{"swagger":"2.0","info":{"description":"Veracode Policy API Documentation\nUse one of the following base URLs depending on the region for your account:\n* https://api.veracode.com/ - Veracode Global Region (default)\n* https://api.veracode.eu/ - Veracode European Region\n* https://api.veracode.us/ - Veracode US Federal Region","version":"1.0","title":"Veracode Policy API Specification","termsOfService":"urn:tos","contact":{},"license":{"name":"Apache 2.0","url":"http://www.apache.org/licenses/LICENSE-2.0"}},"host":"api.veracode.com","basePath":"/","tags":[{"name":"Policy Settings information API","description":"Policy Settings Information API."},{"name":"Policy information API","description":"Policy information API."},{"name":"Policy settings information API","description":"Policy Settings Controller."},{"name":"SCA Component License Information API","description":"List component software licenses associated with Veracode SCA security policies."}],"paths":{"/appsec/v1/policies":{"get":{"tags":["Policy information API"],"summary":"getPolicies","description":"Returns a list of policies. The individual policy has links to policy evaluations performed against this policy.","operationId":"getPoliciesUsingGET","produces":["application/json"],"parameters":[{"name":"category","in":"query","description":"The category of the policy.","required":false,"type":"string","allowEmptyValue":false,"enum":["APPLICATION","COMPONENT"]},{"name":"legacy_policy_id","in":"query","description":"Filters results based on the ID of the custom policy created in the Veracode Platform.","required":false,"type":"integer","format":"int32","allowEmptyValue":false},{"name":"name","in":"query","description":"Filter on the policy name.","required":false,"type":"string","allowEmptyValue":false},{"name":"name_exact","in":"query","description":"Use this flag to enforce exact name-matching when filtering on the policy name.","required":false,"type":"boolean","allowEmptyValue":false},{"name":"page","in":"query","description":"Page number. Defaults to 0.","required":false,"type":"integer","format":"int32","allowEmptyValue":false},{"name":"public_policy","in":"query","description":"Filters results to include or exclude a public Veracode policy.","required":false,"type":"boolean","default":true,"allowEmptyValue":false},{"name":"size","in":"query","description":"Page size (1-500, defaults to 50).","required":false,"type":"integer","format":"int32","allowEmptyValue":false},{"name":"vendor_policy","in":"query","description":"Filters results to those with or without a vendor policy flag.","required":false,"type":"boolean","allowEmptyValue":false}],"responses":{"200":{"description":"You have successfully submitted your request.","schema":{"$ref":"#/definitions/PagedResourceOfPolicyVersion"}},"400":{"description":"Invalid request. Verify all the components of your request and try again."},"401":{"description":"You are not authorized to perform this action."},"403":{"description":"Access denied. You are not authorized to make this request."},"404":{"description":"This page does not exist. Verify the URI and try again."},"429":{"description":"Request limit exceeded. You have sent too many requests in a single time period. Submit your request again later."},"500":{"description":"Server-side error. Please try again later."}},"deprecated":false},"post":{"tags":["Policy information API"],"summary":"Create a new policy.","description":"Create and return the new policy.","operationId":"createPolicyUsingPOST","consumes":["application/json"],"produces":["application/json"],"parameters":[{"in":"body","name":"policy","description":"The policy object to be created.","required":true,"schema":{"$ref":"#/definitions/PolicyVersion"}}],"responses":{"200":{"description":"You have successfully submitted your request.","schema":{"$ref":"#/definitions/PolicyVersion"}},"400":{"description":"Invalid request. Verify all the components of your request and try again."},"401":{"description":"You are not authorized to perform this action."},"403":{"description":"Access denied. You are not authorized to make this request."},"404":{"description":"This page does not exist. Verify the URI and try again."},"429":{"description":"Request limit exceeded. You have sent too many requests in a single time period. Submit your request again later."},"500":{"description":"Server-side error. Please try again later."