Snyk

https://docs.snyk.io/
Admin
Snyk is a developer-first security platform that scans code for vulnerabilities and provides...
Tokens:1,602,158
Snippets:12,749
Trust Score:10
Update:1 week ago
Show doc for...
Tokens:
Raw
### Basic Snyk Setup Action workflow

Source: https://docs.snyk.io/developer-tools/integrations/snyk-ci-cd-integrations/github-actions-for-snyk-setup-and-checking-for-vulnerabilities/snyk-setup-action

Installs the Snyk CLI using the `snyk/actions/setup` action in a GitHub Actions workflow. The example sets up a Go environment with `actions/setup-go` and runs `snyk test` with a `SNYK_TOKEN` secret.

```yaml
name: Snyk example 
on: push
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@master
    - uses: snyk/actions/setup@master
    - uses: actions/setup-go@v1
      with:
        go-version: "1.13"
    - name: Snyk test
      run: snyk test
      env:
        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

```

--------------------------------

### Use Snyk Setup action (binary installation)

Source: https://docs.snyk.io/developer-tools/snyk-cli/upgrade-the-snyk-cli

The Snyk Setup action installs the CLI directly from a binary and downloads the latest version by default.

```yaml
- name: Set up Snyk CLI
  uses: snyk/actions/setup@master
```

--------------------------------

### 201 Response - Newly Created App Install

Source: https://docs.snyk.io/developer-tools/snyk-api/reference/apps

Example response for a successful app install, containing the client_id, client_secret, and resource links.

```json
{
  "data": {
    "attributes": {
      "client_id": "123e4567-e89b-12d3-a456-426614174000",
      "client_secret": "text"
    },
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "links": {
      "first": "https://example.com/api/resource",
      "last": "https://example.com/api/resource",
      "next": "https://example.com/api/resource",
      "prev": "https://example.com/api/resource",
      "related": "https://example.com/api/resource",
      "self": "https://example.com/api/resource"
    },
    "relationships": {
      "app": {
        "data": {
          "id": "123e4567-e89b-12d3-a456-426614174000",
          "type": "text"
        }
      }
    },
    "type": "text"
  },
  "jsonapi": {
    "version": "1.0"
  },
  "links": {
    "first": "https://example.com/api/resource?ending_before=v1.eyJpZCI6IjExIn0K",
    "last": "https://example.com/api/resource?starting_after=v1.eyJpZCI6IjMwIn0K",
    "next": "https://example.com/api/resource?starting_after=v1.eyJpZCI6IjEwIn0K"
  }
}
```

--------------------------------

### Get Integration Settings - Example Response

Source: https://docs.snyk.io/snyk-api/reference/integrations-v1

Example response body for the Get Integration Settings endpoint, showing all configurable fields with sample values.

```json
{
  "autoDepUpgradeLimit": 1,
  "autoDepUpgradeIgnoredDependencies": [
    "text"
  ],
  "autoDepUpgradeEnabled": true,
  "autoDepUpgradeMinAge": 1,
  "pullRequestFailOnAnyVulns": true,
  "pullRequestFailOnlyForHighSeverity": true,
  "pullRequestTestCodeEnabled": true,
  "pullRequestTestCodeSeverity": "text",
  "pullRequestTestSecretsEnabled": true,
  "pullRequestTestSecretsSeverity": "text",
  "pullRequestTestEnabled": true,
  "pullRequestAssignment": "text",
  "autoRemediationPrs": {
    "backlogPrsEnabled": true,
    "backlogPrStrategy": null,
    "freshPrsEnabled": true,
    "usePatchRemediation": true
  },
  "manualRemediationPrs": {
    "usePatchRemediation": true
  },
  "dockerfileSCMEnabled": true
}
```

