Official vendor OpenAPI document · agent-readySecurityVulnerability Managementbearer125 EndpointsREST
For Agents
Automate Mend application security workflows - fetch findings, run scans, generate SBOM and compliance reports, and manage projects across the platform. JWT-authenticated per organisation.
Use for: List all open vulnerability findings for a specific application, Generate an SBOM for a container image scanned by Mend, Trigger a new scan for a project and wait for results, Get the AI dependency findings for an application
Not supported: Does not run runtime threat detection, manage WAF rules, or scan infrastructure-as-code outside Mend's scope - use for Mend platform vulnerability findings, scans, and reporting only.
The Mend API exposes Mend's application security platform - software composition analysis, AI dependency scanning, container image scanning, code findings, SBOM and attribution reports, and policy management - across 125 endpoints. Authentication uses a per-organisation JWT issued from a long-lived user key, with 10-minute token lifetime and cursor pagination on list endpoints. The API is designed to drive CI/CD enforcement, vulnerability triage workflows, and compliance reporting for organisations standardising on Mend's platform.
Install Jentic One Beta
Connect the Mend API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Mend API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fmend.io%2Fmend" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fmend.io%2Fmend" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Mend API.
Fetch open and resolved findings for an application across code, container images, and AI dependencies
Generate SBOM, attribution, and due-diligence reports from /applications/{applicationUuid}/images/reports
Trigger and monitor scans, then pull results into a CI gate or ticketing workflow
Manage projects, applications, and labels for portfolio organisation across teams
Administer users, groups, and access policies through the Administration endpoints
Authenticate via /api/v3.0/login with a user key to receive a 10-minute organisation-scoped JWT
Use Cases
Patterns agents use Mend API for, with concrete tasks.
★ CI Pipeline Vulnerability Gating
Build pipelines call Mend after each scan to determine whether to fail the build. The /applications/{applicationUuid}/code/reports/findings endpoint returns current open findings filtered by severity, which lets a CI step block the merge when a new high-severity issue appears in a pull-request branch and produce a clear summary in the build log.
After a scan completes, call /applications/{applicationUuid}/code/reports/findings filtered by severity=critical,high, exit non-zero if the response contains any findings, and post a comment listing them on the pull request.
SBOM and Compliance Reporting
Compliance teams need recurring SBOMs and attribution reports for shipped applications. /applications/{applicationUuid}/images/reports/SBOM and /attribution generate the documents on demand, which a scheduled job can pull weekly and archive against the release ID for audit evidence without manual UI exports.
For each release tag, call /applications/{applicationUuid}/images/reports/SBOM, store the response in S3 keyed by release ID, and link it from the release ticket.
Vulnerability Triage Workflow
Security analysts triage findings into ticketing tools. The Mend API lets a triage worker enumerate new findings since the last poll, attach context - affected paths, fix versions, severity - and create a Jira ticket per finding with a deep link back to Mend, replacing manual export and reducing time to first response.
Poll /applications/{applicationUuid}/code/reports/findings every hour, diff against the last seen finding IDs, and POST a Jira issue for each new high-severity finding with the affected dependency and recommended upgrade.
AI Agent Security Posture Reviews
An AI agent can answer 'what's the security posture of application X' by chaining Mend report endpoints. Through Jentic, the agent loads the findings, SBOM, and resolved-findings operations as discoverable tools and produces a posture summary covering open critical findings, recent trend, and outstanding compliance obligations.
Search Jentic for 'list mend findings', execute /applications/{applicationUuid}/code/reports/findings and /resolved, then summarise open vs resolved critical counts in plain text for the security lead.
Key Endpoints
125 endpoints — the mend api exposes mend's application security platform - software composition analysis, ai dependency scanning, container image scanning, code findings, sbom and attribution reports, and policy management - across 125 endpoints.
METHOD
PATH
DESCRIPTION
POST
/api/v3.0/login
Exchange a user key for a 10-minute organisation JWT
GET
/api/v3.0/applications/{applicationUuid}/code/reports/findings
Get open code findings for an application
GET
/api/v3.0/applications/{applicationUuid}/code/reports/resolved
Get resolved code findings
GET
/api/v3.0/applications/{applicationUuid}/ai/reports/findings
Get AI dependency findings
GET
/api/v3.0/applications/{applicationUuid}/images/reports/SBOM
Generate an SBOM for scanned container images
GET
/api/v3.0/applications/{applicationUuid}/images/reports/attribution
Generate an attribution report
GET
/api/v3.0/applications/{applicationUuid}/images/reports/dueDiligence
Generate a due-diligence report
GET
/api/v3.0/applications/{applicationUuid}/code/reports/compliance
Generate a compliance report
POST
/api/v3.0/login
Exchange a user key for a 10-minute organisation JWT
GET
/api/v3.0/applications/{applicationUuid}/code/reports/findings
Get open code findings for an application
GET
/api/v3.0/applications/{applicationUuid}/code/reports/resolved
Get resolved code findings
GET
/api/v3.0/applications/{applicationUuid}/ai/reports/findings
Get AI dependency findings
GET
/api/v3.0/applications/{applicationUuid}/images/reports/SBOM
Generate an SBOM for scanned container images
GET
/api/v3.0/applications/{applicationUuid}/images/reports/attribution
Generate an attribution report
GET
/api/v3.0/applications/{applicationUuid}/images/reports/dueDiligence
Generate a due-diligence report
GET
/api/v3.0/applications/{applicationUuid}/code/reports/compliance
Generate a compliance report
Jentic AI Readiness Score
This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use.
