---
title: "Create Vulnerability Scan"
url: "https://us-prod.jeffyongtaotang.com/apis/konnect-service-catalog-1/versions/cdbef9b7-686c-4189-bbc8-55c727a972e8/operations/create-vulnerability-scan"
---

> Full API specification: https://us-prod.jeffyongtaotang.com/apis/konnect-service-catalog-1/versions/cdbef9b7-686c-4189-bbc8-55c727a972e8.md

# Create Vulnerability Scan

`POST` `/vulnerability-scans`

Operation ID: `create-vulnerability-scan`

Create a vulnerability scan, to be broken down into a set of vulnerabilities.

## Request body (required)

Content types: `application/json`

## Responses

- `201` - Response object containing a single vulnerability scan, without its catalog mapping.
- `400` - Bad Request
- `401` - Unauthorized
- `403` - Forbidden

## OpenAPI definition

```yaml
openapi: 3.0.3
info:
  title: Konnect Service Catalog
  version: 1.3.0
servers:
  - url: https://us.api.konghq.com/v1
    description: United-States Production region
  - url: https://eu.api.konghq.com/v1
    description: Europe Production region
  - url: https://au.api.konghq.com/v1
    description: Australia Production region
  - url: https://me.api.konghq.com/v1
    description: Middle-East Production region
  - url: https://in.api.konghq.com/v1
    description: India Production region
  - url: https://sg.api.konghq.com/v1
    description: Singapore Production region
paths:
  /vulnerability-scans:
    post:
      x-unstable: true
      x-internal: true
      summary: Create Vulnerability Scan
      operationId: create-vulnerability-scan
      description: Create a vulnerability scan, to be broken down into a set of
        vulnerabilities.
      requestBody:
        $ref: "#/components/requestBodies/CreateVulnerabilityScanBody"
      responses:
        "201":
          $ref: "#/components/responses/VulnerabilityScanResponse"
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/Unauthorized"
        "403":
          $ref: "#/components/responses/Forbidden"
      tags:
        - Vulnerabilities
security:
  - konnectAccessToken: []
  - personalAccessToken: []
  - systemAccountAccessToken: []
components:
  requestBodies:
    CreateVulnerabilityScanBody:
      description: Request body schema for uploading a vulnerability scan.
      required: true
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/CreateVulnerabilityScan"
  responses:
    VulnerabilityScanResponse:
      description: Response object containing a single vulnerability scan, without its
        catalog mapping.
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/VulnerabilityScan"
    BadRequest:
      description: Bad Request
      content:
        application/problem+json:
          schema:
            $ref: "#/components/schemas/BadRequestError"
    Unauthorized:
      description: Unauthorized
      content:
        application/problem+json:
          schema:
            $ref: "#/components/schemas/UnauthorizedError"
          examples:
            UnauthorizedExample:
              $ref: "#/components/examples/UnauthorizedExample"
    Forbidden:
      description: Forbidden
      content:
        application/problem+json:
          schema:
            $ref: "#/components/schemas/ForbiddenError"
          examples:
            UnauthorizedExample:
              $ref: "#/components/examples/ForbiddenExample"
  schemas:
    CreateVulnerabilityScan:
      title: UploadVulnerabilityScan
      type: object
      additionalProperties: false
      properties:
        scan_key:
          $ref: "#/components/schemas/VulnerabilityScanKey"
        tool:
          $ref: "#/components/schemas/VulnerabilityScanTool"
        description:
          type: string
          nullable: true
        raw_scan_report:
          type: object
          additionalProperties: true
        catalog_reference:
          $ref: "#/components/schemas/CreateVulnerabilityScanCatalogReference"
        environment:
          type: string
          nullable: true
          example: prod
        region:
          type: string
          nullable: true
          example: us-east-2
        source_correlation_key:
          type: string
          example: kong/repo-id
          description: >
            Optional key used to correlate vulnerabilities found in this scan
            with the same vulnerabilities found across different sources.

            This allows tracking the same vulnerability in two sources as one
            vulnerability instance.

            When omitted, this will inherit the value of `scan_key`.
        attributes:
          type: object
          additionalProperties:
            type: string
          example:
            org.kong.enterprise.source.version: v1
        ts:
          type: string
          format: date-time
          description: >
