2026/10/22 - AWS Continuum - 33 new api methods
Changes Releasing Continuum for Code Vulnerabilities APIs for SDKs
Lists the issues in an environment in descending issueId order.
See also: AWS API Documentation
Request Syntax
client.list_code_issues(
environmentId='string',
maxResults=123,
nextToken='string'
)
string
[REQUIRED]
The environment whose issues to list.
integer
The maximum number of results to return in a single call.
string
A pagination token returned by a previous call. Set to null for the first request; use the returned token for subsequent calls.
dict
Response Syntax
{
'items': [
{
'issueId': 'string',
'issueArn': 'string',
'name': 'string',
'severity': 'LOW'|'MEDIUM'|'HIGH'|'CRITICAL',
'confidence': 123,
'status': 'CREATED'|'IN_PROGRESS'|'COMPLETED'|'FAILED',
'phase': 'VALIDATION'|'PRIORITIZATION'|'REMEDIATION',
'statusReason': 'INTERNAL_ERROR'|'REMEDIATION_FAILED',
'statusMessage': 'string',
'statusUpdatedAt': datetime(2015, 1, 1),
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
Contains the list of issue summaries and an optional pagination token.
items (list) --
The issues in the environment, ordered by issueId descending.
(dict) --
A summary of an issue returned in list responses.
issueId (string) --
The unique identifier of the issue.
issueArn (string) --
The ARN of the issue.
name (string) --
The name of the issue.
severity (string) --
Scanner-derived severity assigned to the issue.
confidence (integer) --
The likelihood that this issue is a true positive, expressed as a percentage (0-100).
status (string) --
The current lifecycle status of the issue.
phase (string) --
The part of the workflow the issue is in. Present when status is IN_PROGRESS, and when status is FAILED and the failing phase is known.
statusReason (string) --
Why the issue failed. Present only when status is FAILED.
statusMessage (string) --
Customer-facing explanation of statusReason. Present only when status is FAILED.
statusUpdatedAt (datetime) --
The timestamp when the status or phase last changed.
createdAt (datetime) --
The timestamp when the issue was created.
updatedAt (datetime) --
The timestamp when any field of the issue last changed. Advances on every mutation (including score-only updates that do not transition status), so it is greater than or equal to statusUpdatedAt.
nextToken (string) --
A pagination token to retrieve the next page of results. Absent when there are no more results.
Rotates the credentials used by an Amazon S3 integration. Only S3 integrations can be updated; GitHub integrations cannot be modified. The integration's name, provider type, and bucket remain fixed.
The caller must have iam:PassRole permission for the supplied role, including when only the external ID changes. Continuum verifies that the role can be assumed with the requested external ID and can access the existing bucket before saving both credentials atomically. Omitting externalId preserves its current value. Repeating both current credentials leaves updatedAt unchanged, but still requires authorization and access validation.
See also: AWS API Documentation
Request Syntax
client.update_integration(
integrationId='string',
providerConfiguration={
's3': {
'roleArn': 'string',
'externalId': 'string'
}
}
)
string
[REQUIRED]
The unique identifier of the S3 integration to update.
dict
[REQUIRED]
The provider-specific changes to apply. The member must match the integration's provider type, and only S3 integrations can be updated.
s3 (dict) --
Replacement credentials for a customer-managed S3 integration.
roleArn (string) -- [REQUIRED]
The role to use. Supply the current role when rotating only the external ID. The caller must be allowed to pass this exact role to Continuum.
externalId (string) --
The replacement external ID used when assuming the supplied role. If omitted, the existing external ID is preserved. This value is sensitive and is never included in the public integration response.
dict
Response Syntax
{
'integrationId': 'string',
'integrationArn': 'string',
'name': 'string',
'integrationType': 'GITHUB'|'GITLAB'|'S3',
'providerDetails': {
'github': {
'organizationName': 'string'
},
'gitlab': {
'instanceUrl': 'string',
'targetType': 'GROUP'|'PROJECT',
'targetPath': 'string',
'tokenRotation': 'AUTOMATIC'|'NONE',
'expiresAt': datetime(2015, 1, 1)
},
's3': {
'bucket': 'string',
'roleArn': 'string'
}
},
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
Contains the current state of the updated S3 integration. The sensitive external ID is omitted.
integrationId (string) --
The unique identifier for an Integration resource.
integrationArn (string) --
The Amazon Resource Name (ARN) of an Integration resource, of the form arn:{partition}:continuum:{region}:{account}:integrations/{integrationId}.
name (string) --
The name for an integration.
integrationType (string) --
The immutable provider type for an integration.
providerDetails (dict) --
Provider-specific details for an integration. Only one member will be present.
github (dict) --
Details for a GitHub.com integration.
organizationName (string) --
The name of the GitHub organization associated with the integration.
gitlab (dict) --
Details for a GitLab integration.
instanceUrl (string) --
The HTTPS base URL of the GitLab instance.
targetType (string) --
Whether the integration targets a group or a single project.
targetPath (string) --
The group or project path the integration targets.
tokenRotation (string) --
How the integration's access token is rotated. AUTOMATIC only when the pasted token had the self-rotate scope and rotation was opted in at installation time.
expiresAt (datetime) --
The expiry of the stored access token, for non-rotating tokens only. A rotated token's original expiry is stale, so this is omitted when tokenRotation is AUTOMATIC.
s3 (dict) --
Public details for a customer-managed S3 integration.
bucket (string) --
Customer-managed S3 bucket name.
roleArn (string) --
IAM role assumed by Continuum to read a customer-managed S3 integration.
createdAt (datetime) --
When the integration was created.
updatedAt (datetime) --
When the integration was last updated.
Starts an OAuth authorization for a new integration and returns the values the caller sends to the provider's authorization endpoint. The authorization belongs to the calling AWS account, can be redeemed once by CreateIntegration from that same account, and expires after ten minutes.
See also: AWS API Documentation
Request Syntax
client.start_integration_authorization(
providerType='GITHUB',
name='string'
)
string
[REQUIRED]
The provider to authorize. Only GITHUB is supported.
string
The name the integration will be created with. When specified, the request fails with ConflictException if an integration with this name already exists in the account, before the caller leaves for the provider. The name is only checked: it is not reserved, stored, or authorized. CreateIntegration requires its own name, checks it again, and may use a different one.
dict
Response Syntax
{
'state': 'string',
'codeChallenge': 'string',
'codeChallengeMethod': 'S256',
'expiresAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
Contains the values to send to the provider's authorization endpoint.
state (string) --
An opaque value to send as the OAuth state parameter. Pass the value the provider returns in its callback to CreateIntegration as authorization.state.
codeChallenge (string) --
The PKCE code challenge to send as the OAuth code_challenge parameter.
codeChallengeMethod (string) --
The PKCE challenge method to send as the OAuth code_challenge_method parameter.
expiresAt (datetime) --
The time after which CreateIntegration no longer accepts this authorization.
Deletes an integration and releases its name and account quota. Its retained CreateIntegration token receipt can still replay the original result without recreating the integration. Shared provider registrations are retained: deleting one integration does not remove provider access used by another integration. A fresh GitHub CreateIntegration attempt requires a fresh OAuth authorization code and a new clientToken.
See also: AWS API Documentation
Request Syntax
client.delete_integration(
integrationId='string'
)
string
[REQUIRED]
The unique identifier of the integration to delete.
None
Lists the Collectors owned by the authenticated caller's account, including a Collector whose deletion is in progress. A Collector that is still being created is omitted. The account-scoped Collector quota currently permits at most one result, so no result ordering applies.
See also: AWS API Documentation
Request Syntax
client.list_collectors()
dict
Response Syntax
{
'items': [
{
'collectorId': 'string',
'collectorArn': 'string',
'type': 'AWS_COLLECTOR',
'status': 'ACTIVE'|'PENDING_DELETION',
'createdAt': datetime(2015, 1, 1)
},
]
}
Response Structure
(dict) --
Contains summaries of the caller account's Collectors.
items (list) --
The Collectors owned by the authenticated caller's account. At most one result is currently returned, so no result ordering applies.
(dict) --
A summary of a Collector returned in list responses.
collectorId (string) --
The unique identifier of the Collector.
collectorArn (string) --
The ARN of the Collector.
type (string) --
The source collected by this Collector.
status (string) --
The current lifecycle status.
createdAt (datetime) --
The timestamp when the Collector was created.
Removes one Collector association from this Environment, preserving its other associations. The stored Collector data-access role is cleared when no Collector associations remain. The Environment owner must have permission to disassociate. A current Collector access grant is not required, and the Collector does not need to remain active or present, so stale or revoked associations can be cleaned up.
See also: AWS API Documentation
Request Syntax
client.disassociate_collector(
environmentId='string',
collectorArn='string'
)
string
[REQUIRED]
The unique identifier of the Environment whose associations are updated.
string
[REQUIRED]
The ARN of the Collector to disassociate from this Environment.
None
Creates an explicit scan request for one environment. CP creates durable work before any queue delivery occurs.
Retrying a request that succeeded, with the same clientToken on the same environment, returns the original scan instead of starting another one. Token handling is not yet atomic: requests with the same token that run at the same time, or a retry after a request that failed partway through, can leave an additional scan, which may end in the FAILED state with a message that it was superseded. Deleting the environment makes its tokens unusable; a later request with one of them returns ResourceNotFoundException.
Each environment can have a limited number of scans in progress at the same time. Once that limit is enforced, a request that would exceed it returns ServiceQuotaExceededException; wait for a scan to finish (ListCodeScans shows each scan's status), then retry.
See also: AWS API Documentation
Request Syntax
client.create_code_scan(
environmentId='string',
clientToken='string'
)
string
[REQUIRED]
Environment to scan.
string
An optional token identifying one scan request for this environment. SDKs generate a token when omitted. If a request reaches the service without a token, the service generates one for that request, so each request without a token starts a new scan. To retry a request after a lost response, supply the same token on the same environment; once a request with that token has succeeded, a retry returns the original scan. Concurrent requests with the same token, or a retry after a request that failed partway through, can leave an additional scan, which may end FAILED as superseded. A token is bound to its scan for as long as the service retains the scan's build record, with no shorter expiry. Deleting the environment makes the binding inaccessible: a later request with the token returns ResourceNotFoundException.
This field is autopopulated if not provided.
dict
Response Syntax
{
'scan': {
'scanRunId': 'string',
'status': 'SUBMITTED'|'WAITING_FOR_BUILD'|'BUILDING'|'WAITING_FOR_SCAN'|'SCANNING'|'SUCCEEDED'|'FAILED',
'origin': 'MANUAL'|'SCHEDULED',
'createdAt': datetime(2015, 1, 1),
'completedAt': datetime(2015, 1, 1),
'failureMessage': 'string',
'failureStage': 'SUBMITTED'|'WAITING_FOR_BUILD'|'BUILDING'|'WAITING_FOR_SCAN'|'SCANNING'
}
}
Response Structure
(dict) --
scan (dict) --
The scan run this request created, or the scan run a previous request with the same clientToken already accepted.
scanRunId (string) --
The unique scan identifier.
status (string) --
Current customer-visible status.
origin (string) --
Why the scan was created. Always present.
createdAt (datetime) --
Time at which Continuum accepted the scan request.
completedAt (datetime) --
Time at which a terminal result was recorded.
failureMessage (string) --
Failure detail present for unsuccessful scans.
failureStage (string) --
Phase this scan failed in. Present only when status is FAILED, and absent for a scan that failed before this field existed.
Lists the Environments currently associated with one Collector in lexicographically ascending environmentArn order. The ARN identifies each Environment across accounts within the Collector's Region.
See also: AWS API Documentation
Request Syntax
client.list_associated_environments(
collectorId='string',
maxResults=123,
nextToken='string'
)
string
[REQUIRED]
The unique identifier of the Collector whose associations to list.
integer
Maximum number of Environment associations to return.
string
Pagination token returned by a prior request.
dict
Response Syntax
{
'associatedEnvironments': [
{
'environmentId': 'string',
'environmentArn': 'string',
'name': 'string',
'status': 'ACTIVE',
'createdAt': datetime(2015, 1, 1)
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
Contains one page of Environment summaries associated with the requested Collector.
associatedEnvironments (list) --
Summaries of the Environments associated with this Collector, ordered by environmentArn lexicographically ascending. Each summary has the same fields as a ListEnvironments item but uses an independent model shape. Empty when the Collector has no associations.
(dict) --
A summary of one Environment associated with a Collector. This shape intentionally remains distinct from EnvironmentSummary so the two list operations can evolve independently.
environmentId (string) --
The unique identifier of the associated Environment.
environmentArn (string) --
The ARN of the associated Environment. The account encoded in this ARN identifies cross-account associations; association mutations require its Region to match the Collector's Region.
name (string) --
The customer-visible name of the associated Environment.
status (string) --
The current operational status of the associated Environment.
createdAt (datetime) --
The timestamp when the associated Environment was created.
nextToken (string) --
Pagination token for the next page, if present.
Retrieves the current state of the Collector for the caller's account.
