Page Comparison

Overview

To access the new and recommended version of the WhiteSource HTTP API, use HTTP API v1.1.

This document describes the old version of the WhiteSource HTTP API. The API URL can be obtained by copying the 'WhiteSource Server URL' which can be retrieved from your 'Profile' page on the 'Server URLs' panel. Then, add the '/api' path to it. For example: https://saas.whitesourcesoftware.com/api.

...

Fields

...

Notice: For version numbers, if there are 3 or more version parts, (E.g. x.y.z or x.y.z.w) both x and y are considered a major version (x.y).
             If there are 2 major parts (x.y), then x is considered a major version.

...

{
	"licenseHistogram" : {
		"Apache 2.0" : 2,
		"BSD 3" : 2,
		"GPL 3.0" : 1,
	}
}

Get All Products

Receives an orgToken and returns all products in the organization; name and token of each.

Request

{
  "requestType":"getAllProducts",
  "orgToken":"org_token"
}

Response

{
    "products": [
        {
            "productName": "Product A",
            "productToken": "product_a_token"
        },
        {
            "productName": "Product B",
            "productToken": "product_b_token"
        }
    ],
    "message": "Success"
}

Get All Projects

Receives a productToken and returns all projects in the product; name and token of each.

Request

{
  "requestType":"getAllProjects",
  "productToken":"product_token"
}

Response

{
    "projects": [
        {
            "projectName": "project_a",
            "projectToken": "project_a_token"
        },
        {
            "projectName": "project_b",
            "projectToken": "project_b_token"
        }
    ],
    "message": "Success"
}

...

{
	"projectTags":[
    	{
			"name": "My Project 1",
			"token": "project_token_1",
			"tags":{
				"Component": "Database",
				"Module": "Server"
			}
		},
		{
			"name": "My Project 2",
			"token": "project_token_2",
			"tags":{}
		}
	]
}

Save Project Tags

Save project tags by key, value.

...

• Content-Type = application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
• Content-Disposition: attachment; filename=<project name>.xslx

Change Log Report

Get organization level Change Log Report in various formats.

Request 

{
      "userKey": "user_key", 
      "orgToken": "organization_api_key",
      "requestType": "getChangesReport",
	  "startDateTime": "2018-01-01 10:02:00"
}

...

Get organization, product or project level alerts reports in Excel format.

Organization

{
	"requestType" : "getOrganizationAlertsReport",
	"orgToken" : "organization_api_key",
	"format" : "xlsx"
}

...

Get Project Hierarchy

...

Get Project Inventory

...

1. vulnerability - the name of the vulnerability (e.g. CVE-2008-0983).

2. type - the type of fix available, can be one of:

1. CHANGE_FILES

2. PATCH

3. UPGRADE_VERSION

3. vulnerabilityFixOrigin - the site, service or provider of the fix, can be one of:

1. GITHUB_COMMIT

2. JIRA

3. BUGZILLA

4. NODE_SECURITY_ADVISORY

5. PIVOTAL_VULNERABILITY_REPORT

6. FFMPEG_SECURITY

7. STRUTS_SECURITY_BULLETIN

8. XFORCE_VULNERABILITY_REPORT

9. SECURITY_TRACKER

10. WHITESOURCE_EXPERT - Used whenever a WhiteSource security researcher discovers that a vulnerability can be fixed by upgrading to a newer version, and there are no other sources for the vulnerability fix.

4. url - the URL of the fix.

5. fixResolution - the fix resolution. Depending on the origin the fixResolution field may vary:

1. GITHUB_COMMIT - comma separated file names to change.

2. JIRA - comma separated list of versions, e.g. “1.0.5,1.1.3”.

3. BUGZILLA - comma separated list of versions.

4. NODE_SECURITY_ADVISORY - text taken as-is from the origin, e.g. “>= 1.0.4” or “Upgrade to version 0.2.5 or greater.”

5. PIVOTAL_VULNERABILITY_REPORT - text taken as-is from the origin.

6. FFMPEG_SECURITY - comma separated list of versions.

7. STRUTS_SECURITY_BULLETIN - text taken as-is from the origin, e.g. “Developers should upgrade to Struts 2.0.12”.

8. XFORCE_VULNERABILITY_REPORT - text taken as-is from the origin, e.g. “Refer to ASA-2007-010 for patch, upgrade or suggested workaround information. See References.”.

9. SECURITY_TRACKER - text taken as-is from origin, e.g. “The vendor has issued a fix (2.3.17, 2.4.11).”.

6. date - publish date of the fix (not always available).

7. messsage - the title / description of the fix as taken from the origin.

8. extraData - extra data stored for each fix in key_1=value_1&key_2&value_2 pairs. Depending on the origin the extraData field may vary:

   1. key - the short commit SHA-1.

   2. committerName - the name of the committer.

   3. committerUrl - a link to the committer’s page on GitHub.

   4. committerAvatar - a link to the committer’s avatar.

   1. key - the issue id.

   2. assignee - the person assigned to the issue.

   1. key - the issue id.

   2. assignee - the person assigned to the issue.

   1. key - the advisory id.

   1. key - the report id, which is simply the CVE name.

   1. key - the bulletin id.

   1. key - the report id.

   1. key - the alert id.

1. GITHUB_COMMIT

2. JIRA

3. BUGZILLA

4. NODE_SECURITY_ADVISORY

5. PIVOTAL_VULNERABILITY_REPORT

6. FFMPEG_SECURITY - no extra data available.

7. STRUTS_SECURITY_BULLETIN

8. XFORCE_VULNERABILITY_REPORT

9. SECURITY_TRACKER

...