}},"deprecated":false}},"/appsec/v1/policies/{policyGuid}":{"get":{"tags":["Policy information API"],"summary":"getPolicy","description":"Returns the latest version of the policy.","operationId":"getPolicyUsingGET","produces":["application/json"],"parameters":[{"name":"policyGuid","in":"path","description":"The unique identifier of the policy (GUID).","required":true,"type":"string"}],"responses":{"200":{"description":"You have successfully submitted your request.","schema":{"$ref":"#/definitions/PolicyVersion"}},"401":{"description":"You are not authorized to perform this action."},"403":{"description":"Access denied. You are not authorized to make this request."},"404":{"description":"The policy was not found."},"429":{"description":"Request limit exceeded. You have sent too many requests in a single time period. Submit your request again later."},"500":{"description":"Server-side error. Please try again later."}},"deprecated":false},"put":{"tags":["Policy information API"],"summary":"Update the policy.","description":"Creates a new version of the policy that is the default when making a GET call to this endpoint.","operationId":"updatePolicyUsingPUT","consumes":["application/json"],"produces":["application/json"],"parameters":[{"in":"body","name":"policy","description":"The new policy version to be created.","required":true,"schema":{"$ref":"#/definitions/PolicyVersion"}},{"name":"policyGuid","in":"path","description":"The unique identifier of the policy (GUID).","required":true,"type":"string"}],"responses":{"200":{"description":"You have successfully submitted your request.","schema":{"$ref":"#/definitions/PolicyVersion"}},"400":{"description":"Invalid request. Verify all the components of your request and try again."},"401":{"description":"You are not authorized to perform this action."},"403":{"description":"Access denied. You are not authorized to make this request."},"404":{"description":"This page does not exist. Verify the URI and try again."},"429":{"description":"Request limit exceeded. You have sent too many requests in a single time period. Submit your request again later."},"500":{"description":"Server-side error. Please try again later."}},"deprecated":false},"delete":{"tags":["Policy information API"],"summary":"Delete all versions of the policy.","description":"Delete the policy. This deletion only succeeds if the policy is not associated with any applications or policy evaluations.","operationId":"deletePolicyUsingDELETE","produces":["application/json"],"parameters":[{"name":"policyGuid","in":"path","description":"The unique identifier of the policy (GUID).","required":true,"type":"string"},{"name":"replace_with_default_policy","in":"query","description":"Replace with the default policy, based on the business criticality of the application.","required":false,"type":"boolean","default":false,"allowEmptyValue":false},{"name":"replacement_GUID","in":"query","description":"The unique identifier of the replacement policy (GUID).","required":false,"type":"string","allowEmptyValue":false}],"responses":{"200":{"description":"You have successfully submitted your request.","schema":{"type":"object"}},"400":{"description":"Invalid request. Verify all the components of your request and try again."},"401":{"description":"You are not authorized to perform this action."},"403":{"description":"Access denied. You are not authorized to make this request."},"404":{"description":"This page does not exist. Verify the URI and try again."},"429":{"description":"Request limit exceeded. You have sent too many requests in a single time period. Submit your request again later."},"500":{"description":"Server-side error. Please try again later."}},"deprecated":false}},"/appsec/v1/policies/{policyGuid}/versions":{"get":{"tags":["Policy information API"],"summary":"getPolicyVersions","description":"Returns a list of all versions of the policy. Past versions of the policy that are not currently linked to an application or evaluation are deleted and do not appear in this list.","operationId":"getPolicyVersionsUsingGET","produces":["application/json"],"parameters":[{"name":"page","in":"query","description":"Page number. Defaults to 0.","required":false,"type":"integer","format":"int32","allowEmptyValue":false},{"name":"policyGuid","in":"path","description":"The unique identifier of the policy (GUID).","required":true,"type":"string"},{"name":"size","in":"query","description":"Page size (1-500). Defaults to 50.","required":false,"type":"integer","format":"int32","allowEmptyValue":false}],"responses":{"200":{"description":"You have successfully submitted your request.","schema":{"$ref":"#/definitions/PagedResourceOfPolicyVersion"}},"400":{"description":"Invalid request. Verify all the components of your request and try again."