            Optional RFC-3339 timestamp indicating when the vulnerability scan
            was run.

            If provided, this value will be used as the authoritative scan time.

            If omitted, the system will attempt to extract a timestamp from the
            uploaded scan report.

            If no timestamp can be extracted, the server's current time at
            ingestion will be used.
          example: 2025-01-01T00:00:00Z
      required:
        - scan_key
        - tool
        - description
        - raw_scan_report
        - catalog_reference
        - environment
        - region
        - attributes
    VulnerabilityScan:
      title: VulnerabilityScan
      type: object
      properties:
        id:
          type: string
          format: uuid
          example: 0ca46543-e6a3-4a8b-8e2c-205935a1bb3a
        scan_key:
          $ref: "#/components/schemas/VulnerabilityScanKey"
        tool:
          $ref: "#/components/schemas/VulnerabilityScanTool"
        tool_metadata:
          $ref: "#/components/schemas/VulnerabilityScanToolMetadata"
        description:
          type: string
          nullable: true
        catalog_reference:
          $ref: "#/components/schemas/VulnerabilityScanCatalogReference"
        environment:
          type: string
          nullable: true
          example: prod
        region:
          type: string
          nullable: true
          example: us-east-2
        source_correlation_key:
          type: string
          nullable: true
          example: kong/repo-id
        attributes:
          type: object
          additionalProperties:
            type: string
          example:
            org.kong.enterprise.source.version: v1
        ts:
          type: string
          format: date-time
          description: Date the vulnerability scan occurred at.
          example: 2025-01-01T00:00:00Z
        status:
          $ref: "#/components/schemas/VulnerabilityScanStatus"
        created_at:
          $ref: "#/components/schemas/CreatedAt"
        updated_at:
          $ref: "#/components/schemas/UpdatedAt"
      required:
        - id
        - scan_key
        - tool
        - tool_metadata
        - description
        - catalog_reference
        - environment
        - region
        - source_correlation_key
        - attributes
        - ts
        - status
        - created_at
        - updated_at
    BadRequestError:
      allOf:
        - $ref: "#/components/schemas/BaseError"
        - type: object
          required:
            - invalid_parameters
          properties:
            invalid_parameters:
              $ref: "#/components/schemas/InvalidParameters"
    UnauthorizedError:
      allOf:
        - $ref: "#/components/schemas/BaseError"
        - type: object
          properties:
            status:
              example: 401
            title:
              example: Unauthorized
            type:
              example: https://httpstatuses.com/401
            instance:
              example: kong:trace:1234567890
            detail:
              example: Invalid credentials
    ForbiddenError:
      allOf:
        - $ref: "#/components/schemas/BaseError"
        - type: object
          properties:
            status:
              example: 403
            title:
              example: Forbidden
            type:
              example: https://httpstatuses.com/403
            instance:
              example: kong:trace:1234567890
            detail:
              example: Forbidden
    VulnerabilityScanKey:
      title: VulnerabilityScanKey
      type: string
      description: >
        Machine-usable value to correlate scans (and their vulnerabilities) on a
        given resource. This value is then

        used to determine vulnerabilities resolved/fixed between subsequent
        scans on the same resource.
      example: namespaces/foo:pods/bar-api
    VulnerabilityScanTool:
      type: string
      enum:
        - grype
        - trivy
      example: trivy
    CreateVulnerabilityScanCatalogReference:
      type: object
      oneOf:
        - $ref: "#/components/schemas/CreateServiceVulnerabilityScanCatalogReference"
    VulnerabilityScanToolMetadata:
      type: object
      properties:
        name:
          type: string
          example: Trivy
        version:
          type: string
          nullable: true
          example: 1.0.0
      required:
        - name
        - version
    VulnerabilityScanCatalogReference:
      type: object
      oneOf:
        - $ref: "#/components/schemas/ServiceVulnerabilityScanCatalogReference"
    VulnerabilityScanStatus:
      title: VulnerabilityScanStatus
      type: string
      enum:
        - in_progress
        - completed
        - failed
    CreatedAt:
      type: string
      format: date-time
      example: 2022-11-04T20:10:06.927Z