--------------------------------

### Get Integration Settings - Example Response

Source: https://docs.snyk.io/snyk-api/reference/integrations-v1

Example response body for the Get Integration Settings endpoint, showing all configurable fields with sample values.

```json
{
  "autoDepUpgradeLimit": 2,
  "autoDepUpgradeIgnoredDependencies": [],
  "autoDepUpgradeEnabled": false,
  "autoDepUpgradeMinAge": 21,
  "pullRequestTestCodeEnabled": true,
  "pullRequestTestCodeSeverity": "high",
  "pullRequestTestSecretsEnabled": true,
  "pullRequestTestSecretsSeverity": "high",
  "pullRequestTestEnabled": true,
  "pullRequestFailOnAnyVulns": false,
  "pullRequestFailOnlyForHighSeverity": true,
  "pullRequestAssignment": "{\"enabled\":true,\"type\":\"manual\",\"assignees\":[\"username\"]}",
  "autoRemediationPrs": {
    "backlogPrsEnabled": false,
    "backlogPrStrategy": "vuln",
    "freshPrsEnabled": true,
    "usePatchRemediation": false
  },
  "manualRemediationPrs": {
    "useManualPatchRemediation": false
  },
  "dockerfileSCMEnabled": true
}
```

--------------------------------

### GET /rest/orgs/{org_id}/apps/installs - 200 response

Source: https://docs.snyk.io/developer-tools/snyk-api/reference/apps

Example JSON response for a successful request, containing a list of installed apps with attributes, relationships, and pagination links.

```json
{
  "data": [
    {
      "attributes": {
        "client_id": "941b423a-e0a0-4a33-a7ca-dd9e9e6bd8cf",
        "installed_at": "2024-04-30T16:07:46.230044Z"
      },
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "links": {
        "first": "https://example.com/api/resource",
        "last": "https://example.com/api/resource",
        "next": "https://example.com/api/resource",
        "prev": "https://example.com/api/resource",
        "related": "https://example.com/api/resource",
        "self": "https://example.com/api/resource"
      },
      "relationships": {
        "app": {
          "data": {
            "attributes": {
              "client_id": "123e4567-e89b-12d3-a456-426614174000",
              "context": "tenant",
              "name": "My App",
              "scopes": [
                "text"
              ]
            },
            "id": "123e4567-e89b-12d3-a456-426614174000",
            "links": {
              "first": "https://example.com/api/resource",
              "last": "https://example.com/api/resource",
              "next": "https://example.com/api/resource",
              "prev": "https://example.com/api/resource",
              "related": "https://example.com/api/resource",
              "self": "https://example.com/api/resource"
            },
            "type": "text"
          }
        }
      },
      "type": "text"
    }
  ],
  "jsonapi": {
    "version": "1.0"
  },
  "links": {
    "first": "https://example.com/api/resource?ending_before=v1.eyJpZCI6IjExIn0K",
    "last": "https://example.com/api/resource?starting_after=v1.eyJpZCI6IjMwIn0K",
    "next": "https://example.com/api/resource?starting_after=v1.eyJpZCI6IjEwIn0K"
  }
}
```

--------------------------------

### Install SDK from prebuilt binaries and verify

Source: https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-iac/current-iac-custom-rules/install-the-sdk

Download the prebuilt binary archive from the SDK's GitHub Releases tab, extract it, and move it to /usr/local/bin. The commands assume an Intel-based macOS and version 0.0.5. Verify with the help command.

```bash
$ tar xzf snyk-iac-rules_0.0.5_Darwin_x86_64.tar.gz 
$ sudo mv snyk-iac-rules /usr/local/bin
```

```bash
snyk-iac-rules --help
```

--------------------------------

### Install and run SDK with Docker

Source: https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-iac/current-iac-custom-rules/install-the-sdk

Pull the Docker image and run the SDK in a container, mounting the current directory to /app. The example shows generating a custom rules template with the template command.

```bash
docker pull snyk/snyk-iac-rules
```

```bash
docker run --rm -v $(pwd):/app snyk/snyk-iac-rules {SDK command}
```

```bash
docker run --rm -v $(pwd):/app snyk/snyk-iac-rules template -r {rule_name}
```