},"401":{"description":"You are not authorized to perform this action."},"403":{"description":"Access denied. You are not authorized to make this request."},"404":{"description":"This page does not exist. Verify the URI and try again."},"429":{"description":"Request limit exceeded. You have sent too many requests in a single time period. Submit your request again later."},"500":{"description":"Server-side error. Please try again later."}},"deprecated":false}},"/appsec/v1/policies/{policyGuid}/versions/{version}":{"get":{"tags":["Policy information API"],"summary":"getPolicyVersion","description":"Returns the requested policy version.","operationId":"getPolicyVersionUsingGET","produces":["application/json"],"parameters":[{"name":"policyGuid","in":"path","description":"The unique identifier of the policy (GUID).","required":true,"type":"string"},{"name":"version","in":"path","description":"The specific version of this policy. The default is the last version provided.","required":true,"type":"integer","format":"int32"}],"responses":{"200":{"description":"You have successfully submitted your request.","schema":{"$ref":"#/definitions/PolicyVersion"}},"401":{"description":"You are not authorized to perform this action."},"403":{"description":"Access denied. You are not authorized to make this request."},"404":{"description":"This page does not exist. Verify the URI and try again."},"429":{"description":"Request limit exceeded. You have sent too many requests in a single time period. Submit your request again later."},"500":{"description":"Server-side error. Please try again later."}},"deprecated":false}},"/appsec/v1/policy_settings":{"get":{"tags":["Application policy settings information API","Policy settings information API"],"summary":"Retrieve the application policy Settings","operationId":"getPolicySettingsUsingGET","produces":["application/json"],"responses":{"200":{"description":"You have successfully submitted your request.","schema":{"$ref":"#/definitions/PagedResourceOfPolicySetting"}},"400":{"description":"Invalid request. Verify all the components of your request and try again."},"401":{"description":"You are not authorized to perform this action."},"403":{"description":"Access denied. You are not authorized to make this request."},"404":{"description":"This page does not exist. Verify the URI and try again."},"429":{"description":"Request limit exceeded. You have sent too many requests in a single time period. Submit your request again later."},"500":{"description":"Server-side error. Please try again later."}},"deprecated":false},"put":{"tags":["Application policy settings information API","Policy settings information API"],"summary":"Update the application policy settings.","description":"Updates the application default policy setting for a business criticality for the organization.","operationId":"updatePolicySettingsUsingPUT","consumes":["application/json"],"produces":["application/json"],"parameters":[{"in":"body","name":"policySettings","description":"Application policy settings that you are updating.","required":true,"schema":{"type":"array","items":{"$ref":"#/definitions/PolicySetting"}}}],"responses":{"200":{"description":"You have successfully submitted your request.","schema":{"type":"array","items":{"$ref":"#/definitions/PolicySetting"}}},"400":{"description":"Invalid request. Verify all the components of your request and try again."},"401":{"description":"You are not authorized to perform this action."},"403":{"description":"Access denied. You are not authorized to make this request."},"404":{"description":"This page does not exist. Verify the URI and try again."},"429":{"description":"Request limit exceeded. You have sent too many requests in a single time period. Submit your request again later."},"500":{"description":"Server-side error. Please try again later."}},"deprecated":false}},"/appsec/v1/policy_settings/components":{"get":{"tags":["Default pre-build component policy settings information API","Policy settings information API"],"summary":"Retrieve the default pre-build component policies.","operationId":"getComponentsUsingGET","produces":["application/json"],"responses":{"200":{"description":"You have successfully submitted your request.","schema":{"$ref":"#/definitions/PagedResourceOfComponentPolicySetting"}},"400":{"description":"Invalid request. Verify all the components of your request and try again."},"401":{"description":"You are not authorized to perform this action."},"403":{"description":"Access denied. You are not authorized to make this request."