See also: AWS API Documentation
Request Syntax
client.get_collector(
collectorId='string'
)
string
[REQUIRED]
The unique identifier of the Collector to retrieve.
dict
Response Syntax
{
'collectorId': 'string',
'collectorArn': 'string',
'type': 'AWS_COLLECTOR',
'status': 'ACTIVE'|'PENDING_DELETION',
'configRecorderArn': 'string',
'kubernetesClusterRoleArn': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
Contains the current state of the Collector.
collectorId (string) --
The unique identifier of the Collector.
collectorArn (string) --
The ARN of the Collector.
type (string) --
The source collected by this Collector.
status (string) --
The current lifecycle status.
configRecorderArn (string) --
The ARN of the provisioned AWS Config Recorder.
kubernetesClusterRoleArn (string) --
IAM role used to collect Kubernetes cluster metadata.
createdAt (datetime) --
The timestamp when the Collector was created.
updatedAt (datetime) --
The time of the last successful UpdateCollector call, returned at whole-second precision in the same date-time format as createdAt.
Retrieves one immutable artifact attached to an issue, including its content.
See also: AWS API Documentation
Request Syntax
client.get_code_issue_artifact(
environmentId='string',
issueId='string',
artifactId='string'
)
string
[REQUIRED]
The environment that owns the issue.
string
[REQUIRED]
The issue the artifact is attached to.
string
[REQUIRED]
The unique identifier of the artifact to retrieve.
dict
Response Syntax
{
'artifactId': 'string',
'artifactType': 'EVIDENCE'|'AGENT_COMMUNICATION'|'VALIDATION_EVIDENCE'|'REMEDIATION_PROPOSAL'|'DECISION'|'PATCH',
'mediaType': 'string',
'body': {
'validationEvidence': {
'exploitable': 'EXPLOITABLE'|'NOT_EXPLOITABLE'|'UNCERTAIN',
'terminalStatus': 'COMPLETED'|'FAILED'|'NO_SOURCE_AVAILABLE'|'PARTIAL',
'flowVerdicts': [
{
'flowId': 'string',
'verdict': 'CONFIRMED'|'DENIED'|'INCONCLUSIVE',
'confidence': 123.0,
'evidence': [
'string',
]
},
],
'attackFlowsConfirmed': [
'string',
],
'exploitArtifact': {
'payload': 'string',
'targetUrl': 'string',
'httpMethod': 'GET'|'HEAD'|'POST'|'PUT'|'PATCH'|'DELETE'|'OPTIONS',
'headers': {
'string': 'string'
},
'responseStatus': 123,
'responseSnippet': 'string',
'effect': 'DATA_LEAKED'|'ERROR_REVEALED'|'BEHAVIOR_CHANGED'|'NO_EFFECT'
},
'executedProof': {
'code': {
'proofCode': [
{
'content': 'string'
},
]
},
'output': {
'consoleOutput': 'string'
},
'observedEffect': 'DATA_LEAKED'|'ERROR_REVEALED'|'BEHAVIOR_CHANGED'|'NO_EFFECT'
},
'sourceAnalysis': {
'summary': 'string',
'inferredEffect': 'DATA_LEAKED'|'ERROR_REVEALED'|'BEHAVIOR_CHANGED'|'NO_EFFECT'
},
'perFindingResults': [
{
'findingId': 'string',
'exploitable': 'EXPLOITABLE'|'NOT_EXPLOITABLE'|'UNCERTAIN',
'confidence': 123.0,
'flowVerdicts': [
{
'flowId': 'string',
'verdict': 'CONFIRMED'|'DENIED'|'INCONCLUSIVE',
'confidence': 123.0,
'evidence': [
'string',
]
},
],
'reasoningChain': [
{
'step': 123,
'claim': 'string',
'source': 'string',
'confidence': 123.0
},
],
'exploitArtifact': {
'payload': 'string',
'targetUrl': 'string',
'httpMethod': 'GET'|'HEAD'|'POST'|'PUT'|'PATCH'|'DELETE'|'OPTIONS',
'headers': {
'string': 'string'
},
'responseStatus': 123,
'responseSnippet': 'string',
'effect': 'DATA_LEAKED'|'ERROR_REVEALED'|'BEHAVIOR_CHANGED'|'NO_EFFECT'
}
},
]
},
'prevalidationSignals': {
'producedBy': 'string',
'signals': [
{
'subjectRef': 'string',
'dimension': 'EXPLOITABILITY'|'BLAST_RADIUS'|'NETWORK_EXPOSURE'|'PRECONDITION'|'CODE_CONTEXT'|'LIKELIHOOD_ASSESSMENT'|'IMPACT_ASSESSMENT',
'signalStrength': 'NONE'|'WEAK'|'MODERATE'|'STRONG',
'conclusion': 'string',
'producerId': 'string',
'producerVersion': 'string',
'confidence': 123.0,
'confidenceReasoning': {
'summary': 'string',
'factors': [
'string',
]
},
'computed': {
'likelihoodBand': 'VERY_LOW'|'LOW'|'MODERATE'|'HIGH',
'impactBand': 'VERY_LOW'|'LOW'|'MODERATE'|'HIGH',
'barriers': 123
},
'preconditions': {
'reachableFromAttacker': {
'value': True|False,
'basis': 'CODE'|'GRAPH'|'FINDING'|'INFERRED'|'NO_EVIDENCE_DEFAULT',
'reason': 'string',
'missingInfo': 'string'
},
'configurationNeeded': {
'value': True|False,
'basis': 'CODE'|'GRAPH'|'FINDING'|'INFERRED'|'NO_EVIDENCE_DEFAULT',
'reason': 'string',
'missingInfo': 'string'
},
'accessLevel': {
'value': 'NONE'|'ANY_AUTHENTICATED'|'PRIVILEGED',
'basis': 'CODE'|'GRAPH'|'FINDING'|'INFERRED'|'NO_EVIDENCE_DEFAULT',
'reason': 'string',
'missingInfo': 'string'
},
'userInteractionRequired': {
'value': True|False,
'basis': 'CODE'|'GRAPH'|'FINDING'|'INFERRED'|'NO_EVIDENCE_DEFAULT',
'reason': 'string',
'missingInfo': 'string'
}
},
'impactDimensions': {
'attackerGains': {
'value': 'EXECUTE'|'MODIFY_PRIVILEGED'|'MODIFY_DATA'|'MODIFY_COSMETIC'|'READ'|'NEITHER',
'basis': 'CODE'|'GRAPH'|'FINDING'|'INFERRED'|'NO_EVIDENCE_DEFAULT',
'reason': 'string',
'missingInfo': 'string'
},
'blastRadius': {
'value': 'CROSS_TENANT'|'OTHER_USERS_IN_TENANT'|'OWN_SCOPE',
'basis': 'CODE'|'GRAPH'|'FINDING'|'INFERRED'|'NO_EVIDENCE_DEFAULT',
'reason': 'string',
'missingInfo': 'string'
},
'targetValue': {
'value': 'HIGH'|'MEDIUM'|'LOW',
'basis': 'CODE'|'GRAPH'|'FINDING'|'INFERRED'|'NO_EVIDENCE_DEFAULT',
'reason': 'string',
'missingInfo': 'string'
}
},
'exploitability': {
'verdict': 'EXPLOITABLE'|'NOT_EXPLOITABLE'|'UNCERTAIN',
'reachedCrownJewels': True|False,
'highestLayerReached': 123,
'confidenceTier': 'SOURCE_READ'|'STATIC_PROVEN'|'BUILD_PROVEN'|'RUNTIME_PROVEN',
'scriptable': True|False,
'sourceValidationArtifactId': 'string'
}
},
]
},
'remediationProposal': {
'patch': 'string',
'format': 'GIT_MAILBOX_PATCH'|'GIT_BINARY_DIFF'|'GIT_DIFF',
'filename': 'string',
'patchSha256': 'string'
},
'patch': {
'patch': 'string',
'format': 'GIT_MAILBOX_PATCH'|'GIT_BINARY_DIFF'|'GIT_DIFF',
'repositoryName': 'string',
'patchSha256': 'string',
'sizeBytes': 123,
'delivery': {
'status': 'PENDING'|'SUCCEEDED'|'FAILED'|'SKIPPED'|'ABANDONED',
'target': {
's3': {
'bucket': 'string',
'key': 'string',
'version': 'string'
},
'github': {
'owner': 'string',
'repository': 'string',
'pullRequestNumber': 123,
'headSha': 'string'
}
},
'updatedAt': datetime(2015, 1, 1)
}
},
'raw': 'string'
},
'metadata': {...}|[...]|123|123.4|'string'|True|None,
'producer': {
'agent': 'string'
},
'createdAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
Contains the requested artifact and its content.
artifactId (string) --
The unique identifier of the artifact.
artifactType (string) --
Semantic category of the artifact.
mediaType (string) --
MIME type the producer declared for its content.
body (dict) --
The artifact body, projected against the shape defined for its artifactType. A type with a defined shape is returned as that structure, and anything else through IssueArtifactBody.raw.
validationEvidence (dict) --
Projected VALIDATION_EVIDENCE content.
exploitable (string) --
Exploitability verdict. Explicit UNCERTAIN replaces the producer's tri-state exploitable: true | false | null, so an absent verdict is never confused with a negative one.
terminalStatus (string) --
How the validation run ended. Absent when the producer reported a status with no mapping yet: the rest of the body still projects, so one unmapped enum never costs a customer the whole artifact.
flowVerdicts (list) --
One verdict per attack flow assessed in the bundle.
(dict) --
Validation's verdict for one attack flow.
flowId (string) --
Identifier of the attack flow assessed.
verdict (string) --
Outcome for this flow.
confidence (float) --
Confidence in this flow's verdict. Absent when out of range.
evidence (list) --
Citations supporting the verdict.
(string) --
A citation supporting a claim: file:line, an HTTP response, or a graph node id.
1024 rather than 512: validation agents cite a span of reasoning rather than a single location, reaching ~930 characters, and an over-long citation drops its entire ReasoningStep — claim included — rather than just the citation.
attackFlowsConfirmed (list) --
Identifiers of attack flows upgraded to Confirmed provenance.
(string) --
Identifier of an attack flow within a validation bundle.
exploitArtifact (dict) --
Concrete payload and its observed effect, when validation produced one by sending an HTTP request.
Only an HTTP proof projects here. A validation agent that proves exploitability by RUNNING code against the repository projects executedProof, and one that proves it by reading the source projects sourceAnalysis. All three are mutually exclusive: at most one is present.
payload (string) --
The exact payload sent.
targetUrl (string) --
Target the payload was sent to.
httpMethod (string) --
HTTP method the payload was sent with.
headers (dict) --
Headers sent with the payload.
(string) --
A citation supporting a claim: file:line, an HTTP response, or a graph node id.
1024 rather than 512: validation agents cite a span of reasoning rather than a single location, reaching ~930 characters, and an over-long citation drops its entire ReasoningStep — claim included — rather than just the citation.
(string) --
A bounded free-text field in a projected artifact body.
8192 rather than 4096: a validation agent's reasoning claim runs to ~5.6K in practice, and a claim dropped on length takes its whole ReasoningStep with it. Deliberately NOT raised to the proof-body bound — this type is also the member of a 50-entry ReasoningSteps list and of ArtifactHeaders, so its bound multiplies into the worst-case response size.
The product of these bounds is NOT what actually caps a response. Every projected body is read out of one IssueArtifactContent, itself bounded at 5 MiB, so no projection can exceed the size of the content it came from whatever the member bounds permit. Keeping this one modest is about not inflating a typical response, not about the ceiling.
responseStatus (integer) --
HTTP status observed in the response.
responseSnippet (string) --
Leading portion of the response body, bounded by the producer.
effect (string) --
Effect observed from sending the payload.
executedProof (dict) --
Proof the agent produced by executing code against the repository under test, with the output that execution produced.
code (dict) --
The code that was run. Not a request payload: it imports the repository's own modules and drives the vulnerable code path directly.
proofCode (list) --
Proof program files, main file first, in their retained order.
(dict) --
One proof program file. Further members, such as path and purpose, can be added later as optional details.
content (string) --
The file's non-blank text, exactly as retained.
output (dict) --
What the execution printed, including the agent's own PASS/FAIL assertions. Absent when the run printed nothing retained.
consoleOutput (string) --
What the run printed: standard output and standard error merged, as retained. The text may be empty.
observedEffect (string) --
Effect the execution actually produced. observedEffect rather than effect: this one was witnessed, and the name has to stay distinguishable from ValidationSourceAnalysis.inferredEffect, which was not.
sourceAnalysis (dict) --
Proof the agent produced by reading the repository's source, with nothing built or run.
summary (string) --
The non-blank analysis as Markdown: the annotated entry-to-sink walk, its citations, and why the checked guards are absent or bypassed.
inferredEffect (string) --
Effect the agent concluded WOULD occur. Deliberately not effect: nothing was executed, so this is reasoned from the source and must not be read as an observation. See ValidationExecutedProof.observedEffect.
perFindingResults (list) --
Per-finding breakdown for a multi-finding bundle. Absent for a single-finding bundle.