--------------------------------

### GET /rest/orgs/{org_id}/apps/installs - HTTP request

Source: https://docs.snyk.io/developer-tools/snyk-api/reference/apps

Example HTTP request to list installed Snyk Apps for an organization. Requires an API token with the 'View Apps (org.app.read)' permission. The version parameter is required and must be a valid API version.

```http
GET /rest/orgs/{org_id}/apps/installs?version=2026-03-25 HTTP/1.1
Host: api.snyk.io
Authorization: YOUR_API_KEY
Accept: */*

```

--------------------------------

### Quick start: run snyk-jira-sync

Source: https://docs.snyk.io/developer-tools/snyk-apps/tool-jira-tickets-for-new-vulns

Quick start command to run the jira-tickets-for-new-vulns tool. Requires the Snyk Organization ID, a Snyk API Token (service accounts work), and the Jira project key.

```bash
./snyk-jira-sync-<yourplatform> 
    --orgID=<SNYK_ORG_ID>                    // Can find it under settings
    --token=<API Token>                      // Snyk API Token. Service accounts work.
    --jiraProjectKey=<Key>                  // Jira project Key the tickets will be opened against
```

--------------------------------

### GET /orgs/{org_id}/users/{id} response example

Source: https://docs.snyk.io/developer-tools/snyk-api/reference/users

Example 200 response for the 'Get user by ID' endpoint, showing user attributes such as active, email, membership (with created_at and strategy), name, and username, along with jsonapi object.

```JSON
{
  "data": {
    "attributes": {
      "active": true,
      "email": "user@someorg.com",
      "membership": {
        "created_at": "2022-09-14T09:19:29.206Z",
        "strategy": "direct"
      },
      "name": "user",
      "username": "username"
    },
    "id": "55a348e2-c3ad-4bbc-b40e-9b232d1f4121",
    "type": "user"
  },
  "jsonapi": {
    "version": "1.0"
  }
}
```

--------------------------------

### Scan setup.py with --file option

Source: https://docs.snyk.io/supported-languages/supported-languages-list/python/snyk-cli-for-python

The CLI does not automatically discover setup.py; specify it manually using the --file option.

```bash
snyk test --file=setup.py
```