M
Mend API
- Foundational (C+)57/100
48
Foundational Compliance67
Developer Experience & Jentic Compatibility41
AI-Readiness & Agent Experience77
Agent Usability75
Security70
AI DiscoverabilityPowered by JenticScoring Framework 1.0.0 | Scoring Engine 0.4.0
Show dimension breakdown
48
Foundational Compliance
Base layer of spec validity and structural soundness.
Grade: D+Signals: 4
93%
Lint Results
Aggregated quality score from linter diagnostics, weighted by severity.
100%
Resolution Completeness
Percentage of `$ref` references that resolve successfully.
0%
Specification Validity
Checks whether the API description parses successfully and conforms to its declared specification (e.g., OpenAPI).
0%
Structural Integrity
Structural correctness score based on schema issues using logarithmic dampening.
67
Developer Experience & Jentic Compatibility
Clarity, completeness, and ingestion readiness for developers and tooling.
Grade: B+Signals: 4
16%
Example Density
How richly the API is illustrated with examples.
98%
Example Validity
Percentage of examples that conform to their schemas.
54%
Response Coverage
Percentage of operations with complete response definitions (success, client error, server error).
100%
Tooling Readiness
Health of API ingestion, bundling, and resolution within Jentic pipelines.
41
AI-Readiness & Agent Experience
Semantic breadth, depth, and agent comprehension for AI systems.
Grade: D-Signals: 4
31%
Description Coverage
Coverage of descriptions across API elements.
0%
Error Standardization
Coverage of RFC 9457 Problem Details for error responses.
80%
OperationId Quality
Coverage, uniqueness, and casing consistency of operationIds for AI inference.
53%
Summary Coverage
Coverage of summaries across operations/tags/info.
77
Agent Usability
Functional utility, complexity comfort, and AI orchestration readiness.
Grade: A-Signals: 1
77%
Complexity Comfort
Agent comfort level based on API operational and structural complexity.
75
Security
Trust, risk posture, and security compliance.
Grade: A-Signals: 1
75%
Authentication Strength
Average quality of security schemes based on authentication method strength (weakest link for OAuth2).
70
AI Discoverability
Findability, semantic richness, and reasoning readiness.
Grade: A-Signals: 1
70%
Descriptive Richness
Clarity and depth of descriptions across API elements.
Score it yourself
Every API in the directory is allowlisted, so you can re-score it with no key required.
npx @jentic/api-scorecard-cli score <openapi-url>Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring Mend by hand means exchanging a user key for a short-lived organisation JWT via /login, refreshing it before it expires, and hand-coding each application report call. Through Jentic you install once, import the Mend API from the API Directory, store the user key once, and your agent calls it.
Permission scoping
Mend puts the application id in the URL path (/api/v3.0/applications/{applicationUuid}/...), so a rule can pin your agent to one application: it can read that application's findings, SBOM, and compliance reports and nothing else. You choose the operations it may call, so reports for other applications are included only if you add them.
Credential isolation
Your Mend user key is stored once, encrypted, by your own Jentic One instance, which performs the /login exchange and injects the resulting JWT at execution time. Neither secret enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'list Mend findings' or 'generate an SBOM', and Jentic returns the matching report endpoint with the application UUID parameter and filter schema so the agent calls the right endpoint without browsing the reference docs.
Related APIs
Alternatives and complements available in the Jentic catalogue.
Alternative
Snyk
Direct competitor in software composition analysis and developer-first security
Choose Snyk when the user has Snyk credentials or needs Snyk's developer-IDE integrations; choose Mend when working in an organisation already standardised on the Mend platform.
FAQs
Specific to using Mend API through Jentic.
What authentication does the Mend API use?
The API uses HTTP bearer authentication with JWTs issued by /api/v3.0/login. The login endpoint accepts a user key from your Mend Platform profile and returns a JWT scoped to one organisation that expires after 10 minutes. Through Jentic, the user key is held in the encrypted vault and the token-refresh round trip is handled at execution time.
Can I generate an SBOM for a scanned container image with the Mend API?
Yes. /api/v3.0/applications/{applicationUuid}/images/reports/SBOM generates an SBOM for the application's scanned container images, and adjacent endpoints produce attribution and due-diligence reports against the same scan data.
What are the rate limits for the Mend API?
The OpenAPI spec does not declare numeric rate limits but enforces a 10-minute JWT lifetime per organisation, which means long-running jobs must refresh tokens. Cursor pagination is supported on list endpoints to control page size on heavy result sets.
How do I fetch open vulnerability findings through Jentic?
Run `pip install jentic`, search for `list mend findings`, load /api/v3.0/applications/{applicationUuid}/code/reports/findings, and execute with the application UUID. Jentic handles the login round trip and JWT injection automatically.
Does the Mend API cover AI dependency scanning?
Yes. /api/v3.0/applications/{applicationUuid}/ai/reports/findings and /api/v3.0/applications/{applicationUuid}/ai/reports/inventory expose Mend's AI bill-of-materials and findings, which surface risks introduced by ML libraries and model dependencies in scanned applications.
Can I limit what my agent is allowed to do with the Mend API?
Yes. Because Jentic One is self-hosted, your own rules decide which operations and credentials the agent may use. Since Mend puts the application id in the URL path (/api/v3.0/applications/{applicationUuid}/...), you can pin the agent to a single application so it reads only that application's findings, SBOM, attribution, and compliance reports. You also choose which operations it may call, so it can trigger scans or read AI dependency findings only if you add those, and reports for other applications stay out of reach.
GET STARTED