(dict) --
Validation's result for one finding within a multi-finding bundle.
findingId (string) --
The finding assessed.
exploitable (string) --
Exploitability verdict for this finding.
confidence (float) --
Confidence in this finding's verdict. Absent when out of range.
flowVerdicts (list) --
Per-flow verdicts recorded for this finding.
(dict) --
Validation's verdict for one attack flow.
flowId (string) --
Identifier of the attack flow assessed.
verdict (string) --
Outcome for this flow.
confidence (float) --
Confidence in this flow's verdict. Absent when out of range.
evidence (list) --
Citations supporting the verdict.
(string) --
A citation supporting a claim: file:line, an HTTP response, or a graph node id.
1024 rather than 512: validation agents cite a span of reasoning rather than a single location, reaching ~930 characters, and an over-long citation drops its entire ReasoningStep — claim included — rather than just the citation.
reasoningChain (list) --
Reasoning chain recorded for this finding.
(dict) --
One step in the validation agent's reasoning chain.
step (integer) --
Position of this step in the chain.
claim (string) --
The claim or conclusion reached at this step.
source (string) --
Citation supporting the claim.
confidence (float) --
Confidence in this individual claim, on the producer's native 0-1 scale.
exploitArtifact (dict) --
Exploit artifact produced for this finding, when there was one.
payload (string) --
The exact payload sent.
targetUrl (string) --
Target the payload was sent to.
httpMethod (string) --
HTTP method the payload was sent with.
headers (dict) --
Headers sent with the payload.
(string) --
A citation supporting a claim: file:line, an HTTP response, or a graph node id.
1024 rather than 512: validation agents cite a span of reasoning rather than a single location, reaching ~930 characters, and an over-long citation drops its entire ReasoningStep — claim included — rather than just the citation.
(string) --
A bounded free-text field in a projected artifact body.
8192 rather than 4096: a validation agent's reasoning claim runs to ~5.6K in practice, and a claim dropped on length takes its whole ReasoningStep with it. Deliberately NOT raised to the proof-body bound — this type is also the member of a 50-entry ReasoningSteps list and of ArtifactHeaders, so its bound multiplies into the worst-case response size.
The product of these bounds is NOT what actually caps a response. Every projected body is read out of one IssueArtifactContent, itself bounded at 5 MiB, so no projection can exceed the size of the content it came from whatever the member bounds permit. Keeping this one modest is about not inflating a typical response, not about the ceiling.
responseStatus (integer) --
HTTP status observed in the response.
responseSnippet (string) --
Leading portion of the response body, bounded by the producer.
effect (string) --
Effect observed from sending the payload.
prevalidationSignals (dict) --
Projected EVIDENCE content whose stored envelope declares artifact_kind: prevalidation_signals — the severity signals prioritization uses.
One artifactType can select different members here: EVIDENCE also carries the prioritization markdown narrative, which is not JSON and so returns through raw. The member is therefore chosen by artifactType AND, for a type that carries more than one payload kind, the content's own discriminator.
producedBy (string) --
The agent that produced this signal set.
signals (list) --
The signals backing the Issue's proposed severity.
(dict) --
One producer's conclusion about one subject on one scoring dimension.
subjectRef (string) --
What this signal is about, such as a finding or issue reference.
dimension (string) --
The axis this signal speaks to. Absent when the producer reported a dimension with no mapping yet.
signalStrength (string) --
The signal's own rating. This is an input to scoring and is NOT the finding's severity.
conclusion (string) --
The producer's conclusion.
producerId (string) --
Stable name of the producer that emitted this signal.
producerVersion (string) --
Version of that producer.
confidence (float) --
The producer's confidence in this conclusion, on its native 0-1 scale. Absent when the stored value falls outside 0-1.
confidenceReasoning (dict) --
Why the producer is or is not sure, kept structured rather than prose.
summary (string) --
One-line rationale.
factors (list) --
The individual factors behind it.
(string) --
A citation supporting a claim: file:line, an HTTP response, or a graph node id.
1024 rather than 512: validation agents cite a span of reasoning rather than a single location, reaching ~930 characters, and an over-long citation drops its entire ReasoningStep — claim included — rather than just the citation.
computed (dict) --
The deterministic values the producer computed from its assessment.
likelihoodBand (string) --
Computed likelihood band, on a likelihood signal.
impactBand (string) --
Computed impact band, on an impact signal.
barriers (integer) --
How many of the four exploit preconditions act as barriers (0-4).
preconditions (dict) --
The four exploit preconditions a likelihood signal assessed, each with the basis the producer had for it.
reachableFromAttacker (dict) --
Whether the vulnerable code path is reachable by an attacker.
value (boolean) --
The producer's determination.
A Boolean rather than an enum, against the Common Terms preference for enums on extensibility grounds. The question each precondition answers is closed — is the code reachable, is configuration required, must a user other than the attacker interact — and the only third state, "not determined", is already expressed by omitting this member, which the projection does whenever the stored value is not a bool. An enum would give two ways to say the same thing, while basis and missingInfo already qualify how firm the answer is.
basis (string) --
Where the producer's determination came from.
reason (string) --
The producer's explanation.
missingInfo (string) --
What the producer could not determine, when anything was missing.
configurationNeeded (dict) --
Whether exploitation depends on a non-default configuration.
value (boolean) --
The producer's determination.
A Boolean rather than an enum, against the Common Terms preference for enums on extensibility grounds. The question each precondition answers is closed — is the code reachable, is configuration required, must a user other than the attacker interact — and the only third state, "not determined", is already expressed by omitting this member, which the projection does whenever the stored value is not a bool. An enum would give two ways to say the same thing, while basis and missingInfo already qualify how firm the answer is.
basis (string) --
Where the producer's determination came from.
reason (string) --
The producer's explanation.
missingInfo (string) --
What the producer could not determine, when anything was missing.
accessLevel (dict) --
What level of access exploitation requires.
value (string) --
The level of access exploitation requires. Absent when the producer reported a level with no mapping yet.
basis (string) --
Where the producer's determination came from.
reason (string) --
The producer's explanation.
missingInfo (string) --
What the producer could not determine, when anything was missing.
userInteractionRequired (dict) --
Whether exploitation requires a user other than the attacker to take part, for example by opening a link or a file (CVSS User Interaction).
value (boolean) --
The producer's determination.
A Boolean rather than an enum, against the Common Terms preference for enums on extensibility grounds. The question each precondition answers is closed — is the code reachable, is configuration required, must a user other than the attacker interact — and the only third state, "not determined", is already expressed by omitting this member, which the projection does whenever the stored value is not a bool. An enum would give two ways to say the same thing, while basis and missingInfo already qualify how firm the answer is.
basis (string) --
Where the producer's determination came from.
reason (string) --
The producer's explanation.
missingInfo (string) --
What the producer could not determine, when anything was missing.
impactDimensions (dict) --
The three impact dimensions an impact signal assessed, each with the basis the producer had for it. These are what the computed impact band is derived from.
attackerGains (dict) --
What the attacker gains from exploitation.
value (string) --
The capability exploitation grants. Absent when the producer reported a value with no mapping yet.
basis (string) --
Where the producer's determination came from.
reason (string) --
The producer's explanation.
missingInfo (string) --
What the producer could not determine, when anything was missing.
blastRadius (dict) --
How far the consequences reach.
value (string) --
How far the consequences reach. Absent when the producer reported a value with no mapping yet.
basis (string) --
Where the producer's determination came from.
reason (string) --
The producer's explanation.
missingInfo (string) --
What the producer could not determine, when anything was missing.
targetValue (dict) --
How valuable the target is, which can shift the band off its base value.
value (string) --
How valuable the target is. Absent when the producer reported a value with no mapping yet.
basis (string) --
Where the producer's determination came from.
reason (string) --
The producer's explanation.
missingInfo (string) --
What the producer could not determine, when anything was missing.
exploitability (dict) --
What validation established about exploitability, on an exploitability signal. This summarizes the verdict the signal was derived from; the proof itself is the VALIDATION_EVIDENCE artifact it cites.
verdict (string) --
Validation's verdict. UNCERTAIN covers a run that was inconclusive — out of budget, an ambiguous failure, or no decisive layer reached — and is never a refutation.
reachedCrownJewels (boolean) --
Whether validation reached the high-value sink the attack path posited.
A Boolean rather than an enum: the sink was either reached or it was not, and how far the walk got when it was not is already carried, with more precision, by highestLayerReached. An unknown is the absent member.
highestLayerReached (integer) --
The highest impact layer validation reached, 1-5, as a measure of how far the attack path was walked.
confidenceTier (string) --
How strong the evidence behind the verdict is.
scriptable (boolean) --
Whether the proven exploit is automatable rather than one-off.
A Boolean for the same reason as SignalPrecondition.value: validation records a bool, and an unknown is the absent member.
sourceValidationArtifactId (string) --
The VALIDATION_EVIDENCE artifact on this same issue holding the proof this verdict summarizes. Fetch it with GetCodeIssueArtifact for the full reasoning chain and exploit artifact.
remediationProposal (dict) --
Projected REMEDIATION_PROPOSAL content: a patch the remediation agent produced, with the descriptors needed to apply and verify it.
REMEDIATION_PROPOSAL content that does not match this shape is returned through raw.
patch (string) --
The patch exactly as the remediation agent produced it, unmodified.
format (string) --
The patch's wire format, which determines how to apply it. Absent when the producer recorded a format with no mapping yet.
filename (string) --
Filename the producer suggests for the patch, when it named one.
patchSha256 (string) --
SHA-256 of the patch bytes in lowercase hex, as recorded by the producer.
Lets a caller confirm the patch it applies is byte-for-byte the one that was reviewed. Computed over the patch bytes, so it is verifiable against patch without trusting this value.
patch (dict) --
Projected PATCH content: the remediation patch for one repository, with the descriptors needed to verify and apply it and the state of its delivery to the customer's own bucket or repository.
Every PATCH projects here. The descriptors come from members Control Plane computes or owns when it stores the patch, not from producer metadata, so this member is the whole PATCH contract and metadata is omitted for it.
patch (string) --
The patch exactly as stored, unmodified. Control Plane accepted it only as a text unified diff, so git apply applies it.
format (string) --
The patch's wire format, read from the patch itself, which determines how to apply it. Absent when the patch starts with neither a git mailbox header nor a diff --git header.
repositoryName (string) --
The repository the patch applies to, as named in the source snapshot it was generated against.
patchSha256 (string) --
SHA-256 of the patch's UTF-8 bytes in lowercase hex, computed by Control Plane when it stored the patch.
Lets a caller confirm the patch it applies is byte-for-byte the one that was reviewed. Computed over the patch bytes, so it is verifiable against patch without trusting this value.
sizeBytes (integer) --
Size of the patch in UTF-8 bytes, the unit the digest is computed over.
delivery (dict) --
Delivery of the patch to the customer's bucket or repository. Absent when the artifact has no delivery destination.
status (string) --
How far delivery to the destination has progressed.
target (dict) --
Where the patch was or will be delivered. Absent while the destination is still being resolved, or when delivery was skipped before a destination was known.
s3 (dict) --
The S3 object the patch is delivered to.
bucket (string) --
Customer-managed S3 bucket name.
key (string) --
The object key of the delivered patch.
version (string) --
The S3 version ID of the delivered object, when the bucket is versioned.
github (dict) --
The GitHub repository the patch is delivered to, including the pull request once it is opened.
owner (string) --
The GitHub user or organization that owns the repository.
repository (string) --
The repository name.
pullRequestNumber (integer) --
Repository-scoped pull request number assigned by GitHub.
headSha (string) --
The head commit SHA of the pull request. Absent until the pull request is opened.
updatedAt (datetime) --
When the delivery status last changed.
raw (string) --
The producer's content verbatim, for an artifactType with no defined shape or content that failed to parse against its shape.
metadata (:ref:`document<document>`) --
Producer-defined structured metadata, when the producer supplied any.
Returned only for an artifactType whose content has no defined shape, so that the artifact stays inspectable. For an artifactType with a defined shape, body carries the content and this member is omitted.
producer (dict) --
The agent that produced the artifact.
agent (string) --
Stable producer name, such as ContinuumValidation.
createdAt (datetime) --
The timestamp when the artifact was created.
Retrieves the current state and configuration of an environment.