      description: An ISO-8601 timestamp representation of entity creation date.
      readOnly: true
      x-speakeasy-param-suppress-computed-diff: true
    UpdatedAt:
      type: string
      format: date-time
      example: 2022-11-04T20:10:06.927Z
      description: An ISO-8601 timestamp representation of entity update date.
      readOnly: true
      x-speakeasy-param-suppress-computed-diff: true
    BaseError:
      type: object
      title: Error
      description: standard error
      required:
        - status
        - title
        - instance
        - detail
      properties:
        status:
          type: integer
          description: >
            The HTTP status code of the error. Useful when passing the response

            body to child properties in a frontend UI. Must be returned as an
            integer.
          readOnly: true
        title:
          type: string
          description: |
            A short, human-readable summary of the problem. It should not
            change between occurences of a problem, except for localization.
            Should be provided as "Sentence case" for direct use in the UI.
          readOnly: true
        type:
          type: string
          description: The error type.
          readOnly: true
        instance:
          type: string
          description: |
            Used to return the correlation ID back to the user, in the format
            kong:trace:<correlation_id>. This helps us find the relevant logs
            when a customer reports an issue.
          readOnly: true
        detail:
          type: string
          description: >
            A human readable explanation specific to this occurence of the
            problem.

            This field may contain request/entity data to help the user
            understand

            what went wrong. Enclose variable values in square brackets. Should
            be

            provided as "Sentence case" for direct use in the UI.
          readOnly: true
    InvalidParameters:
      type: array
      nullable: false
      uniqueItems: true
      minItems: 1
      description: invalid parameters
      items:
        oneOf:
          - $ref: "#/components/schemas/InvalidParameterStandard"
          - $ref: "#/components/schemas/InvalidParameterMinimumLength"
          - $ref: "#/components/schemas/InvalidParameterMaximumLength"
          - $ref: "#/components/schemas/InvalidParameterChoiceItem"
          - $ref: "#/components/schemas/InvalidParameterDependentItem"
    CreateServiceVulnerabilityScanCatalogReference:
      type: object
      additionalProperties: false
      properties:
        service:
          type: string
          description: Reference to the service to map the vulnerability scan to. Can be
            either the service name or ID.
          example: user-svc
      required:
        - service
    ServiceVulnerabilityScanCatalogReference:
      type: object
      additionalProperties: false
      properties:
        service:
          type: object
          additionalProperties: false
          properties:
            id:
              type: string
              format: uuid
              example: b72008a7-1a8b-42d7-9691-ed88cbc1e61f
            name:
              type: string
              example: user-svc
            display_name:
              type: string
              example: User Service
          required:
            - id
            - name
            - display_name
      required:
        - service
    InvalidParameterStandard:
      type: object
      additionalProperties: false
      properties:
        field:
          type: string
          example: name
          readOnly: true
        rule:
          $ref: "#/components/schemas/InvalidRules"
        source:
          type: string
          example: body
        reason:
          type: string
          example: is a required field
          readOnly: true
      required:
        - field
        - reason
    InvalidParameterMinimumLength:
      type: object
      additionalProperties: false
      properties:
        field:
          type: string
          example: name
          readOnly: true
        rule:
          description: invalid parameters rules
          type: string
          readOnly: true
          nullable: false
          enum:
            - min_length
            - min_digits
            - min_lowercase
            - min_uppercase
            - min_symbols
            - min_items
            - min
        minimum:
          type: integer
          example: 8
        source:
          type: string
          example: body
        reason:
          type: string
          example: must have at least 8 characters
          readOnly: true
      required:
        - field
        - reason