},"404":{"description":"This page does not exist. Verify the URI and try again."},"429":{"description":"Request limit exceeded. You have sent too many requests in a single time period. Submit your request again later."},"500":{"description":"Server-side error. Please try again later."}},"deprecated":false},"put":{"tags":["Default pre-build component policy settings update API","Policy settings information API"],"summary":"Update the default pre-build component policies.","description":"Updates the pre-build component default policies of an organization.","operationId":"updateComponentsUsingPUT","consumes":["application/json"],"produces":["application/json"],"parameters":[{"in":"body","name":"componentPolicySettings","description":"Pre-build component policy settings that you are updating.","required":true,"schema":{"type":"array","items":{"$ref":"#/definitions/ComponentPolicySetting"}}}],"responses":{"200":{"description":"Your request was successful.","schema":{"type":"array","items":{"$ref":"#/definitions/ComponentPolicySetting"}}},"400":{"description":"Invalid request. Verify all the components of your request and try again."},"401":{"description":"You are not authorized to perform this action."},"403":{"description":"Access denied. You are not authorized to make this request."},"404":{"description":"This page does not exist. Verify the URI and try again."},"429":{"description":"Request limit exceeded. You have sent too many requests in a single time period. Submit your request again later."},"500":{"description":"Server-side error. Please try again later."}},"deprecated":false}},"/appsec/v1/policy_settings/thirdparty_libraries":{"get":{"tags":["Default pre-build component policy settings information API","Policy settings information API"],"summary":"Retrieve the default pre-build component policies.","operationId":"getThirdpartyLibrariesUsingGET","produces":["application/json"],"responses":{"200":{"description":"You have successfully submitted your request.","schema":{"$ref":"#/definitions/PagedResourceOfComponentPolicySetting"}},"400":{"description":"Invalid request. Verify all the components of your request and try again."},"401":{"description":"You are not authorized to perform this action."},"403":{"description":"Access denied. You are not authorized to make this request."},"404":{"description":"This page does not exist. Verify the URI and try again."},"429":{"description":"Request limit exceeded. You have sent too many requests in a single time period. Submit your request again later."},"500":{"description":"Server-side error. Please try again later."}},"deprecated":false},"put":{"tags":["Default pre-build component policy settings update API","Policy settings information API"],"summary":"Update the default pre-build component policies.","description":"Updates the pre-build component default policies of an organization.","operationId":"updateThirdpartyLibrariesUsingPUT","consumes":["application/json"],"produces":["application/json"],"parameters":[{"in":"body","name":"componentPolicySettings","description":"Pre-build component policy settings that you are updating.","required":true,"schema":{"type":"array","items":{"$ref":"#/definitions/ComponentPolicySetting"}}}],"responses":{"200":{"description":"Your request was successful.","schema":{"type":"array","items":{"$ref":"#/definitions/ComponentPolicySetting"}}},"400":{"description":"Invalid request. Verify all the components of your request and try again."},"401":{"description":"You are not authorized to perform this action."},"403":{"description":"Access denied. You are not authorized to make this request."},"404":{"description":"This page does not exist. Verify the URI and try again."},"429":{"description":"Request limit exceeded. You have sent too many requests in a single time period. Submit your request again later."},"500":{"description":"Server-side error. Please try again later."}},"deprecated":false}},"/appsec/v1/policy_licenselist":{"get":{"tags":["SCA Component License Information API"],"summary":"Get a list of component licenses for SCA.","description":"Returns a list component licenses associated with SCA security policies.","operationId":"getScaLicensesUsingGET","produces":["application/json"],"parameters":[{"name":"page","in":"query","required":false,"type":"integer","format":"int32"},{"name":"size","in":"query","required":false,"type":"integer","format":"int32"},{"name":"sort","in":"query","required":false,"type":"string"}],"responses":{"200":{"description":"You have successfully submitted your request.","schema":{"$ref":"#/definitions/PagedResourceOfScaLicenseSummary"}},"400":{"description":"Invalid request. Verify all the components of your request and try again."