See also: AWS API Documentation
Request Syntax
client.get_environment(
environmentId='string'
)
string
[REQUIRED]
The unique identifier of the environment to retrieve.
dict
Response Syntax
{
'environmentId': 'string',
'environmentArn': 'string',
'name': 'string',
'status': 'ACTIVE',
'statusMessage': 'string',
'statusUpdatedAt': datetime(2015, 1, 1),
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'configuration': {
'codeConfiguration': {
'collectorDetails': {
'collectorDataAccessRoleArn': 'string'
},
'sourceConfiguration': {
's3Sources': [
{
'integrationId': 'string',
'codePrefix': 'string',
'contextPrefix': 'string'
},
],
'repositorySources': [
{
'integrationId': 'string',
'repository': 'string',
'defaultBranch': 'string'
},
]
},
'environmentConfiguration': {
'network': {
'allowedDomains': [
'string',
]
},
'scanFrequency': 'string',
'patchCreationPolicy': 'ENABLED'|'DISABLED'
},
'latestScan': {
'scanRunId': 'string',
'status': 'SUBMITTED'|'WAITING_FOR_BUILD'|'BUILDING'|'WAITING_FOR_SCAN'|'SCANNING'|'SUCCEEDED'|'FAILED',
'origin': 'MANUAL'|'SCHEDULED',
'createdAt': datetime(2015, 1, 1),
'completedAt': datetime(2015, 1, 1),
'failureMessage': 'string',
'failureStage': 'SUBMITTED'|'WAITING_FOR_BUILD'|'BUILDING'|'WAITING_FOR_SCAN'|'SCANNING'
}
}
}
}
Response Structure
(dict) --
Contains the current state and configuration of the requested environment.
environmentId (string) --
The unique identifier of the environment.
environmentArn (string) --
The ARN of the environment.
name (string) --
The customer-visible name of the environment.
status (string) --
The current operational status of the environment.
statusMessage (string) --
Human-readable details about the current status. Present when the status requires additional context (e.g., failure reason).
statusUpdatedAt (datetime) --
The timestamp when the status last transitioned.
createdAt (datetime) --
The timestamp when the environment was created.
updatedAt (datetime) --
The timestamp when the environment's properties were last updated.
configuration (dict) --
Type-specific configuration and state, including code sources, operating policy, Collector details, and the latest scan.
codeConfiguration (dict) --
Configuration and scan state for a code-scanning environment.
collectorDetails (dict) --
Collector data access configuration. Omitted when no Collector data access role is configured.
collectorDataAccessRoleArn (string) --
IAM role that Continuum assumes to authorize its access to associated Collector inventory. Required for nonempty Collector inventory resolution, in the same account or across accounts. This is independent from any S3 source role.
sourceConfiguration (dict) --
Sources in the shape accepted by CreateEnvironment and UpdateEnvironment.
s3Sources (list) --
S3 sources backed by previously-created S3 integrations.
(dict) --
An S3 source for one environment, backed by a previously-created S3 integration.
integrationId (string) --
Identifier of an S3 integration in the caller's account. The integration supplies the bucket, the read role, and the external ID Continuum uses to read the prefixes.
codePrefix (string) --
Prefix containing source code. Defaults to code/ when omitted.
contextPrefix (string) --
Prefix containing customer-authored context. Defaults to context/ when omitted.
repositorySources (list) --
Explicit repository selections from previously-created integrations.
(dict) --
One repository selected from a previously-created integration.
integrationId (string) --
Integration that provides the selected repository.
repository (string) --
Repository selected from that integration in owner/repository form.
defaultBranch (string) --
Branch used when a scan does not choose a more specific revision.
environmentConfiguration (dict) --
Operating policy in the shape accepted by CreateEnvironment and UpdateEnvironment.
network (dict) --
Network policy for agent execution.
allowedDomains (list) --
Domains that an environment's agent execution may contact.
(string) --
A domain name permitted for build-time dependency resolution.
scanFrequency (string) --
Recurring scan interval: P1D (1 day), P2D (2 days), or P7D (7 days). PT0H disables recurring scans. Defaults to P1D when creating an environment.
patchCreationPolicy (string) --
Whether Continuum creates a patch for a proposed remediation. Defaults to DISABLED.
latestScan (dict) --
The newest scan requested for this environment, if one exists.
scanRunId (string) --
The unique scan identifier.
status (string) --
Current customer-visible status.
origin (string) --
Why the scan was created. Always present.
createdAt (datetime) --
Time at which Continuum accepted the scan request.
completedAt (datetime) --
Time at which a terminal result was recorded.
failureMessage (string) --
Failure detail present for unsuccessful scans.
failureStage (string) --
Phase this scan failed in. Present only when status is FAILED, and absent for a scan that failed before this field existed.
Associates one Collector with this Environment and configures the customer role Continuum uses to authorize access to associated Collector data. The caller must have permission on the Environment and permission to pass the role. Continuum assumes the supplied role and calls GetCollectorDataAccessAuthorization on the requested Collector; only a successful authorization response permits the association. The caller does not need Collector data-access permission. The Environment retains its other Collector associations. Calling again with an existing association is safe and does not create a duplicate.
See also: AWS API Documentation
Request Syntax
client.associate_collector(
environmentId='string',
clientToken='string',
collectorArn='string',
collectorDataAccessRoleArn='string'
)
string
[REQUIRED]
The unique identifier of the Environment making the association.
string
Caller-provided token that makes retried association requests idempotent. The first successful request binds the token to the complete Collector ARN, supplied role, and result for at least 24 hours. During that retry window, reusing it with a different request fails with ConflictException. A matching replay still requires the supplied role to have current Collector access. Once authorized, a matching replay returns the stored result without changing association state. Revocation can deny a replay; it does not remove the stored association or its original result.
This field is autopopulated if not provided.
string
[REQUIRED]
The ARN of the Collector to associate with this Environment.
string
[REQUIRED]
IAM role in the Environment account that Continuum assumes before authorizing access to associated Collector inventory. Every association, including a same-account association, requires this role. The supplied ARN replaces the Environment's previously stored role. The customer is responsible for granting the role access to every Collector that should contribute data.
dict
Response Syntax
{
'environmentId': 'string',
'environmentArn': 'string',
'associatedCollector': {
'collectorId': 'string',
'collectorArn': 'string'
}
}
Response Structure
(dict) --
Contains the Environment and the Collector associated by this request.
environmentId (string) --
The unique identifier of the Environment making the association.
environmentArn (string) --
The ARN of the Environment making the association.
associatedCollector (dict) --
The Collector identifier and ARN validated by this operation.
collectorId (string) --
The unique identifier of the associated Collector.
collectorArn (string) --
The ARN of the associated Collector. The account and Region encoded in this ARN identify cross-account and cross-Region associations.
Creates an environment and starts its validation and any requested provisioning. Storage provisioning and dependency checks may continue after the initial 201 response; use GetEnvironment to observe completion.
See also: AWS API Documentation
Request Syntax
client.create_environment(
name='string',
configuration={
'codeConfiguration': {
'sourceConfiguration': {
's3Sources': [
{
'integrationId': 'string',
'codePrefix': 'string',
'contextPrefix': 'string'
},
],
'repositorySources': [
{
'integrationId': 'string',
'repository': 'string',
'defaultBranch': 'string'
},
]
},
'environmentConfiguration': {
'network': {
'allowedDomains': [
'string',
]
},
'scanFrequency': 'string',
'patchCreationPolicy': 'ENABLED'|'DISABLED'
}
}
}
)
string
[REQUIRED]
The customer-visible name of the environment.
dict
Type-specific configuration. Omission creates a code environment with the default operating policy and no sources.
codeConfiguration (dict) --
Configuration for a code-scanning environment.
sourceConfiguration (dict) --
Source configuration for the environment.
s3Sources (list) --
S3 sources backed by previously-created S3 integrations.
(dict) --
An S3 source for one environment, backed by a previously-created S3 integration.
integrationId (string) -- [REQUIRED]
Identifier of an S3 integration in the caller's account. The integration supplies the bucket, the read role, and the external ID Continuum uses to read the prefixes.
codePrefix (string) --
Prefix containing source code. Defaults to code/ when omitted.
contextPrefix (string) --
Prefix containing customer-authored context. Defaults to context/ when omitted.
repositorySources (list) --
Explicit repository selections from previously-created integrations.
(dict) --
One repository selected from a previously-created integration.
integrationId (string) -- [REQUIRED]
Integration that provides the selected repository.
repository (string) -- [REQUIRED]
Repository selected from that integration in owner/repository form.
defaultBranch (string) --
Branch used when a scan does not choose a more specific revision.
environmentConfiguration (dict) --
Environment-level operating policy.
network (dict) --
Network policy for agent execution.
allowedDomains (list) --
Domains that an environment's agent execution may contact.
(string) --
A domain name permitted for build-time dependency resolution.
scanFrequency (string) --
Recurring scan interval: P1D (1 day), P2D (2 days), or P7D (7 days). PT0H disables recurring scans. Defaults to P1D when creating an environment.
patchCreationPolicy (string) --
Whether Continuum creates a patch for a proposed remediation. Defaults to DISABLED.
dict
Response Syntax
{
'environmentId': 'string',
'environmentArn': 'string',
'status': 'ACTIVE',
'createdAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
Contains the identifier and ARN of the newly created environment.
environmentId (string) --
The unique identifier assigned to the environment.
environmentArn (string) --
The ARN of the created environment.
status (string) --
The initial status of the environment. Always ACTIVE on successful creation.
createdAt (datetime) --
The timestamp when the environment was created.
Lists the artifacts attached to an issue in descending artifactId order. Content is returned by GetCodeIssueArtifact.
See also: AWS API Documentation
Request Syntax
client.list_code_issue_artifacts(
environmentId='string',
issueId='string',
artifactType='EVIDENCE'|'AGENT_COMMUNICATION'|'VALIDATION_EVIDENCE'|'REMEDIATION_PROPOSAL'|'DECISION'|'PATCH',
maxResults=123,
nextToken='string'
)
string
[REQUIRED]
The environment that owns the issue.
string
[REQUIRED]
The issue whose artifacts to list.
string
Optional filter for a semantic artifact category. Omit to list all artifacts attached to the issue.
integer
The maximum number of results to return in a single call.
string
A pagination token returned by a previous call. Set to null for the first request; use the returned token for subsequent calls.
dict
Response Syntax
{
'items': [
{
'artifactId': 'string',
'artifactType': 'EVIDENCE'|'AGENT_COMMUNICATION'|'VALIDATION_EVIDENCE'|'REMEDIATION_PROPOSAL'|'DECISION'|'PATCH',
'mediaType': 'string',
'producer': {
'agent': 'string'
},
'contentSizeBytes': 123,
'createdAt': datetime(2015, 1, 1)
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
Contains the list of artifact summaries and an optional pagination token.
items (list) --
The artifacts attached to the issue, ordered by artifactId descending.
(dict) --
A summary of an artifact returned in list responses.
artifactId (string) --
The unique identifier of the artifact.
artifactType (string) --
Semantic category of the artifact.
mediaType (string) --
MIME type of the artifact content.
producer (dict) --
The agent that produced the artifact.
agent (string) --
Stable producer name, such as ContinuumValidation.
contentSizeBytes (integer) --
Size of the artifact content in bytes. The content itself is returned by GetCodeIssueArtifact.
createdAt (datetime) --
The timestamp when the artifact was created.
nextToken (string) --
A pagination token to retrieve the next page of results. Absent when there are no more results.
Updates the customer-controlled mutable properties of a Collector. Only the name and Kubernetes cluster IAM role can be changed.
See also: AWS API Documentation
Request Syntax
client.update_collector(
collectorId='string',
name='string',
kubernetesClusterRole={
'set': {
'roleArn': 'string',
'externalId': 'string'
},
'remove': {}
}
)
string
[REQUIRED]
The unique identifier of the Collector to update.
string
The new customer-visible name.
dict
Atomic update to the IAM role configuration used to collect Kubernetes cluster metadata. The set variant requires a complete configuration; the authenticated caller must be allowed to pass its exact roleArn to Continuum. The remove variant clears both the role and external ID.
set (dict) --
Replace the complete role configuration.
roleArn (string) -- [REQUIRED]
IAM role the authenticated caller passes to Continuum.
externalId (string) --
Optional external ID Continuum supplies when assuming roleArn. This must match the role trust policy when configured and does not replace the caller's iam:PassRole permission.
remove (dict) --
Remove the configured role and external ID.
dict
Response Syntax
{
'collectorId': 'string',
'collectorArn': 'string',
'type': 'AWS_COLLECTOR',
'status': 'ACTIVE'|'PENDING_DELETION',
'configRecorderArn': 'string',
'kubernetesClusterRoleArn': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
Contains the current state of the updated Collector.
collectorId (string) --
The unique identifier of the updated Collector.
collectorArn (string) --
The ARN of the updated Collector.
type (string) --
The source collected by this Collector.
status (string) --
The current lifecycle status.
configRecorderArn (string) --
The ARN of the provisioned AWS Config Recorder.
kubernetesClusterRoleArn (string) --
IAM role used to collect Kubernetes cluster metadata.
createdAt (datetime) --
The timestamp when the Collector was created.
updatedAt (datetime) --
The time of the last successful UpdateCollector call, returned at whole-second precision in the same date-time format as createdAt.
Lists customer-visible scans for one environment in descending scanRunId order.
