Mend API

Name: Mend API
Brand: Mend API
Availability: InStock

✓ Official Vendor SpecSecurityVulnerability Managementbearer125 EndpointsREST

For Agents

Automate Mend application security workflows — fetch findings, run scans, generate SBOM and compliance reports, and manage projects across the platform. JWT-authenticated per organisation.

Install Jentic One Beta

Connect the Mend API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Mend API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Mend API.

Fetch open and resolved findings for an application across code, container images, and AI dependencies

Generate SBOM, attribution, and due-diligence reports from /applications/{applicationUuid}/images/reports

Trigger and monitor scans, then pull results into a CI gate or ticketing workflow

GET STARTED

Start building with Mend API

Explore with Jentic

View OpenAPI Document

Use Cases

Patterns agents use Mend API for, with concrete tasks.

★ CI Pipeline Vulnerability Gating

Build pipelines call Mend after each scan to determine whether to fail the build. The /applications/{applicationUuid}/code/reports/findings endpoint returns current open findings filtered by severity, which lets a CI step block the merge when a new high-severity issue appears in a pull-request branch and produce a clear summary in the build log.

After a scan completes, call /applications/{applicationUuid}/code/reports/findings filtered by severity=critical,high, exit non-zero if the response contains any findings, and post a comment listing them on the pull request.

SBOM and Compliance Reporting

Compliance teams need recurring SBOMs and attribution reports for shipped applications. /applications/{applicationUuid}/images/reports/SBOM and /attribution generate the documents on demand, which a scheduled job can pull weekly and archive against the release ID for audit evidence without manual UI exports.

For each release tag, call /applications/{applicationUuid}/images/reports/SBOM, store the response in S3 keyed by release ID, and link it from the release ticket.

Vulnerability Triage Workflow

Security analysts triage findings into ticketing tools. The Mend API lets a triage worker enumerate new findings since the last poll, attach context — affected paths, fix versions, severity — and create a Jira ticket per finding with a deep link back to Mend, replacing manual export and reducing time to first response.

Poll /applications/{applicationUuid}/code/reports/findings every hour, diff against the last seen finding IDs, and POST a Jira issue for each new high-severity finding with the affected dependency and recommended upgrade.

AI Agent Security Posture Reviews

An AI agent can answer 'what's the security posture of application X' by chaining Mend report endpoints. Through Jentic, the agent loads the findings, SBOM, and resolved-findings operations as discoverable tools and produces a posture summary covering open critical findings, recent trend, and outstanding compliance obligations.

Search Jentic for 'list mend findings', execute /applications/{applicationUuid}/code/reports/findings and /resolved, then summarise open vs resolved critical counts in plain text for the security lead.

Key Endpoints

125 endpoints — the mend api exposes mend's application security platform — software composition analysis, ai dependency scanning, container image scanning, code findings, sbom and attribution reports, and policy management — across 125 endpoints.

METHOD

PATH

DESCRIPTION

POST

/api/v3.0/login

Exchange a user key for a 10-minute organisation JWT

GET

/api/v3.0/applications/{applicationUuid}/code/reports/findings

Get open code findings for an application

GET

/api/v3.0/applications/{applicationUuid}/code/reports/resolved

Get resolved code findings

GET

/api/v3.0/applications/{applicationUuid}/ai/reports/findings

Get AI dependency findings

GET

/api/v3.0/applications/{applicationUuid}/images/reports/SBOM

Generate an SBOM for scanned container images

GET

/api/v3.0/applications/{applicationUuid}/images/reports/attribution

Generate an attribution report

GET

/api/v3.0/applications/{applicationUuid}/images/reports/dueDiligence

Generate a due-diligence report

GET

/api/v3.0/applications/{applicationUuid}/code/reports/compliance

Generate a compliance report

POST

/api/v3.0/login

Exchange a user key for a 10-minute organisation JWT

GET

/api/v3.0/applications/{applicationUuid}/code/reports/findings

Get open code findings for an application

GET

/api/v3.0/applications/{applicationUuid}/code/reports/resolved

Get resolved code findings

GET

/api/v3.0/applications/{applicationUuid}/ai/reports/findings

Get AI dependency findings

GET

/api/v3.0/applications/{applicationUuid}/images/reports/SBOM

Generate an SBOM for scanned container images

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Mend uses a long-lived user key that exchanges for a 10-minute organisation JWT. Jentic stores the user key encrypted in the MAXsystem vault, performs the /login round trip server-side, and injects the JWT on each call so neither secret enters agent context.

Intent-based discovery

Agents search Jentic for intents like 'list mend findings' or 'generate sbom' and receive the matching report endpoint with the application UUID parameter and filter schema, ready to execute.

Time to first call

Direct integration: 1-2 days to handle the login flow, 10-minute token rotation, cursor pagination, and 125-endpoint surface area. Through Jentic: under 1 hour — only the operations the agent needs are loaded.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Alternative

Snyk

Direct competitor in software composition analysis and developer-first security

Choose Snyk when the user has Snyk credentials or needs Snyk's developer-IDE integrations; choose Mend when working in an organisation already standardised on the Mend platform.

Complementary

GitHub API

Source control system that Mend scans against

Use GitHub to read repository state and post checks/PR comments; use Mend to retrieve the findings that drive those checks.

Complementary

GitLab

Source control and CI host for pipelines that consume Mend results

Use GitLab when the CI pipeline lives there; use Mend to retrieve the scan findings that the pipeline gates on.

FAQs

Specific to using Mend API through Jentic.

What authentication does the Mend API use?

The API uses HTTP bearer authentication with JWTs issued by /api/v3.0/login. The login endpoint accepts a user key from your Mend Platform profile and returns a JWT scoped to one organisation that expires after 10 minutes. Through Jentic, the user key is held in the encrypted vault and the token-refresh round trip is handled at execution time.

Can I generate an SBOM for a scanned container image with the Mend API?

Yes. /api/v3.0/applications/{applicationUuid}/images/reports/SBOM generates an SBOM for the application's scanned container images, and adjacent endpoints produce attribution and due-diligence reports against the same scan data.

What are the rate limits for the Mend API?

The OpenAPI spec does not declare numeric rate limits but enforces a 10-minute JWT lifetime per organisation, which means long-running jobs must refresh tokens. Cursor pagination is supported on list endpoints to control page size on heavy result sets.

How do I fetch open vulnerability findings through Jentic?

Run `pip install jentic`, search for `list mend findings`, load /api/v3.0/applications/{applicationUuid}/code/reports/findings, and execute with the application UUID. Jentic handles the login round trip and JWT injection automatically.

Does the Mend API cover AI dependency scanning?

Yes. /api/v3.0/applications/{applicationUuid}/ai/reports/findings and /api/v3.0/applications/{applicationUuid}/ai/reports/inventory expose Mend's AI bill-of-materials and findings, which surface risks introduced by ML libraries and model dependencies in scanned applications.