--------------------------------

### Get a package (Early Access)

Source: https://docs.snyk.io/developer-tools/snyk-api/reference/package

This code snippet documents the GET endpoint for retrieving package metadata from the Snyk REST API. It includes the endpoint URL, required parameters, authorization, request example, response example, and error responses.

```APIDOC
## GET /rest/orgs/{org_id}/ecosystems/{ecosystem}/packages/{package_name}

### Description
Get package metadata for a specific package from an ecosystem. This endpoint is in Early Access and supports the npm, pypi, maven, nuget, and golang ecosystems.

### Method
GET

### Endpoint
`https://api.snyk.io/rest/orgs/{org_id}/ecosystems/{ecosystem}/packages/{package_name}`

### Parameters
#### Path Parameters
- **org_id** (string, uuid) - Required - Org ID
- **ecosystem** (string, enum) - Required - The package ecosystem. Possible values: `npm`, `pypi`, `maven`, `nuget`, `golang`
- **package_name** (string) - Required - Package name (URL encoded if needed)

#### Query Parameters
- **version** (string) - Required - Requested API version. Example: `2026-03-25`. Pattern: `^(wip|work-in-progress|experimental|beta|((([0-9]{4})-([0-1][0-9]))-((3[01])|(0[1-9])|([12][0-9]))(~(wip|work-in-progress|experimental|beta))?))$`

### Authorizations
- **APIToken** (string) - Required - API key value must be prefixed with "Token ".

### Request Example
```http
GET /rest/orgs/{org_id}/ecosystems/{ecosystem}/packages/{package_name}?version=2026-03-25 HTTP/1.1
Host: api.snyk.io
Authorization: YOUR_API_KEY
Accept: */*
```

### Response
#### Success Response (200)
Returns package metadata. Response content type: `application/vnd.api+json`.

#### Response Example
```json
{
  "data": {
    "attributes": {
      "ecosystem": "npm",
      "language": "JavaScript",
      "latest_version": "4.19.2",
      "owner_details": {
        "followers_count": 123,
        "location": "somewhere",
        "name": "expressjs",
        "repositories_count": 45,
        "total_stars": 65000
      },
      "package_details": {
        "homepage_url": "https://expressjs.com",
        "registry_url": "https://www.npmjs.com/package/express",
        "repository_url": "https://github.com/expressjs/express"
      },
      "package_health": {
        "community": {
          "description": "...",
          "has_code_of_conduct_file": true,
          "has_contributing_file": true,
          "has_funding_file": false,
          "has_readme_file": true,
          "rating": "Active",
          "stargazers_count": 75000
        },
        "description": "The package has mixed or concerning signals that require closer review. Applies to medium, high, and critical vulnerabilities. Low-severity vulnerabilities are excluded.",
        "maintenance": {
          "description": "...",
          "first_release_published_at": "2010-01-03T00:00:00Z",
          "forks_count": 66,
          "is_archived": false,
          "is_forked": false,
          "latest_release_number": "4.19.2",
          "latest_release_published_at": "2024-10-08T00:00:00Z",
          "lifecycle": "active",
          "rating": "Healthy",
          "total_versions_count": 760
        },
        "overall_rating": "Review recommended",
        "popularity": {
          "dependent_packages_count": 280,
          "dependent_repos_count": 65000,
          "description": "...",
          "downloads": 12000,
          "rating": "Influential project"
        },
        "security": {
          "description": "...",
          "direct_vulnerabilities": true,
          "direct_vulnerabilities_total": 3,
          "rating": "Security issues found"
        }
      },
      "package_id": "pkg:npm/express",
      "package_name": "express"
    },
    "id": "pkg:npm/express",
    "type": "package"
  },
  "jsonapi": {
    "version": "1.0"
  },
  "links": {
    "self": "https://api.snyk.io/rest/orgs/12345/ecosystems/npm/packages/express?version=2024-10-15"
  }
}
```

### Error Responses
- **400** - Bad Request: A parameter provided as a part of the request was invalid.
- **401** - Unauthorized: the request requires an authentication token.
- **403** - Forbidden: the request requires an authentication token with more or different permissions.
- **404** - Not Found: The resource being operated on could not be found.
- **409** - Conflict: The requested operation conflicts with the current state of the resource in some way.
- **500** - Internal Server Error: An error was encountered while attempting to process the request.

### Required Permissions
- `View Organization (org.read)`
```

--------------------------------

### List Deployment contexts - GET /rest/tenants/{tenant_id}/brokers/installs/{install_id}/deployments/{deployment_id}/contexts

Source: https://docs.snyk.io/developer-tools/snyk-api/reference/universal-broker

Lists broker contexts for a given deployment ID. Requires the `View Tenant Details (tenant.read)` permission and an API token prefixed with "Token ". The `version` query parameter is required and must match the pattern `^(wip|work-in-progress|experimental|beta|((([0-9]{4})-([0-1][0-9]))-((3[01])|(0[1-9])|([12][0-9]))(~(wip|work-in-progress|experimental|beta))?))$`.

```http
GET /rest/tenants/{tenant_id}/brokers/installs/{install_id}/deployments/{deployment_id}/contexts?version=2021-06-04 HTTP/1.1
Host: api.snyk.io
Authorization: YOUR_API_KEY
Accept: */*
```

--------------------------------

### Install SDK with Homebrew

Source: https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-iac/current-iac-custom-rules/install-the-sdk

Install the SDK using Homebrew on macOS or Linux. First add the Snyk tap, then install the snyk-iac-rules formula.

```bash
brew tap snyk/tap
```

```bash
brew install snyk-iac-rules
```

--------------------------------

### GET /issues request example

Source: https://docs.snyk.io/developer-tools/snyk-api/reference/issues

Example HTTP GET request to the Snyk API issues endpoint. Use this to retrieve issue data. The response includes fields such as resolved_at, risk factors, severity scores, status, and tool identifiers.

```http
GET /issues HTTP/1.1
Host: api.snyk.io
Accept: application/json
```