See also: AWS API Documentation
Request Syntax
client.list_code_scans(
environmentId='string',
maxResults=123,
nextToken='string'
)
string
[REQUIRED]
Environment whose scans to list.
integer
Maximum number of scans to return.
string
Pagination token returned by a prior request.
dict
Response Syntax
{
'scans': [
{
'scanRunId': 'string',
'status': 'SUBMITTED'|'WAITING_FOR_BUILD'|'BUILDING'|'WAITING_FOR_SCAN'|'SCANNING'|'SUCCEEDED'|'FAILED',
'origin': 'MANUAL'|'SCHEDULED',
'createdAt': datetime(2015, 1, 1),
'completedAt': datetime(2015, 1, 1),
'failureMessage': 'string',
'failureStage': 'SUBMITTED'|'WAITING_FOR_BUILD'|'BUILDING'|'WAITING_FOR_SCAN'|'SCANNING'
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
scans (list) --
Customer-visible scans ordered by scanRunId descending.
(dict) --
Customer-visible summary of one environment scan.
scanRunId (string) --
The unique scan identifier.
status (string) --
Current customer-visible status.
origin (string) --
Why the scan was created. Always present.
createdAt (datetime) --
Time at which Continuum accepted the scan request.
completedAt (datetime) --
Time at which a terminal result was recorded.
failureMessage (string) --
Failure detail present for unsuccessful scans.
failureStage (string) --
Phase this scan failed in. Present only when status is FAILED, and absent for a scan that failed before this field existed.
nextToken (string) --
Pagination token for the next page, if present.
Ingests a customer-supplied security finding into an environment. Continuum validates the document synchronously against the required overlay fields for the declared format; invalid documents are rejected with a ValidationException. The maximum accepted document size is 256 KB. The environment must have a source configured, and the finding must identify a code location so Continuum can tie it to a repository in the environment's build. Continuum assigns a findingId and stores the verbatim document. When no successful build yet contains the finding's repository, the finding stays SUBMITTED until the next successful build; if that build does not contain it either, the finding is DISCARDED with discardReason SOURCE_REPO_NOT_FOUND.
See also: AWS API Documentation
Request Syntax
client.create_code_finding(
environmentId='string',
ocsfDocument={...}|[...]|123|123.4|'string'|True|None,
clientToken='string'
)
string
[REQUIRED]
The environment to ingest the finding into.
:ref:`document<document>`
[REQUIRED]
The OCSF finding document to ingest, verbatim. Must declare a class_uid Continuum supports (2002 Vulnerability Finding, or 2007 Application Security Posture Finding) and validate against the vendored OCSF JSON Schema for that class, including the Continuum overlay requirements that finding_info.uid be present and that vulnerabilities[0].affected_code[0].file identify the code location. With several repositories in the environment, the file path must begin with the repository name. Maximum size 256 KB. Stored verbatim and normalized into the typed Finding members returned by GetCodeFinding. GetCodeFinding does not return the document itself.
string
Caller-provided idempotency token. A retry with the same token and an identical finding document replays the original result; the same token with different content is rejected.
This field is autopopulated if not provided.
dict
Response Syntax
{
'findingId': 'string',
'findingArn': 'string',
'title': 'string',
'status': 'SUBMITTED'|'VALIDATING'|'CONFIRMED'|'DISCARDED',
'createdAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
Contains the identifier, ARN, title, and initial status of the newly ingested finding.
findingId (string) --
The unique identifier assigned to the finding.
findingArn (string) --
The ARN of the ingested finding.
title (string) --
The title extracted from the submitted document. Always populated at ingestion.
status (string) --
The finding's current lifecycle status -- SUBMITTED for a newly ingested finding, or the finding's present status when an idempotent retry replays an already-processed finding.
createdAt (datetime) --
The timestamp when the finding was ingested.
Authorizes an Environment's access to a Collector's data. Continuum calls this operation with the Environment's Collector data-access role before it reads the Collector's inventory, so grant continuum:GetCollectorDataAccessAuthorization to that role and, for a Collector in another account, in the Collector's resource policy. The operation evaluates the action against the exact Collector ARN and the Collector's current resource policy using IAM and the caller's authenticated request context, with environmentArn as the continuum:EnvironmentArn condition key. A successful request returns HTTP 200 with no response members. If access is not granted, the operation returns AccessDeniedException without disclosing Collector existence, ownership, or the policy layer that denied access. The service does not reinterpret the policy using only an account ID.
See also: AWS API Documentation
Request Syntax
client.get_collector_data_access_authorization(
accountId='string',
collectorId='string',
environmentArn='string'
)
string
[REQUIRED]
The AWS account that owns the Collector.
string
[REQUIRED]
The unique identifier of the Collector.
string
The full ARN of the Environment requesting the Collector's data. The Environment must be in the caller's account. Continuum supplies this value as the continuum:EnvironmentArn condition key.
dict
Response Syntax
{}
Response Structure
(dict) --
Empty response returned when the authenticated caller is authorized to access the Collector's data.
Lists the Collectors currently associated with one Environment in ascending collectorId order. Each entry carries the Collector ARN, so a listed association can be passed straight to DisassociateCollector, including when the Collector belongs to another account. An association recorded before Continuum persisted the ARN is omitted from the response, because without the ARN it cannot be acted on.
See also: AWS API Documentation
Request Syntax
client.list_associated_collectors(
environmentId='string',
maxResults=123,
nextToken='string'
)
string
[REQUIRED]
The unique identifier of the Environment whose associations to list.
integer
Maximum number of associated Collectors to return.
string
Pagination token returned by a prior request.
dict
Response Syntax
{
'associatedCollectors': [
{
'collectorId': 'string',
'collectorArn': 'string'
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
Contains one page of the Collectors associated with the requested Environment.
associatedCollectors (list) --
The Collectors associated with this Environment, ordered by collectorId ascending. Empty when the Environment has no associations, and also when every association on the page predates Continuum persisting the ARN — the page is still advanced by nextToken in that case.
(dict) --
One Collector associated with an Environment.
collectorId (string) --
The unique identifier of the associated Collector.
collectorArn (string) --
The ARN of the associated Collector. The account and Region encoded in this ARN identify cross-account and cross-Region associations.
nextToken (string) --
Pagination token for the next page, if present.
Retrieves information about an integration.
See also: AWS API Documentation
Request Syntax
client.get_integration(
integrationId='string'
)
string
[REQUIRED]
The unique identifier of the integration to retrieve.
dict
Response Syntax
{
'integrationId': 'string',
'integrationArn': 'string',
'name': 'string',
'integrationType': 'GITHUB'|'GITLAB'|'S3',
'providerDetails': {
'github': {
'organizationName': 'string'
},
'gitlab': {
'instanceUrl': 'string',
'targetType': 'GROUP'|'PROJECT',
'targetPath': 'string',
'tokenRotation': 'AUTOMATIC'|'NONE',
'expiresAt': datetime(2015, 1, 1)
},
's3': {
'bucket': 'string',
'roleArn': 'string'
}
},
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
Contains metadata for the requested integration.
integrationId (string) --
The unique identifier of the integration.
integrationArn (string) --
The ARN of the integration.
name (string) --
The name of the integration.
integrationType (string) --
The immutable provider type for the integration.
providerDetails (dict) --
Provider-specific details for the integration.
github (dict) --
Details for a GitHub.com integration.
organizationName (string) --
The name of the GitHub organization associated with the integration.
gitlab (dict) --
Details for a GitLab integration.
instanceUrl (string) --
The HTTPS base URL of the GitLab instance.
targetType (string) --
Whether the integration targets a group or a single project.
targetPath (string) --
The group or project path the integration targets.
tokenRotation (string) --
How the integration's access token is rotated. AUTOMATIC only when the pasted token had the self-rotate scope and rotation was opted in at installation time.
expiresAt (datetime) --
The expiry of the stored access token, for non-rotating tokens only. A rotated token's original expiry is stale, so this is omitted when tokenRotation is AUTOMATIC.
s3 (dict) --
Public details for a customer-managed S3 integration.
bucket (string) --
Customer-managed S3 bucket name.
roleArn (string) --
IAM role assumed by Continuum to read a customer-managed S3 integration.
createdAt (datetime) --
The timestamp when the integration was created.
updatedAt (datetime) --
The timestamp when the integration was last updated.
Creates the Collector for the caller's account. Provisions an AWS Config service-linked recorder using the caller's federated access session and begins recording infrastructure changes.
See also: AWS API Documentation
Request Syntax
client.create_collector(
type='AWS_COLLECTOR',
kubernetesClusterRole={
'roleArn': 'string',
'externalId': 'string'
},
clientToken='string'
)
string
Source to collect. Defaults to AWS_COLLECTOR when omitted.
dict
IAM role configuration used to collect Kubernetes cluster metadata. The authenticated caller must be allowed to pass its exact roleArn to Continuum.
roleArn (string) -- [REQUIRED]
IAM role the authenticated caller passes to Continuum.
externalId (string) --
Optional external ID Continuum supplies when assuming roleArn. This must match the role trust policy when configured and does not replace the caller's iam:PassRole permission.
string
Caller-provided token that makes retried create requests return the original Collector rather than creating a duplicate.
This field is autopopulated if not provided.
dict
Response Syntax
{
'collectorId': 'string',
'collectorArn': 'string',
'type': 'AWS_COLLECTOR',
'status': 'ACTIVE'|'PENDING_DELETION',
'createdAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
Contains the identifier and ARN of the newly created Collector.
collectorId (string) --
The unique identifier assigned to the Collector.
collectorArn (string) --
The ARN of the created Collector.
type (string) --
The source collected by this Collector.
status (string) --
The current lifecycle status.
createdAt (datetime) --
The timestamp when the Collector was created.
Creates a new integration with an external source provider. Repeating an identical request with the same clientToken returns the original integrationId, integrationArn, and createdAt. Token records are retained for eight hours after success or terminal failure, including after the integration is deleted; replaying a deleted integration's token does not recreate it. An identical request with a retained terminal failure returns the recorded error.
Reusing a token with different parameters returns ValidationException. A fresh token starts a new create attempt; if the name is already owned by another integration, ConflictException includes that integration's identifier. An attempt still in progress may return ThrottlingException with retryAfterSeconds set to 1; retry with the same token and identical parameters.
GitHub authorization codes are single use. Retry an unresolved attempt with its original token and unchanged parameters first. If the service reports a terminal failure, an expired attempt, or a successful token exchange whose integration could not be saved, restart GitHub authorization with a fresh token and authorization code. The service does not checkpoint provider results for recovery by another request.
See also: AWS API Documentation
Request Syntax
client.create_integration(
clientToken='string',
name='string',
providerConfiguration={
'github': {
'authorization': {
'authorizationCode': 'string',
'state': 'string',
'redirectUrl': 'string'
},
'organizationName': 'string'
},
'gitlab': {
'instanceUrl': 'string',
'targetType': 'GROUP'|'PROJECT',
'targetPath': 'string',
'accessToken': 'string'
},
's3': {
'bucket': 'string',
'roleArn': 'string',
'externalId': 'string'
}
}
)
string
An optional token identifying one create attempt within the caller's account, Region, and operation. SDKs generate a token when omitted. If a request reaches the service without a token, the service generates one for that request. Each request without a token starts a new attempt. To replay an attempt, supply the same token and identical input. Authorized users and roles in the same account can retry an attempt this way. Token records are retained for eight hours after success or terminal failure, including after deletion of a successfully created integration. Different input with the same token returns ValidationException.
This field is autopopulated if not provided.
string
[REQUIRED]
The name for the integration.
dict
[REQUIRED]
The provider-specific configuration required to create the integration. Only one member may be specified.
github (dict) --
Configuration for a GitHub.com integration.
authorization (dict) -- [REQUIRED]
OAuth authorization used to establish the integration. Required on create; not returned on read operations.
authorizationCode (string) -- [REQUIRED]
The OAuth authorization code returned by GitHub after the user authorizes the application.
state (string) -- [REQUIRED]
The state returned by GitHub in the OAuth callback. It must be the state that StartIntegrationAuthorization returned to the same AWS account, and the authorization request must have sent that call's codeChallenge. The state can be redeemed once. A stage that enforces authorization sessions rejects a missing, expired, already used, or other-account state with ValidationException; restart the authorization with StartIntegrationAuthorization.
redirectUrl (string) --
The redirect URL used to obtain the authorization code. Must match one of the redirect URLs registered on the GitHub App. If omitted, the App's default redirect URL is used. Not stored or returned after creation.
organizationName (string) --
The name of the GitHub organization to associate with the integration. If not specified, the integration is associated with the authenticated user's personal account.
gitlab (dict) --
Configuration for a GitLab integration.
instanceUrl (string) -- [REQUIRED]
The HTTPS base URL of the GitLab instance (gitlab.com or self-managed).
targetType (string) -- [REQUIRED]
Whether the integration targets a group or a single project.
targetPath (string) -- [REQUIRED]
The group or project path the integration targets.
accessToken (string) -- [REQUIRED]
The GitLab access token (personal, group or project). Write-only; not stored or returned after creation. If the token carries the self-rotate scope, rotation is opted in and Continuum manages the token thereafter.
s3 (dict) --
Configuration for a customer-managed S3 integration.
bucket (string) -- [REQUIRED]
Customer-managed source bucket name.
roleArn (string) -- [REQUIRED]
Role Continuum will assume to read from the source bucket.
externalId (string) -- [REQUIRED]
Caller-provided external ID required by the role trust policy.
dict
Response Syntax
{
'integrationId': 'string',
'integrationArn': 'string',
'createdAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
Contains the original identifier, ARN, and creation time of the new or replayed integration. A replay can refer to an integration that has since been deleted.
integrationId (string) --
The unique identifier of the created integration.
integrationArn (string) --
The ARN of the created integration.
createdAt (datetime) --
The timestamp when the integration was created.
