Snyk API API

Overview

The Snyk API is available to customers on [Business and Enterprise plans](https://snyk.io/plans) and allows you to programatically integrate with Snyk. ## REST API We are in the process of building a new, improved API (`https://api.snyk.io/rest`) built using the OpenAPI and JSON API standards. We welcome you to try it out as we shape and release endpoints until it, ultimately, becomes a full replacement for our current API. Looking for our REST API docs? Please head over to [https://apidocs.snyk.io](https://apidocs.snyk.io) ## API vs CLI vs Snyk integration The API detailed below has the ability to test a package for issues, as they are defined by Snyk. It is important to note that for many package managers, using this API will be less accurate than running the [Snyk CLI](https://snyk.io/docs/using-snyk) as part of your build pipe, or just using it locally on your package. The reason for this is that more than one package version fit the requirements given in manifest files. Running the CLI locally tests the actual deployed code, and has an accurate snapshot of the dependency versions in use, while the API can only infer it, with inferior accuracy. It should be noted that the Snyk CLI has the ability to output machine-readable JSON output (with the `--json` flag to `snyk test`). A third option, is to allow Snyk access to your development flow via the existing [Snyk integrations](https://snyk.io/docs/). The advantage to this approach is having Snyk monitor every new pull request, and suggest fixes by opening new pull requests. This can be achieved either by integrating Snyk directly to your source code management (SCM) tool, or via a broker to allow greater security and auditability. If those are not viable options, this API is your best choice. ## API url The base URL for all API endpoints is https://api.snyk.io/api/v1/ ## Authorization To use this API, you must get your token from Snyk. It can be seen on https://snyk.io/account/ after you register with Snyk and login. The token should be supplied in an `Authorization` header with the token, preceded by `token`: ```http Authorization: token API_KEY ``` Otherwise, a 401 "Unauthorized" response will be returned. ```http HTTP/1.1 401 Unauthorized { "code": 401, "error": "Not authorised", "message": "Not authorised" } ``` ## Overview and entities The API is a REST API. It has the following entities: ### Test result The test result is the object returned from the API giving the results of testing a package for issues. It has the following fields: | Property | Type | Description | Example | |----------------:|---------|-------------------------------------------------------|-----------------------------------------------------------------| | ok | boolean | Does this package have one or more issues? | false | | issues | object | The issues found. See below for details. | See below | | dependencyCount | number | The number of dependencies the package has. | 9 | | org | object | The organization this test was carried out for. | {"name": "anOrg", "id": "5d7013d9-2a57-4c89-993c-0304d960193c"} | | licensesPolicy | object | The organization's licenses policy used for this test | See in the examples | | packageManager | string | The package manager for this package | "maven" | | | | | | ### Issue An issue is either a vulnerability or a license issue, according to the organization's policy. It has the following fields: | Property | Type | Description | Example | |---------------:|---------------|----------------------------------------------------------------------------------------------------------------------------|----------------------------------------| | id | string | The issue ID | "SNYK-JS-BACKBONE-10054" | | url | string | A link to the issue details on snyk.io | "https://snyk.io/vuln/SNYK-JS-BACKBONE-10054 | | title | string | The issue title | "Cross Site Scripting" | | type | string | The issue type: "license" or "vulnerability". | "license" | | paths | array | The paths to the

Snyk API is a development API from snyk.io. It needs no API key. It is served over HTTPS. Its OpenAPI description documents 103 endpoints.

At a glance

Authentication

No auth

HTTPS

Yes

CORS

Unknown

Category

Development

Base URL

https://api.snyk.io/api/v1

Version

1.0.0

Endpoints

103

OpenAPI

Specification ↗

Spec updated

2023-03-06

Make a first request

Replace the placeholders; the documentation says exactly where credentials go.

curl -X GET "https://api.snyk.io/api/v1/orgs" \
  -H "Accept: application/json"

const response = await fetch("https://api.snyk.io/api/v1/orgs", {
  method: "GET",
  headers: {
    "Accept": "application/json",
  },
});
const data = await response.json();
console.log(data);

import requests

response = requests.request(
    "GET",
    "https://api.snyk.io/api/v1/orgs",
    headers={
    "Accept": "application/json",
    },
    timeout=30,
)
print(response.json())

Endpoints

Questions