canonical: https://jentic.com/apis/mend.io/mend # Mend API The Mend API exposes Mend's application security platform - software composition analysis, AI dependency scanning, container image scanning, code findings, SBOM and attribution reports, and policy management - across 125 endpoints. Authentication uses a per-organisation JWT issued from a long-lived user key, with 10-minute token lifetime and cursor pagination on list endpoints. The API is designed to drive CI/CD enforcement, vulnerability triage workflows, and compliance reporting for organisations standardising on Mend's platform. ## For AI agents Automate Mend application security workflows - fetch findings, run scans, generate SBOM and compliance reports, and manage projects across the platform. JWT-authenticated per organisation. ## Scope Does not run runtime threat detection, manage WAF rules, or scan infrastructure-as-code outside Mend's scope - use for Mend platform vulnerability findings, scans, and reporting only. ## Capabilities - Fetch open and resolved findings for an application across code, container images, and AI dependencies - Generate SBOM, attribution, and due-diligence reports from `/applications/{applicationUuid}/images/reports` - Trigger and monitor scans, then pull results into a CI gate or ticketing workflow - Manage projects, applications, and labels for portfolio organisation across teams - Administer users, groups, and access policies through the Administration endpoints - Authenticate via `/api/v3.0/login` with a user key to receive a 10-minute organisation-scoped JWT ## Use cases ### CI Pipeline Vulnerability Gating Build pipelines call Mend after each scan to determine whether to fail the build. The `/applications/{applicationUuid}/code/reports/findings` endpoint returns current open findings filtered by severity, which lets a CI step block the merge when a new high-severity issue appears in a pull-request branch and produce a clear summary in the build log. Example prompt: After a scan completes, call `/applications/{applicationUuid}/code/reports/findings` filtered by severity=critical,high, exit non-zero if the response contains any findings, and post a comment listing them on the pull request. ### SBOM and Compliance Reporting Compliance teams need recurring SBOMs and attribution reports for shipped applications. `/applications/{applicationUuid}/images/reports/SBOM` and /attribution generate the documents on demand, which a scheduled job can pull weekly and archive against the release ID for audit evidence without manual UI exports. Example prompt: For each release tag, call `/applications/{applicationUuid}/images/reports/SBOM`, store the response in S3 keyed by release ID, and link it from the release ticket. ### Vulnerability Triage Workflow Security analysts triage findings into ticketing tools. The Mend API lets a triage worker enumerate new findings since the last poll, attach context - affected paths, fix versions, severity - and create a Jira ticket per finding with a deep link back to Mend, replacing manual export and reducing time to first response. Example prompt: Poll `/applications/{applicationUuid}/code/reports/findings` every hour, diff against the last seen finding IDs, and POST a Jira issue for each new high-severity finding with the affected dependency and recommended upgrade. ### AI Agent Security Posture Reviews An AI agent can answer 'what's the security posture of application X' by chaining Mend report endpoints. Through Jentic, the agent loads the findings, SBOM, and resolved-findings operations as discoverable tools and produces a posture summary covering open critical findings, recent trend, and outstanding compliance obligations. Example prompt: Search Jentic for 'list mend findings', execute `/applications/{applicationUuid}/code/reports/findings` and /resolved, then summarise open vs resolved critical counts in plain text for the security lead. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | POST | `/api/v3.0/login` | Exchange a user key for a 10-minute organisation JWT | | GET | `/api/v3.0/applications/{applicationUuid}/code/reports/findings` | Get open code findings for an application | | GET | `/api/v3.0/applications/{applicationUuid}/code/reports/resolved` | Get resolved code findings | | GET | `/api/v3.0/applications/{applicationUuid}/ai/reports/findings` | Get AI dependency findings | | GET | `/api/v3.0/applications/{applicationUuid}/images/reports/SBOM` | Generate an SBOM for scanned container images | | GET | `/api/v3.0/applications/{applicationUuid}/images/reports/attribution` | Generate an attribution report | | GET | `/api/v3.0/applications/{applicationUuid}/images/reports/dueDiligence` | Generate a due-diligence report | | GET | `/api/v3.0/applications/{applicationUuid}/code/reports/compliance` | Generate a compliance report | ## Key resources - **Findings** — Open and resolved findings for code, AI dependencies, and container images per application. - **Reports** — SBOM, attribution, due-diligence, and compliance reports generated on demand. - **Scans** — Trigger and monitor scans across configured projects. - **Applications and Projects** — Portfolio organisation primitives - applications, projects, and labels. - **Administration** — User, group, and label management plus access policies. - **Access Management** — Authentication endpoints including /login that issues a 10-minute organisation-scoped JWT. ## Why Jentic - **Setup:** Wiring Mend by hand means exchanging a user key for a short-lived organisation JWT via /login, refreshing it before it expires, and hand-coding each application report call. Through Jentic you install once, import the Mend API from the API Directory, store the user key once, and your agent calls it. - **Permission scoping:** Mend puts the application id in the URL path (`/api/v3.0/applications/{applicationUuid}/...`), so a rule can pin your agent to one application: it can read that application's findings, SBOM, and compliance reports and nothing else. You choose the operations it may call, so reports for other applications are included only if you add them. - **Credential handling:** Your Mend user key is stored once, encrypted, by your own Jentic One instance, which performs the /login exchange and injects the resulting JWT at execution time. Neither secret enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'list Mend findings' or 'generate an SBOM', and Jentic returns the matching report endpoint with the application UUID parameter and filter schema so the agent calls the right endpoint without browsing the reference docs. ## Related APIs - **Snyk** — Direct competitor in software composition analysis and developer-first security - **GitHub API** — Source control system that Mend scans against - **GitLab** — Source control and CI host for pipelines that consume Mend results ## FAQ ### What authentication does the Mend API use? The API uses HTTP bearer authentication with JWTs issued by `/api/v3.0/login.` The login endpoint accepts a user key from your Mend Platform profile and returns a JWT scoped to one organisation that expires after 10 minutes. Through Jentic, the user key is held in the encrypted vault and the token-refresh round trip is handled at execution time. ### Can I generate an SBOM for a scanned container image with the Mend API? Yes. `/api/v3.0/applications/{applicationUuid}/images/reports/SBOM` generates an SBOM for the application's scanned container images, and adjacent endpoints produce attribution and due-diligence reports against the same scan data. ### What are the rate limits for the Mend API? The OpenAPI spec does not declare numeric rate limits but enforces a 10-minute JWT lifetime per organisation, which means long-running jobs must refresh tokens. Cursor pagination is supported on list endpoints to control page size on heavy result sets. ### How do I fetch open vulnerability findings through Jentic? Run `pip install jentic`, search for `list mend findings`, load `/api/v3.0/applications/{applicationUuid}/code/reports/findings`, and execute with the application UUID. Jentic handles the login round trip and JWT injection automatically. ### Does the Mend API cover AI dependency scanning? Yes. `/api/v3.0/applications/{applicationUuid}/ai/reports/findings` and `/api/v3.0/applications/{applicationUuid}/ai/reports/inventory` expose Mend's AI bill-of-materials and findings, which surface risks introduced by ML libraries and model dependencies in scanned applications. ### Can I limit what my agent is allowed to do with the Mend API? Yes. Because Jentic One is self-hosted, your own rules decide which operations and credentials the agent may use. Since Mend puts the application id in the URL path (`/api/v3.0/applications/{applicationUuid}/...`), you can pin the agent to a single application so it reads only that application's findings, SBOM, attribution, and compliance reports. You also choose which operations it may call, so it can trigger scans or read AI dependency findings only if you add those, and reports for other applications stay out of reach.