Retrieves the current state and details of an issue.
See also: AWS API Documentation
Request Syntax
client.get_code_issue(
environmentId='string',
issueId='string'
)
string
[REQUIRED]
The environment that owns the issue.
string
[REQUIRED]
The unique identifier of the issue to retrieve.
dict
Response Syntax
{
'issueId': 'string',
'issueArn': 'string',
'name': 'string',
'synopsis': 'string',
'severity': 'LOW'|'MEDIUM'|'HIGH'|'CRITICAL',
'confidence': 123,
'severityReasoning': 'string',
'summary': 'string',
'findingIds': [
'string',
],
'status': 'CREATED'|'IN_PROGRESS'|'COMPLETED'|'FAILED',
'phase': 'VALIDATION'|'PRIORITIZATION'|'REMEDIATION',
'statusReason': 'INTERNAL_ERROR'|'REMEDIATION_FAILED',
'statusMessage': 'string',
'statusUpdatedAt': datetime(2015, 1, 1),
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'evidenceAvailability': 'NONE'|'AVAILABLE',
'patchDelivery': {
'status': 'PENDING'|'SUCCEEDED'|'FAILED'|'SKIPPED',
'patchCount': 123,
'succeededCount': 123,
'failedCount': 123,
'failureReasons': [
'ARTIFACT_READ_FAILED'|'ARTIFACT_SOURCE_MISMATCH'|'ARTIFACT_SOURCE_MISSING'|'BUILD_NOT_FOUND'|'BUILD_READ_FAILED'|'BUILD_RESULT_SCOPE_MISMATCH'|'DELIVERY_NOT_CONFIGURED'|'DELIVERY_SOURCE_KIND_CHANGED'|'DUPLICATE_LOGICAL_REPOSITORY'|'DUPLICATE_OR_INVALID_REPOSITORY'|'ENVIRONMENT_DELETED'|'ENVIRONMENT_NOT_ACTIVE'|'ENVIRONMENT_NOT_FOUND'|'ENVIRONMENT_READ_FAILED'|'S3_ACCESS_DENIED'|'S3_SOURCE_PREFIX_OVERLAP'|'SOURCE_INTEGRATION_UNRESOLVED'|'SOURCE_INTEGRATION_READ_FAILED'|'SOURCE_INTEGRATION_INVALID'|'SOURCE_INTEGRATION_CHANGED'|'EXPORT_CREDENTIALS_MISSING'|'EXPORT_CREDENTIAL_EXPIRY_INVALID'|'EXPORT_DESTINATION_INVALID'|'EXPORT_EXISTING_OBJECT_MISMATCH'|'EXPORT_PUT_FAILED'|'EXPORT_RECONCILIATION_READ_FAILED'|'EXPORT_ROLE_ASSUMPTION_FAILED'|'GITHUB_ACCESS_DENIED'|'GITHUB_BASE_NOT_FOUND'|'GITHUB_BRANCH_CONFLICT'|'GITHUB_NOT_FOUND'|'GITHUB_RATE_LIMITED'|'GITHUB_REPOSITORY_CHANGED'|'GITHUB_REPOSITORY_NOT_FOUND'|'GITHUB_REQUEST_FAILED'|'GITHUB_REQUEST_REJECTED'|'GITHUB_RESPONSE_INVALID'|'GREEN_ATTEMPT_NOT_SUCCESSFUL'|'GREEN_COMPLETION_NOT_OBSERVED'|'PATCH_NOT_SELECTED'|'INCOMPLETE_SOURCE_REFERENCE'|'INVALID_ARCHIVE_DIGEST'|'INVALID_ARTIFACT_SOURCE'|'INVALID_COMPLETED_MANIFEST'|'INVALID_EXPORT_RECEIPT'|'INVALID_GITHUB_PROVENANCE'|'INVALID_S3_DESTINATION'|'INVALID_SERVICE_RECEIPT'|'INVALID_SOURCE_INVENTORY'|'INVALID_SOURCE_MANIFEST'|'INVALID_SOURCE_REFERENCE'|'ISSUE_INTEGRITY_FAILURE'|'ISSUE_NOT_FOUND'|'MANIFEST_INVENTORY_MISMATCH'|'MANIFEST_PROVENANCE_CHANGED'|'MANIFEST_REPOSITORY_SET_MISMATCH'|'MANIFEST_SCOPE_OR_VERSION_MISMATCH'|'MISSING_BUILD_RESULT'|'MISSING_COMPLETED_MANIFEST'|'MISSING_RESULT_DIGEST'|'MISSING_SOURCE_MANIFEST'|'MISSING_SOURCE_TARGET'|'PATCH_NOT_APPLICABLE'|'PATCH_STORAGE_IDENTITY_MISSING'|'PATCH_UNSUPPORTED'|'PUBLICATION_OUTCOME_UNKNOWN_AFTER_RETRY_LIMIT'|'PUBLISHER_DEADLINE_EXCEEDED'|'RESULT_COMPLETED_MANIFEST_MISMATCH'|'RESULT_SOURCE_BINDING_MISMATCH'|'SERVICE_COPY_DIGEST_MISMATCH'|'SERVICE_OBJECT_READ_FAILED'|'SERVICE_OBJECT_TOO_LARGE'|'SERVICE_RECEIPT_OUTSIDE_ISSUE'|'SOURCE_OBJECT_DIGEST_MISMATCH'|'SOURCE_REFERENCE_OUTSIDE_BUILD'|'SOURCE_TARGET_BUILD_MISMATCH'|'UNKNOWN_REPOSITORY'|'UNKNOWN_SOURCE_PROVIDER'|'UNSUPPORTED_ENVIRONMENT_SCHEMA'|'github_destination_not_enabled'|'patch_creation_policy_disabled',
]
}
}
Response Structure
(dict) --
Contains the current state and details of the requested issue.
issueId (string) --
The unique identifier of the issue.
issueArn (string) --
The ARN of the issue.
name (string) --
The name of the issue.
synopsis (string) --
A free-form synopsis of the issue.
severity (string) --
Current severity: the FindingSeverity seed at create, overwritten by the authoritative severity that prioritization assigns after validation.
confidence (integer) --
The likelihood that this issue is a true positive, expressed as a percentage (0-100).
severityReasoning (string) --
The justification for the current severity. Always leads with a customer-facing basis clause synthesized from how the severity was determined (e.g. "Severity from finding.", "Severity from Continuum system."); when prioritization has run, its own reasoning follows. Issues created before the basis clause was introduced return their original reasoning without it.
summary (string) --
The remediation completion summary, when the green stage has run.
findingIds (list) --
The findings that motivated this issue. Bare identifiers only -- a caller authorized for GetCodeIssue is not necessarily authorized to read finding detail; call GetCodeFinding for that. Every referenced finding is included regardless of origin (both CustomerUploaded and ContinuumScanner).
(string) --
The unique identifier for a Finding resource.
status (string) --
The current lifecycle status of the issue.
phase (string) --
The part of the workflow the issue is in. Present when status is IN_PROGRESS, and when status is FAILED and the failing phase is known.
statusReason (string) --
Why the issue failed. Present only when status is FAILED.
statusMessage (string) --
Customer-facing explanation of statusReason. Present only when status is FAILED.
statusUpdatedAt (datetime) --
The timestamp when the status or phase last changed.
createdAt (datetime) --
The timestamp when the issue was created.
updatedAt (datetime) --
The timestamp when any field of the issue last changed. Advances on every mutation (including score-only updates that do not transition status), so it is greater than or equal to statusUpdatedAt.
evidenceAvailability (string) --
Whether the issue has any attached evidence (formerly 'artifacts': tool output, remediation proposals, patches). NONE = no evidence; AVAILABLE = at least one evidence item exists. Computed at read time.
patchDelivery (dict) --
Customer delivery of the issue's patches, summarized from its PATCH artifacts at read time. Absent when no patch has a destination delivery.
status (string) --
The overall result, in priority order: FAILED when any patch's destination delivery failed or exhausted its retries; otherwise PENDING while any is still in progress; otherwise SUCCEEDED when at least one was delivered; otherwise SKIPPED.
patchCount (integer) --
Number of the issue's patches that have a destination delivery.
succeededCount (integer) --
Number of those patches delivered to their destination.
failedCount (integer) --
Number of those patches whose delivery failed or exhausted its retries.
failureReasons (list) --
Distinct reasons of the failed deliveries, in ascending order. Present only when failedCount is greater than zero.
(string) --
Cause of a PATCH delivery's current state; used only by DeliveryState.reason. These are outcomes of one delivery lifecycle, not shared operation error enums. The two existing skip-code wire values are retained for compatibility.
Deletes an environment and its associated resources.
See also: AWS API Documentation
Request Syntax
client.delete_environment(
environmentId='string'
)
string
[REQUIRED]
The unique identifier of the environment to delete.
None
Retrieves one customer-visible environment scan.
See also: AWS API Documentation
Request Syntax
client.get_code_scan(
environmentId='string',
scanRunId='string'
)
string
[REQUIRED]
Environment that owns the scan.
string
[REQUIRED]
Scan to retrieve.
dict
Response Syntax
{
'scan': {
'scanRunId': 'string',
'status': 'SUBMITTED'|'WAITING_FOR_BUILD'|'BUILDING'|'WAITING_FOR_SCAN'|'SCANNING'|'SUCCEEDED'|'FAILED',
'origin': 'MANUAL'|'SCHEDULED',
'createdAt': datetime(2015, 1, 1),
'completedAt': datetime(2015, 1, 1),
'failureMessage': 'string',
'failureStage': 'SUBMITTED'|'WAITING_FOR_BUILD'|'BUILDING'|'WAITING_FOR_SCAN'|'SCANNING'
}
}
Response Structure
(dict) --
scan (dict) --
Complete customer-visible scan data.
scanRunId (string) --
The unique scan identifier.
status (string) --
Current customer-visible status.
origin (string) --
Why the scan was created. Always present.
createdAt (datetime) --
Time at which Continuum accepted the scan request.
completedAt (datetime) --
Time at which a terminal result was recorded.
failureMessage (string) --
Failure detail present for unsuccessful scans.
failureStage (string) --
Phase this scan failed in. Present only when status is FAILED, and absent for a scan that failed before this field existed.
Updates the customer-controlled mutable properties of an environment. Only the name, the environment's S3 integration source and repository selections, its scan frequency, its network policy, and its patch creation policy can be changed.
See also: AWS API Documentation
Request Syntax
client.update_environment(
environmentId='string',
name='string',
configuration={
'codeConfiguration': {
'sourceConfiguration': {
's3Sources': [
{
'integrationId': 'string',
'codePrefix': 'string',
'contextPrefix': 'string'
},
],
'repositorySources': [
{
'integrationId': 'string',
'repository': 'string',
'defaultBranch': 'string'
},
]
},
'environmentConfiguration': {
'network': {
'allowedDomains': [
'string',
]
},
'scanFrequency': 'string',
'patchCreationPolicy': 'ENABLED'|'DISABLED'
}
}
}
)
string
[REQUIRED]
The unique identifier of the environment to update.
string
The new customer-visible name.
dict
Type-specific configuration changes. Omission preserves the configuration.
codeConfiguration (dict) --
Changes to a code-scanning environment.
sourceConfiguration (dict) --
Source changes. s3Sources replaces the environment's S3 source, and repositorySources replaces its repository selections.
s3Sources (list) --
S3 sources backed by previously-created S3 integrations.
(dict) --
An S3 source for one environment, backed by a previously-created S3 integration.
integrationId (string) -- [REQUIRED]
Identifier of an S3 integration in the caller's account. The integration supplies the bucket, the read role, and the external ID Continuum uses to read the prefixes.
codePrefix (string) --
Prefix containing source code. Defaults to code/ when omitted.
contextPrefix (string) --
Prefix containing customer-authored context. Defaults to context/ when omitted.
repositorySources (list) --
Explicit repository selections from previously-created integrations.
(dict) --
One repository selected from a previously-created integration.
integrationId (string) -- [REQUIRED]
Integration that provides the selected repository.
repository (string) -- [REQUIRED]
Repository selected from that integration in owner/repository form.
defaultBranch (string) --
Branch used when a scan does not choose a more specific revision.
environmentConfiguration (dict) --
Operating-policy changes. network replaces the environment's network policy; a network without allowedDomains allows no domains. Builds accepted before the change keep the domains they were accepted with. patchCreationPolicy replaces the patch creation policy. scanFrequency updates scan cadence. Omitted members preserve their stored values.
network (dict) --
Network policy for agent execution.
allowedDomains (list) --
Domains that an environment's agent execution may contact.