        - rule
        - minimum
    InvalidParameterMaximumLength:
      type: object
      additionalProperties: false
      properties:
        field:
          type: string
          example: name
          readOnly: true
        rule:
          description: invalid parameters rules
          type: string
          readOnly: true
          nullable: false
          enum:
            - max_length
            - max_items
            - max
        maximum:
          type: integer
          example: 8
        source:
          type: string
          example: body
        reason:
          type: string
          example: must not have more than 8 characters
          readOnly: true
      required:
        - field
        - reason
        - rule
        - maximum
    InvalidParameterChoiceItem:
      type: object
      additionalProperties: false
      properties:
        field:
          type: string
          example: name
          readOnly: true
        rule:
          description: invalid parameters rules
          type: string
          readOnly: true
          nullable: false
          enum:
            - enum
        reason:
          type: string
          example: is a required field
          readOnly: true
        choices:
          type: array
          uniqueItems: true
          readOnly: true
          nullable: false
          minItems: 1
          items: {}
        source:
          type: string
          example: body
      required:
        - field
        - reason
        - rule
        - choices
    InvalidParameterDependentItem:
      type: object
      additionalProperties: false
      properties:
        field:
          type: string
          example: name
          readOnly: true
        rule:
          description: invalid parameters rules
          type: string
          readOnly: true
          nullable: true
          enum:
            - dependent_fields
        reason:
          type: string
          example: is a required field
          readOnly: true
        dependents:
          type: array
          uniqueItems: true
          nullable: true
          items: {}
          readOnly: true
        source:
          type: string
          example: body
      required:
        - field
        - rule
        - reason
        - dependents
    InvalidRules:
      description: invalid parameters rules
      type: string
      readOnly: true
      nullable: true
      enum:
        - required
        - is_array
        - is_base64
        - is_boolean
        - is_date_time
        - is_integer
        - is_null
        - is_number
        - is_object
        - is_string
        - is_uuid
        - is_fqdn
        - is_arn
        - unknown_property
        - missing_reference
        - is_label
        - matches_regex
        - invalid
        - is_supported_network_availability_zone_list
        - is_supported_network_cidr_block
        - is_supported_provider_region
        - type
  examples:
    UnauthorizedExample:
      value:
        status: 401
        title: Unauthorized
        instance: kong:trace:8347343766220159418
        detail: Unauthorized
    ForbiddenExample:
      value:
        status: 403
        title: Forbidden
        instance: kong:trace:2723154947768991354
        detail: You do not have permission to perform this action
  securitySchemes:
    konnectAccessToken:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >
        The Konnect access token is meant to be used by the Konnect dashboard
        and the decK CLI authenticate with.
    personalAccessToken:
      type: http
      scheme: bearer
      bearerFormat: Token
      description: >
        The personal access token is meant to be used as an alternative to
        basic-auth when accessing Konnect via APIs.

        You can generate a Personal Access Token (PAT) from the [personal access
        token page](https://cloud.konghq.com/global/account/tokens/) in the
        Konnect dashboard.

        The PAT token must be passed in the header of a request, for example:

        `curl -X GET 'https://global.api.konghq.com/v2/users/' --header
        'Authorization: Bearer kpat_xgfT...'`
    systemAccountAccessToken:
      type: http
      scheme: bearer
      bearerFormat: Token
      description: >
        The system account access token is meant for automations and
        integrations that are not directly associated with a human identity.

        You can generate a system account Access Token by creating a system
        account and then obtaining a system account access token for that
        account.

        The access token must be passed in the header of a request, for example:

        `curl -X GET 'https://global.api.konghq.com/v2/users/' --header
        'Authorization: Bearer spat_i2Ej...'`
```