},"401":{"description":"You are not authorized to perform this action."},"403":{"description":"Access denied. You are not authorized to make this request."},"404":{"description":"This page does not exist. Verify the URI and try again."},"429":{"description":"Request limit exceeded. You have sent too many requests in a single time period. Submit your request again later."},"500":{"description":"Server-side error. Please try again later."}}}}},"definitions":{"ComponentPolicySetting":{"type":"object","properties":{"modified":{"type":"string","format":"date-time","description":"The date and time when the pre-build component default policy setting was modified. The date and time format is per RFC3339 and ISO-8601. Timezone is UTC."},"modified_by":{"type":"string","description":"Name of the user who most recently modified the pre-build component default policy setting."},"plugin":{"type":"string","description":"Plugin","enum":["nexus"]},"policy_guid":{"type":"string","description":"Unique identifier for the pre-build component policy."}},"title":"ComponentPolicySetting"},"Coordinate":{"type":"object","properties":{"coordinate1":{"type":"string","description":"The name of the first coordinate."},"coordinate2":{"type":"string","description":"The name of the second coordinate."},"created_by":{"type":"string","description":"The name of the user who created this coordinate."},"created_date":{"type":"string","format":"date-time","description":"The date when the user created the coordinate."},"finding_rule":{"$ref":"#/definitions/FindingRule"},"repo_type":{"type":"string","description":"The repository type of the coordinate; for example, nexus, or maven."},"version":{"type":"string","description":"The version of the coordinate."}},"title":"Coordinate"},"CustomSeverity":{"type":"object","properties":{"cwe":{"type":"integer","format":"int32","description":"The CWE associated with the custom severity."},"severity":{"type":"integer","format":"int32","description":"The severity to be applied to findings of the specified CWE."}},"title":"CustomSeverity"},"EmbeddedComponentPolicySetting":{"type":"object","properties":{"component_policy_settings":{"type":"array","items":{"$ref":"#/definitions/ComponentPolicySetting"}}},"title":"EmbeddedComponentPolicySetting"},"EmbeddedPolicySetting":{"type":"object","properties":{"policy_settings":{"type":"array","items":{"$ref":"#/definitions/PolicySetting"}}},"title":"EmbeddedPolicySetting"},"EmbeddedPolicyVersion":{"type":"object","properties":{"policy_versions":{"type":"array","items":{"$ref":"#/definitions/PolicyVersion"}}},"title":"EmbeddedPolicyVersion"},"EmbeddedScaLicenseSummary":{"type":"object","properties":{"sca_license_summaries":{"type":"array","items":{"$ref":"#/definitions/ScaLicenseSummary"}}},"title":"EmbeddedScaLicenseSummary"},"FindingRule":{"type":"object","properties":{"coordinates":{"type":"array","items":{"$ref":"#/definitions/Coordinate"}},"policy_version":{"$ref":"#/definitions/PolicyVersion"},"scan_type":{"type":"array","description":"The type of scan on which to enforce the rule.","items":{"type":"string","enum":["STATIC","DYNAMIC","MANUAL","SCA","MOBILE","ALL","DYNAMICMP"]}},"type":{"type":"string","description":"Specify the supported rule types.","enum":["FAIL_ALL","CWE","CATEGORY","MAX_SEVERITY","CVSS","CVE","BLACKLIST","MIN_SCORE","SECURITY_STANDARD","LICENSE_RISK","ALLOWLIST"]},"advanced_options":{"$ref":"#/definitions/FindingRuleAdvancedOptions"},"value":{"type":"string","description":"The value of this specific rule, such as the minimal score value. This value does not apply to the FAIL_ALL rule type."}},"title":"FindingRule"},"Link":{"type":"object","properties":{"deprecation":{"type":"string","xml":{"name":"deprecation","attribute":true,"wrapped":false}},"href":{"type":"string","xml":{"name":"href","attribute":true,"wrapped":false}},"hreflang":{"type":"string","xml":{"name":"hreflang","attribute":true,"wrapped":false}},"media":{"type":"string","xml":{"name":"media","attribute":true,"wrapped":false}},"rel":{"type":"string","xml":{"name":"rel","attribute":true,"wrapped":false}},"templated":{"type":"boolean"},"title":{"type":"string","xml":{"name":"title","attribute":true,"wrapped":false}},"type":{"type":"string","xml":{"name":"type","attribute":true,"wrapped":false}}},"title":"Link"},"PagedResourceOfComponentPolicySetting":{"type":"object","properties":{"_embedded":{"$ref":"#/definitions/EmbeddedComponentPolicySetting"},"_links":{"