(string) --
A domain name permitted for build-time dependency resolution.
scanFrequency (string) --
Recurring scan interval: P1D (1 day), P2D (2 days), or P7D (7 days). PT0H disables recurring scans. Defaults to P1D when creating an environment.
patchCreationPolicy (string) --
Whether Continuum creates a patch for a proposed remediation. Defaults to DISABLED.
dict
Response Syntax
{
'environmentId': 'string',
'environmentArn': 'string',
'name': 'string',
'status': 'ACTIVE',
'statusMessage': 'string',
'statusUpdatedAt': datetime(2015, 1, 1),
'createdAt': datetime(2015, 1, 1),
'configuration': {
'codeConfiguration': {
'collectorDetails': {
'collectorDataAccessRoleArn': 'string'
},
'sourceConfiguration': {
's3Sources': [
{
'integrationId': 'string',
'codePrefix': 'string',
'contextPrefix': 'string'
},
],
'repositorySources': [
{
'integrationId': 'string',
'repository': 'string',
'defaultBranch': 'string'
},
]
},
'environmentConfiguration': {
'network': {
'allowedDomains': [
'string',
]
},
'scanFrequency': 'string',
'patchCreationPolicy': 'ENABLED'|'DISABLED'
},
'latestScan': {
'scanRunId': 'string',
'status': 'SUBMITTED'|'WAITING_FOR_BUILD'|'BUILDING'|'WAITING_FOR_SCAN'|'SCANNING'|'SUCCEEDED'|'FAILED',
'origin': 'MANUAL'|'SCHEDULED',
'createdAt': datetime(2015, 1, 1),
'completedAt': datetime(2015, 1, 1),
'failureMessage': 'string',
'failureStage': 'SUBMITTED'|'WAITING_FOR_BUILD'|'BUILDING'|'WAITING_FOR_SCAN'|'SCANNING'
}
}
}
}
Response Structure
(dict) --
Contains the current state of the updated environment. Use GetEnvironment to read its source and environment configuration.
environmentId (string) --
The unique identifier of the updated environment.
environmentArn (string) --
The ARN of the updated environment.
name (string) --
The current customer-visible name of the environment.
status (string) --
The current operational status of the environment.
statusMessage (string) --
Human-readable details about the current status.
statusUpdatedAt (datetime) --
The timestamp when the status last transitioned. Uses the existing GetEnvironment/ListEnvironments ISO-8601 wire format for this field.
createdAt (datetime) --
The timestamp when the environment was created. Uses the existing GetEnvironment/ListEnvironments ISO-8601 wire format for this field.
configuration (dict) --
Type-specific state, including Collector details and the latest scan. Read source and operating-policy settings through GetEnvironment.
codeConfiguration (dict) --
Configuration and scan state for a code-scanning environment.
collectorDetails (dict) --
Collector data access configuration. Omitted when no Collector data access role is configured.
collectorDataAccessRoleArn (string) --
IAM role that Continuum assumes to authorize its access to associated Collector inventory. Required for nonempty Collector inventory resolution, in the same account or across accounts. This is independent from any S3 source role.
sourceConfiguration (dict) --
Sources in the shape accepted by CreateEnvironment and UpdateEnvironment.
s3Sources (list) --
S3 sources backed by previously-created S3 integrations.
(dict) --
An S3 source for one environment, backed by a previously-created S3 integration.
integrationId (string) --
Identifier of an S3 integration in the caller's account. The integration supplies the bucket, the read role, and the external ID Continuum uses to read the prefixes.
codePrefix (string) --
Prefix containing source code. Defaults to code/ when omitted.
contextPrefix (string) --
Prefix containing customer-authored context. Defaults to context/ when omitted.
repositorySources (list) --
Explicit repository selections from previously-created integrations.
(dict) --
One repository selected from a previously-created integration.
integrationId (string) --
Integration that provides the selected repository.
repository (string) --
Repository selected from that integration in owner/repository form.
defaultBranch (string) --
Branch used when a scan does not choose a more specific revision.
environmentConfiguration (dict) --
Operating policy in the shape accepted by CreateEnvironment and UpdateEnvironment.
network (dict) --
Network policy for agent execution.
allowedDomains (list) --
Domains that an environment's agent execution may contact.
(string) --
A domain name permitted for build-time dependency resolution.
scanFrequency (string) --
Recurring scan interval: P1D (1 day), P2D (2 days), or P7D (7 days). PT0H disables recurring scans. Defaults to P1D when creating an environment.
patchCreationPolicy (string) --
Whether Continuum creates a patch for a proposed remediation. Defaults to DISABLED.
latestScan (dict) --
The newest scan requested for this environment, if one exists.
scanRunId (string) --
The unique scan identifier.
status (string) --
Current customer-visible status.
origin (string) --
Why the scan was created. Always present.
createdAt (datetime) --
Time at which Continuum accepted the scan request.
completedAt (datetime) --
Time at which a terminal result was recorded.
failureMessage (string) --
Failure detail present for unsuccessful scans.
failureStage (string) --
Phase this scan failed in. Present only when status is FAILED, and absent for a scan that failed before this field existed.
Lists the findings in an environment in descending findingId order.
See also: AWS API Documentation
Request Syntax
client.list_code_findings(
environmentId='string',
maxResults=123,
nextToken='string'
)
string
[REQUIRED]
The environment whose findings to list.
integer
The maximum number of results to return in a single call.
string
A pagination token returned by a previous call. Set to null for the first request; use the returned token for subsequent calls.
dict
Response Syntax
{
'items': [
{
'findingId': 'string',
'findingArn': 'string',
'environmentId': 'string',
'source': 'string',
'sourceFindingId': 'string',
'reportedAt': datetime(2015, 1, 1),
'status': 'SUBMITTED'|'VALIDATING'|'CONFIRMED'|'DISCARDED',
'statusUpdatedAt': datetime(2015, 1, 1),
'createdAt': datetime(2015, 1, 1),
'scanRunId': 'string',
'statusMessage': 'string',
'discardReason': 'SCANNER_VALIDATED_FALSE_POSITIVE'|'SCANNER_NEEDS_REVIEW'|'FALSE_POSITIVE_VALIDATED_AGAINST_CONTEXT'|'DUPLICATE_OF_OPEN_ISSUE'|'DUPLICATE_OF_CLOSED_ISSUE'|'COMPENSATING_CONTROL_PRESENT'|'OUT_OF_SCOPE'|'INSUFFICIENT_EVIDENCE'|'PROCESSING_FAILED'|'SOURCE_REPO_NOT_FOUND',
'discardReasoning': 'string',
'duplicateOfIssueId': 'string',
'createdIssueId': 'string',
'completedAt': datetime(2015, 1, 1),
'type': 'CONTINUUM_CODE_VULN'|'CUSTOMER_CODE_VULN',
'title': 'string',
'severity': 'UNKNOWN'|'INFORMATIONAL'|'LOW'|'MEDIUM'|'HIGH'|'CRITICAL'|'FATAL'|'OTHER',
'category': 'string',
'filePath': 'string'
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
Contains the list of finding summaries and an optional pagination token.
items (list) --
The findings in the environment, ordered by findingId descending.
(dict) --
A summary of a finding returned in list responses. Shares FindingLifecycleFields with the read operations so the list and get projections cannot drift. Carries a lean content subset -- fetch the finding for its full contents.
findingId (string) --
The unique identifier of the finding.
findingArn (string) --
The ARN of the finding.
environmentId (string) --
The environment that owns the finding.
source (string) --
The system that produced the finding.
sourceFindingId (string) --
The producer's own identifier for the finding.
reportedAt (datetime) --
When the producer reported the finding -- its own clock, which is not Continuum's ingestion time. createdAt is when Continuum accepted it; these are genuinely different instants and a reader usually wants this one.
For CreateCodeFinding, this is the submitted OCSF document's own top-level time. For findings Continuum's scanner produces, it is the finding's own creation time.
Continuum does not validate it for plausibility: a producer's value is echoed as given, so a timestamp here asserts the unit and format, not that the instant is genuine.
status (string) --
The current lifecycle status of the finding.
statusUpdatedAt (datetime) --
The timestamp when the status last transitioned.
createdAt (datetime) --
The timestamp when the finding was ingested.
scanRunId (string) --
The scan that produced the finding, when it came from one. For a finding Continuum's scanner produced, this is the Continuum scan run (see GetCodeScan). For a finding submitted with CreateCodeFinding, it is the OCSF document's metadata.correlation_uid, when that value is a valid ScanRunId. Absent when the finding did not come from a scan.
statusMessage (string) --
Human-readable context about the current status.
discardReason (string) --
Why the finding was not escalated. Present only when status is DISCARDED.
discardReasoning (string) --
Customer-facing explanation accompanying discardReason.
duplicateOfIssueId (string) --
The existing issue this finding duplicates. Present only for the DUPLICATE_OF_* discard reasons.
createdIssueId (string) --
The issue Continuum created from this finding.
completedAt (datetime) --
When processing finished, whether by creating an issue or discarding. Absent while the finding is still in flight.
type (string) --
What kind of finding this is.
title (string) --
The producer's title for the finding.
severity (string) --
The finding's severity.
category (string) --
The producer's vulnerability category.
filePath (string) --
The file the finding is about, when it has a code location.
nextToken (string) --
A pagination token to retrieve the next page of results. Absent when there are no more results.
Lists all environments in your account in descending environmentId order. This complete-inventory operation intentionally has no response filters; see the input documentation for the API standards justification.
See also: AWS API Documentation
Request Syntax
client.list_environments(
maxResults=123,
nextToken='string'
)
integer
The maximum number of results to return in a single call.
string
A pagination token returned by a previous call. Set to null for the first request; use the returned token for subsequent calls.
dict
Response Syntax
{
'items': [
{
'environmentId': 'string',
'environmentArn': 'string',
'name': 'string',
'status': 'ACTIVE',
'createdAt': datetime(2015, 1, 1)
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
Contains environment metadata and an optional pagination token.
items (list) --
Common metadata for the environments in the account, ordered by environmentId descending.
(dict) --
Summary of an environment returned in list responses.
environmentId (string) --
The unique identifier of the environment.
environmentArn (string) --
The ARN of the environment.
name (string) --
The customer-visible name of the environment.
status (string) --
The current operational status of the environment.
createdAt (datetime) --
The timestamp when the environment was created. Preserve the existing EnvironmentSummary.createdAt date-time wire format.
nextToken (string) --
A pagination token to retrieve the next page of results. Absent when there are no more results.
Retrieves the current state and details of a finding.
See also: AWS API Documentation
Request Syntax
client.get_code_finding(
environmentId='string',
findingId='string'
)
string
[REQUIRED]
The environment that owns the finding.
string
[REQUIRED]
The unique identifier of the finding to retrieve.