--------------------------------

### Set up Broker for an existing integration - response

Source: https://docs.snyk.io/snyk-api/api-endpoints-index-and-tips/examples-for-the-update-existing-integration-endpoint

Example response from the API when enabling Broker. It returns the integration id and a brokerToken.

```json
{
  "id": "9a3e5d90-b782-468a-a042-9a2073736f0b",
  "brokerToken": "4a18d42f-0706-4ad0-b127-24078731fbed"
}
```

--------------------------------

### Install Snyk MCP Server with pre-installed Snyk CLI

Source: https://docs.snyk.io/agent-security/agentic-security-with-snyk-studio/quickstart-guides/augment-code-guide

Command to start the Snyk MCP Server using a pre-installed Snyk CLI. Replace /absolute/path/to/snyk with the actual path to the snyk executable.

```bash
/absolute/path/to/snyk mcp -t stdio
```

--------------------------------

### Install jq and snyk-filter (Ubuntu example)

Source: https://docs.snyk.io/developer-tools/snyk-cli/scan-and-maintain-projects-using-the-cli/cli-tools/snyk-filter

Install jq manually to avoid node-jq errors, set environment variables to skip automatic jq installation, and install snyk-filter globally. Note that snyk-filter does not work with Node version > 12.

```bash
# install jq ahead of time (ubuntu example)
sudo apt-get install -y jq

# tell node-jq to skip trying to install it on its own
export NODE_JQ_SKIP_INSTALL_BINARY=true

# tell node-jq where the existing jq binary is
export JQ_PATH=$(which jq)

# finally, install snyk-filter (does not work with node version > 12)
sudo npm install -g
```

--------------------------------

### snyk cos scan start

Source: https://docs.snyk.io/developer-tools/snyk-cli/commands/cos-scan-start

Documentation for the snyk cos scan start command, including usage, options, exit codes, and examples.

```APIDOC
## snyk cos scan start

### Description
Starts a new scan on a target. By default, the command returns immediately after starting the scan. Use the `--wait` option to block until the scan finishes and print the report.

### Usage
`snyk cos scan start [<OPTIONS>]`

### Options

#### `--target-id=<TARGET_ID>`
- **Required** - Specify the target to scan. The `<TARGET_ID>` must be a valid target ID.

#### `--wait`
- Wait for the scan to complete and print the report. When set, the command blocks until the scan finishes or the `--timeout` value is reached.

#### `--timeout=<DURATION>`
- Specify the maximum time to wait when `--wait` is set. Use the format `<VALUE><UNIT>`, where unit is `s` (seconds), `m` (minutes), or `h` (hours), for example, `30s`, `5m`, or `1h`. Default: `30m`.

#### `--interval=<DURATION>`
- Specify the polling interval when `--wait` is set. Use the format `<VALUE><UNIT>`, where unit is `s` (seconds), `m` (minutes), or `h` (hours), for example, `30s`, `5m`, or `1h`. Default: `5s`.

#### `--json`
- Print the report on the console as a JSON data structure. Requires `--wait`.

#### `--output-file=<FILE_PATH>`
- Write the JSON report to the specified file path. Requires `--wait` and `--json`.

### Exit Codes
- **0** : scan started
- **2** : failure, the target already has a running scan, the target is unreachable, or authentication failed
- **3** : failure, target ID not found

### Examples

```
$ snyk cos scan start --target-id=92b10f07ec07c7b1b73305181398ccf5
```

```
$ snyk cos scan start --target-id=92b10f07ec07c7b1b73305181398ccf5 --wait
```

```
$ snyk cos scan start --target-id=92b10f07ec07c7b1b73305181398ccf5 --wait --timeout=60m
```

```
$ snyk cos scan start --target-id=92b10f07ec07c7b1b73305181398ccf5 --wait --interval=10s
```

```
$ snyk cos scan start --target-id=92b10f07ec07c7b1b73305181398ccf5 --wait --json
```

```
$ snyk cos scan start --target-id=92b10f07ec07c7b1b73305181398ccf5 --wait --json --output-file=./report.json
```
```
Tokens:
Raw