$ref":"#/definitions/Link"}},"title":"PagedResourceOfComponentPolicySetting"},"PagedResourceOfPolicySetting":{"type":"object","properties":{"_embedded":{"$ref":"#/definitions/EmbeddedPolicySetting"},"_links":{"$ref":"#/definitions/Link"}},"title":"PagedResourceOfPolicySetting"},"PagedResourceOfPolicyVersion":{"type":"object","properties":{"_embedded":{"$ref":"#/definitions/EmbeddedPolicyVersion"},"_links":{"$ref":"#/definitions/Link"}},"title":"PagedResourceOfPolicyVersion"},"PagedResourceOfScaLicenseSummary":{"type":"object","properties":{"__embedded":{"$ref":"#/definitions/EmbeddedScaLicenseSummary"},"__links":{"$ref":"#/definitions/Link"}},"title":"PagedResourceOfScaLicenseSummary"},"PolicyApplicableRules":{"type":"object","properties":{"custom_severity":{"type":"boolean"},"finding_rules":{"type":"array","items":{"type":"string","enum":["FAIL_ALL","CWE","CATEGORY","MAX_SEVERITY","CVSS","CVE","BLACKLIST","MIN_SCORE","SECURITY_STANDARD","LICENSE_RISK","ALLOWLIST"]}},"frequency_scan_types":{"type":"array","items":{"type":"string","enum":["STATIC","DYNAMIC","MANUAL","SCA","ANY"]}},"grace_period_types":{"type":"array","items":{"type":"string","enum":["MINIMUM_SCAN_SCORE","COMPONENT_BLACKLIST_ENFORCEMENT","FINDING_BY_SEVERITY"]}},"sca_only":{"type":"boolean"}},"title":"PolicyApplicableRules"},"PolicySetting":{"type":"object","properties":{"business_criticality":{"type":"string","description":"The business criticality for which this policy is the default policy.","enum":["VERY_HIGH","HIGH","MEDIUM","LOW","VERY_LOW"]},"modified":{"type":"string","format":"date-time","description":"The date and time when the application default policy setting was modified. The date and time format is per RFC3339 and ISO-8601. Timezone is UTC."},"policy_guid":{"type":"string","description":"Unique identifier for the application policy."}},"title":"PolicySetting"},"PolicyVersion":{"type":"object","properties":{"category":{"type":"string","description":"The category of the policy.","enum":["APPLICATION","COMPONENT"]},"created":{"type":"string","format":"date-time","description":"The date and time the application was created. The date/time is formatted as per RFC3339 and ISO-8601. The timezone is UTC."},"custom_severities":{"type":"array","description":"A set of severity overrides for use with this policy.","items":{"$ref":"#/definitions/CustomSeverity"}},"description":{"type":"string","description":"A description of the policy."},"evaluation_date":{"type":"string","format":"date-time","description":"The date from which to define the evaluation timeframe, which determines when findings that violate rules should cause an application to not pass policy."},"evaluation_date_type":{"type":"string","description":"Specify the supported evaluation date type as before or after the specified date.","enum":["BEFORE","AFTER"]},"finding_rules":{"type":"array","description":"A set of rules to be evaluated against the scan findings.","items":{"$ref":"#/definitions/FindingRule"}},"sca_grace_periods":{"$ref":"#/definitions/ScaGracePeriods"},"guid":{"type":"string","description":"Unique identifier for the policy."},"modified_by":{"type":"string","description":"The username of the user who most recently modified the policy."},"name":{"type":"string","description":"Policy name."},"organization_id":{"type":"integer","format":"int32","description":"The organization with which the policy is associated. If no value is provided, the results are publicly visible."},"sca_blacklist_grace_period":{"type":"integer","format":"int32","description":"The grace period in number of days permitted for the component blocklist enforcement rule type.","deprecated":true},"scan_frequency_rules":{"type":"array","description":"The set of scan frequencies to be evaluated.","items":{"$ref":"#/definitions/ScanFrequency"}},"score_grace_period":{"type":"integer","format":"int32","description":"The number of days grace period allowed for the policy score."},"sev0_grace_period":{"type":"integer","format":"int32","description":"The number of days grace period allowed for findings of severity 0."},"sev1_grace_period":{"type":"integer","format":"int32","description":"The number of days grace period allowed for findings of severity 1."},"sev2_grace_period":{"type":"integer","format":"int32","description":"The number of days grace period allowed for findings of severity 2."},"sev3_grace_period":{"type":"integer","format":"int32","description":"The number of days grace period allowed for findings of severity 3."},"sev4_grace_period":{"type":"integer","format":"int32","description":"The number of days grace period allowed for findings of severity 4."