Upload a security analysis report
Accepts a SARIF/SBOM/TEXT/AUDIT report as multipart/form-data and processes it for the given repository.
The file part can be either a raw report file or a ZIP archive.
ZIP archive requirements:
- exactly one report file;
- the report file must be in the archive root;
- directories, nested paths, and extra files are rejected;
- the single uncompressed entry must be no larger than 100 MB.
The file content must match reportType: SARIF uploads should contain a SARIF report, and SBOM uploads should contain SPDX or CycloneDX JSON. The REST request body is limited to 100 MB.
Create archives without parent directories: zip report.zip report.sarif. Do not zip a folder with zip -r report.zip reports/, because nested paths are rejected.
Set isReactive=true to process in the background — note that it answers 202 before parsing, so a report rejected later is reported only in the logs. Keep the default isReactive=false to get 400 with the reason the report was rejected, which is what an AUDIT upload needs: its message names every result and field to fix before uploading the corrected report again.
Request
POST
https://appsec.sourcecraft.tech/v1/reports/upload
Query parameters
|
Name |
Description |
|
gitRepo |
Type: string Repository identifier. Accepts either internal repository ID (e.g., 88769874964302633) or public UUID (e.g., 0199140f-4343-7c06-a7e3-b835c305b629). These values can be obtained from the getRepo API (fields: id and uuid). Pattern: Example: |
Body
multipart/form-data
{
"file": "example",
"commit": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
"engineName": "Trivy",
"reportType": "SARIF",
"engineType": "SCA",
"scanBasePathAbsolute": "/home/user/workspace/my-project",
"scanTime": 1640995200000,
"shouldTriggerEnrichment": true,
"isReactive": true,
"scanUuid": "example",
"expectedReportCount": 3,
"prUuid": "example",
"reactive": true
}
|
Name |
Description |
|
commit |
Type: string Full SHA commit hash identifying the scanned code revision. Example: |
|
engineName |
Type: string Human-readable name of the analysis tool that produced the report. Example: |
|
file |
Type: string<binary> Raw report file content, or a ZIP archive with exactly one report file in the archive root. Do not include directories or extra files. The uncompressed ZIP entry must be no larger than 100 MB. Example: |
|
reportType |
Type: string Format of the uploaded report. Enum: |
|
engineType |
Type: string Category of the analysis engine. Defaults to UNSPECIFIED when absent. Enum: |
|
expectedReportCount |
Type: integer | null Total reports expected for a scan across all uploaders. Sets the total for a new scan or an existing scan whose total is still zero; a nonzero total is preserved. Omit or send zero when unknown (legacy clients). Min value: |
|
isReactive |
Type: boolean When true, respond 202 immediately and process the report in the background; otherwise process synchronously and respond 200 (or 400 on parse errors). |
|
prUuid |
Type: string | null Pull Request UUID (CI env SOURCECRAFT_PR_UUID). Example: |
|
reactive |
Type: boolean |
|
scanBasePathAbsolute |
Type: string | null Absolute path where the scan ran; stripped from report file paths for normalization. Example: |
|
scanTime |
Type: integer Unix timestamp (ms) when the scan was initiated. |
|
scanUuid |
Type: string | null Scan UUID. Used as the HMAC payload for SBOM upload tokens. Example: |
|
shouldTriggerEnrichment |
Type: boolean When true, run additional security enrichment (SCA, risk scoring, etc.). |
Responses
200 OK
Report processed successfully (synchronous mode)
Body
application/json
null
Type: unknown
202 Accepted
Report accepted for background processing (isReactive=true)
400 Bad Request
Invalid request: missing/invalid fields or unparseable report
401 Unauthorized
Missing or invalid authorization token
403 Forbidden
Permission denied or security disabled for the repository
404 Not Found
Repository not found