},"sev5_grace_period":{"type":"integer","format":"int32","description":"The number of days grace period allowed for findings of severity 5."},"type":{"type":"string","description":"The evaluation policy type.","enum":["BUILTIN","VERACODELEVEL","CUSTOMER","STANDARD"]},"vendor_policy":{"type":"boolean","description":"Use this flag to indicate if this policy is to be visible and available for policy evaluation by a vendor organization."},"version":{"type":"integer","format":"int32","description":"The version of this policy."}},"title":"PolicyVersion"},"ScaGracePeriods":{"type":"object","properties":{"sca_blacklist_grace_period":{"type":"integer","format":"int32","description":"The grace period in number of days permitted for the component blocklist enforcement rule type."},"license_risk_grace_period":{"type":"integer","format":"int32","description":"The grace period in number of days permitted for the component license risk rule type."},"severity_grace_period":{"type":"object","description":"The grace period in number of days permitted for the findings by severity rule type.","$ref":"#/definitions/SeverityGracePeriods"},"cvss_score_grace_period":{"type":"array","description":"The grace period in number of days permitted for the vulnerability CVSS score rule type.","items":{"$ref":"#/definitions/CvssScoreGracePeriod"}}},"title":"ScaGracePeriods"},"SeverityGracePeriods":{"type":"object","properties":{"sev0_grace_period":{"type":"integer","format":"int32","description":"The grace period in number of days permitted for findings with a severity of 0."},"sev1_grace_period":{"type":"integer","format":"int32","description":"The grace period in number of days permitted for findings with a severity of 1."},"sev2_grace_period":{"type":"integer","format":"int32","description":"The grace period in number of days permitted for findings with a severity of 2."},"sev3_grace_period":{"type":"integer","format":"int32","description":"The grace period in number of days permitted for findings with a severity of 3."},"sev4_grace_period":{"type":"integer","format":"int32","description":"The grace period in number of days permitted for findings with a severity of 4."}},"title":"SeverityGracePeriods"},"CvssScoreGracePeriod":{"type":"object","properties":{"upper":{"type":"number","format":"Double","description":"The upper CVSS score limit for this grace period. Value must be between 0.0 and 10.0."},"lower":{"type":"number","description":"The lower CVSS score limit for this grace period. Value must be between 0.0 and 10.0."},"days":{"type":"integer","description":"The grace period in number of days permitted for findings with a CVSS score within the range between the upper and lower CVSS score values."}},"title":"CvssScoreGracePeriod"},"ScanFrequency":{"type":"object","properties":{"frequency":{"type":"string","description":"The frequency by which the organization is required to scan.","enum":["NOT_REQUIRED","ONCE","WEEKLY","MONTHLY","QUARTERLY","SEMI_ANNUALLY","ANNUALLY","EVERY_18_MONTHS","EVERY_2_YEARS","EVERY_3_YEARS","SET_BY_VL_POLICY","SET_BY_POLICY_RULE"]},"policy_version":{"$ref":"#/definitions/PolicyVersion"},"scan_type":{"type":"string","description":"The type of scan on which to enforce the rule.","enum":["STATIC","DYNAMIC","MANUAL","SCA","ANY"]}},"title":"ScanFrequency"},"FindingRuleAdvancedOptions":{"type":"object","properties":{"all_licenses_must_meet_requirement":{"type":"boolean","description":"Set to true to specify that component licenses must meet all policy rule requirements."},"allowed_nonoss_licenses":{"type":"boolean","description":"Set to true to allow licenses that are not open-source (OSS)."},"finding_rule":{"$ref":"#/definitions/FindingRule"},"is_blocklist":{"type":"boolean","description":"Set to true to add the selected list of licenses to the blocklist."},"selected_licenses":{"type":"array","description":"List all selected licenses.","uniqueItems":true,"items":{"$ref":"#/definitions/ScaLicenseSummary"}}},"title":"FindingRuleAdvancedOptions"},"ScaLicenseSummary":{"type":"object","required":["spdx_id"],"properties":{"full_name":{"type":"string","description":"Full name of the license."},"name":{"type":"string","description":"Short name of the license."},"risk":{"type":"string","description":"Risk rating of the license. Values are Low, Medium, High, or Unknown."},"spdx_id":{"type":"string","description":"SPDX identifier for the license."},"url":{"type":"string","description":"URL to the license on the spdx.org website."}},"title":"ScaLicenseSummary"}}}