dict
Response Syntax
{
'type': 'CONTINUUM_CODE_VULN'|'CUSTOMER_CODE_VULN',
'title': 'string',
'severity': 'UNKNOWN'|'INFORMATIONAL'|'LOW'|'MEDIUM'|'HIGH'|'CRITICAL'|'FATAL'|'OTHER',
'summary': 'string',
'detailedDescription': 'string',
'category': 'string',
'subCategory': 'string',
'cweIds': [
'string',
],
'owaspCategory': 'string',
'mitigation': 'string',
'filePath': 'string',
'lineNumber': 123,
'cveId': 'string',
'cvssBaseScore': 123.0,
'affectedPackages': [
{
'name': 'string',
'version': 'string',
'fixedInVersion': 'string',
'packageManager': 'string'
},
],
'vulnerableCode': 'string',
'relevantInputs': [
'string',
],
'stepsToReproduce': [
'string',
],
'validation': {
'verdict': 'TRUE_POSITIVE'|'FALSE_POSITIVE'|'BENIGN_TRUE_POSITIVE'|'NEEDS_REVIEW',
'blockingReason': 'UNREACHABLE'|'PROTECTED'|'MISCLASSIFIED'|'EXCLUDED'|'NOT_FEASIBLE'|'RISK_MITIGATED'|'NONE',
'confidence': 123.0,
'rationale': 'string',
'severityAdjustment': 'CRITICAL'|'HIGH'|'MEDIUM'|'LOW'|'INFORMATIONAL'|'UNCHANGED',
'mitigatingControls': [
'string',
],
'preconditions': [
'string',
],
'evidence': [
{
'file': 'string',
'line': 123,
'snippet': 'string'
},
]
},
'endLine': 123,
'mitreTechniques': [
'string',
],
'remediationReferences': [
'string',
],
'ocsfClass': 'VULNERABILITY_FINDING'|'APPLICATION_SECURITY_POSTURE_FINDING',
'ocsfSchemaVersion': 'string',
'productName': 'string',
'productVendorName': 'string',
'productVersion': 'string',
'sourceStatus': 'string',
'sourceStatusId': 123,
'firstSeenAt': datetime(2015, 1, 1),
'findingTypes': [
'string',
],
'vulnerabilities': [
{
'title': 'string',
'description': 'string',
'cweId': 'string',
'cweCaption': 'string',
'additionalCweIds': [
'string',
],
'cveId': 'string',
'cvssBaseScore': 123.0,
'fixCoverage': 'string',
'fixCoverageId': 123,
'locations': [
{
'filePath': 'string',
'startLine': 123,
'endLine': 123
},
],
'remediation': 'string',
'remediationReferences': [
'string',
],
'code': 'string',
'details': 'string',
'affectedPackages': [
{
'name': 'string',
'version': 'string',
'fixedInVersion': 'string',
'packageManager': 'string'
},
]
},
],
'resources': [
{
'uid': 'string',
'name': 'string',
'type': 'string',
'region': 'string'
},
],
'posture': {
'application': 'string',
'applicationUid': 'string',
'applicationVersion': 'string',
'control': 'string',
'description': 'string',
'standards': [
'string',
],
'requirements': [
'string',
],
'checks': [
{
'uid': 'string',
'name': 'string',
'description': 'string'
},
],
'status': 'string',
'statusId': 123,
'remediation': 'string',
'remediationReferences': [
'string',
]
},
'findingId': 'string',
'findingArn': 'string',
'environmentId': 'string',
'source': 'string',
'sourceFindingId': 'string',
'reportedAt': datetime(2015, 1, 1),
'status': 'SUBMITTED'|'VALIDATING'|'CONFIRMED'|'DISCARDED',
'statusUpdatedAt': datetime(2015, 1, 1),
'createdAt': datetime(2015, 1, 1),
'scanRunId': 'string',
'statusMessage': 'string',
'discardReason': 'SCANNER_VALIDATED_FALSE_POSITIVE'|'SCANNER_NEEDS_REVIEW'|'FALSE_POSITIVE_VALIDATED_AGAINST_CONTEXT'|'DUPLICATE_OF_OPEN_ISSUE'|'DUPLICATE_OF_CLOSED_ISSUE'|'COMPENSATING_CONTROL_PRESENT'|'OUT_OF_SCOPE'|'INSUFFICIENT_EVIDENCE'|'PROCESSING_FAILED'|'SOURCE_REPO_NOT_FOUND',
'discardReasoning': 'string',
'duplicateOfIssueId': 'string',
'createdIssueId': 'string',
'completedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
Contains the current state and details of the requested finding. Which type-specific members are populated depends on type.
type (string) --
What kind of finding this is. Determines which of the type-specific members below are populated.
title (string) --
The producer's title for the finding.
severity (string) --
The finding's severity.
summary (string) --
A one-paragraph description.
detailedDescription (string) --
The full analysis.
category (string) --
The producer's vulnerability category. Not a stable filter key across finding types -- see FindingCategory.
subCategory (string) --
A more specific classification within category.
cweIds (list) --
CWE identifiers classifying the finding.
(string) --
A CWE identifier, e.g. "CWE-532".
owaspCategory (string) --
The OWASP Top 10 category, when the producer supplies one.
mitigation (string) --
How to fix the finding.
filePath (string) --
The file the finding is about.
lineNumber (integer) --
The 1-indexed line the finding is about. Bounds are enforced server-side rather than by a constraint trait: a numeric constraint generates a distinct newtype per enclosing structure, so the same concept would not share a type across the create input and the read output.
cveId (string) --
The CVE this finding reports, for software-composition findings. Both code types can carry one: a customer document supplies it under vulnerabilities[].cve, and Continuum's scanner reports CVEs for dependency-manifest findings.
cvssBaseScore (float) --
The CVSS base score accompanying cveId, when the producer supplies one, from 0.0 to 10.0. Not computed by Continuum. The range is enforced server-side, not by a @range trait -- the smithy-rs server SDK does not support range constraints on double shapes (smithy-rs#2007).
affectedPackages (list) --
Packages implicated by the finding.
(dict) --
A software package implicated by a finding.
name (string) --
The package name.
version (string) --
The affected version.
fixedInVersion (string) --
The earliest version that resolves the issue, when one is known.
packageManager (string) --
The ecosystem supplying the package.
vulnerableCode (string) --
The vulnerable code fragment.
relevantInputs (list) --
User-controlled inputs that reach the vulnerability.
(string) --
One entry in a free-form list carried verbatim from a producer (relevant inputs, reproduction steps, mitigating controls, preconditions, references).
stepsToReproduce (list) --
Steps to reproduce or exploit the finding.
(string) --
One entry in a free-form list carried verbatim from a producer (relevant inputs, reproduction steps, mitigating controls, preconditions, references).
validation (dict) --
The validator's assessment. Absent when no validation ran.
verdict (string) --
The validator's conclusion.
blockingReason (string) --
Why the validator reached that verdict.
confidence (float) --
The validator's confidence, from 0.0 to 1.0 inclusive. Advisory: it does not drive Continuum's own routing decisions. The range is enforced server-side, not by a @range trait -- the smithy-rs server SDK does not support range constraints on double shapes (smithy-rs#2007).
rationale (string) --
The validator's reasoning.
severityAdjustment (string) --
The validator's severity conclusion.
mitigatingControls (list) --
Controls the validator found that reduce exploitability.
(string) --
One entry in a free-form list carried verbatim from a producer (relevant inputs, reproduction steps, mitigating controls, preconditions, references).
preconditions (list) --
Conditions exploitation depends on, which bound the severity.
(string) --
One entry in a free-form list carried verbatim from a producer (relevant inputs, reproduction steps, mitigating controls, preconditions, references).
evidence (list) --
Code citations supporting the verdict.
(dict) --
A code citation supporting a validation verdict.
file (string) --
The file the evidence was found in.
line (integer) --
The 1-indexed line, when known.
snippet (string) --
The cited excerpt.
endLine (integer) --
The last line of the affected range, from the document's affected_code[].end_line.
mitreTechniques (list) --
MITRE ATT&CK technique identifiers, from the document's finding_info.attacks[].technique.uid.
(string) --
One entry in a free-form list carried verbatim from a producer (relevant inputs, reproduction steps, mitigating controls, preconditions, references).
remediationReferences (list) --
Remediation references, from the document's vulnerabilities[].remediation.references.
(string) --
One entry in a free-form list carried verbatim from a producer (relevant inputs, reproduction steps, mitigating controls, preconditions, references).
ocsfClass (string) --
The OCSF class the document declared. Determines whether posture is populated.
ocsfSchemaVersion (string) --
The OCSF schema version the producer wrote against (metadata.version).
productName (string) --
The producing product and vendor (metadata.product).
productVendorName (string) --
A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.
productVersion (string) --
A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.
sourceStatus (string) --
The producer's own status for the finding, and the enum value behind it. Distinct from status, which is Continuum's lifecycle state -- a producer may call a finding "New" while Continuum has it SUBMITTED.
sourceStatusId (integer) --
The producer's numeric enum value for sourceStatus.
firstSeenAt (datetime) --
When the producer first observed the finding (finding_info.first_seen_time). The producer's own clock, not Continuum's.
findingTypes (list) --
The producer's own classification of the finding (finding_info.types).
(string) --
One entry in a free-form list carried verbatim from a producer (relevant inputs, reproduction steps, mitigating controls, preconditions, references).
vulnerabilities (list) --
Every vulnerability the document reported. A document may report several; the flat cveId/ cvssBaseScore/ filePath/ lineNumber members above carry the first one's identity so a caller that only needs "what and where" does not have to walk this list.
(dict) --
One vulnerability reported by a finding. A customer document may report several; each carries its own identity, locations and remediation.
title (string) --
The title of a finding, from the producer's own title -- OCSF finding_info.title, or the scanner's finding title. Length matches the OCSF title constraint.
description (string) --
Free-form prose about a finding (summary, detailed analysis, rationale, remediation guidance). Capped well below the finding document's own 256 KB limit, since several of these can appear on one finding.
cweId (string) --
Primary CWE for this vulnerability, e.g. "CWE-89".
cweCaption (string) --
The producer's human-readable caption for cweId.
additionalCweIds (list) --
Further CWEs the producer attributed to this same vulnerability.
(string) --
A CWE identifier, e.g. "CWE-532".
cveId (string) --
A CVE identifier, e.g. "CVE-2020-8203".
cvssBaseScore (float) --
The CVSS base score for cveId, when the producer supplies one, from 0.0 to 10.0.
fixCoverage (string) --
The producer's description of how completely a fix is available.
fixCoverageId (integer) --
The producer's enum value behind fixCoverage.
locations (list) --
Every location this vulnerability was reported at.
(dict) --
A code location a finding points at.
filePath (string) --
Repository-relative path.
startLine (integer) --
1-indexed first line of the affected range.
endLine (integer) --
1-indexed last line, when the producer reported a range.
remediation (string) --
Free-form prose about a finding (summary, detailed analysis, rationale, remediation guidance). Capped well below the finding document's own 256 KB limit, since several of these can appear on one finding.
remediationReferences (list) --
A free-form list of strings carried verbatim from a producer.
(string) --
One entry in a free-form list carried verbatim from a producer (relevant inputs, reproduction steps, mitigating controls, preconditions, references).
code (string) --
The vulnerable fragment, when the producer supplied one.
details (string) --
The producer's extended analysis for this vulnerability.
affectedPackages (list) --
Software packages implicated by a finding.
(dict) --
A software package implicated by a finding.
name (string) --
The package name.
version (string) --
The affected version.
fixedInVersion (string) --
The earliest version that resolves the issue, when one is known.
packageManager (string) --
The ecosystem supplying the package.
resources (list) --
Resources the document named (resources[]).
(dict) --
A cloud or application resource a finding concerns.
uid (string) --
A resource identifier -- a cloud ARN, a context-graph node id, or whatever identifier scheme the producer uses.
name (string) --
A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.
type (string) --
A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.
region (string) --
A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.
posture (dict) --
The compliance posture, for an Application Security Posture Finding. Absent for a vulnerability finding.
application (string) --
The application the posture was assessed against.
applicationUid (string) --
A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.
applicationVersion (string) --
A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.
control (string) --
The control assessed, and the producer's description of it.
description (string) --
Free-form prose about a finding (summary, detailed analysis, rationale, remediation guidance). Capped well below the finding document's own 256 KB limit, since several of these can appear on one finding.
standards (list) --
Standards and requirements the control maps to.
(string) --
One entry in a free-form list carried verbatim from a producer (relevant inputs, reproduction steps, mitigating controls, preconditions, references).
requirements (list) --
A free-form list of strings carried verbatim from a producer.
(string) --
One entry in a free-form list carried verbatim from a producer (relevant inputs, reproduction steps, mitigating controls, preconditions, references).
checks (list) --
The individual checks performed.
(dict) --
One compliance check behind a posture finding.
uid (string) --
A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.
name (string) --
A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.
description (string) --
Free-form prose about a finding (summary, detailed analysis, rationale, remediation guidance). Capped well below the finding document's own 256 KB limit, since several of these can appear on one finding.
status (string) --
The producer's compliance status, and the enum value behind it.
statusId (integer) --
The producer's numeric enum value for status.
remediation (string) --
Free-form prose about a finding (summary, detailed analysis, rationale, remediation guidance). Capped well below the finding document's own 256 KB limit, since several of these can appear on one finding.
remediationReferences (list) --
A free-form list of strings carried verbatim from a producer.
(string) --
One entry in a free-form list carried verbatim from a producer (relevant inputs, reproduction steps, mitigating controls, preconditions, references).
findingId (string) --
The unique identifier of the finding.
findingArn (string) --
The ARN of the finding.
environmentId (string) --
The environment that owns the finding.
source (string) --
The system that produced the finding.
sourceFindingId (string) --
The producer's own identifier for the finding.
reportedAt (datetime) --
When the producer reported the finding -- its own clock, which is not Continuum's ingestion time. createdAt is when Continuum accepted it; these are genuinely different instants and a reader usually wants this one.
For CreateCodeFinding, this is the submitted OCSF document's own top-level time. For findings Continuum's scanner produces, it is the finding's own creation time.
Continuum does not validate it for plausibility: a producer's value is echoed as given, so a timestamp here asserts the unit and format, not that the instant is genuine.
status (string) --
The current lifecycle status of the finding.
statusUpdatedAt (datetime) --
The timestamp when the status last transitioned.
createdAt (datetime) --
The timestamp when the finding was ingested.
scanRunId (string) --
The scan that produced the finding, when it came from one. For a finding Continuum's scanner produced, this is the Continuum scan run (see GetCodeScan). For a finding submitted with CreateCodeFinding, it is the OCSF document's metadata.correlation_uid, when that value is a valid ScanRunId. Absent when the finding did not come from a scan.
statusMessage (string) --
Human-readable context about the current status.
discardReason (string) --
Why the finding was not escalated. Present only when status is DISCARDED.
discardReasoning (string) --
Customer-facing explanation accompanying discardReason.
duplicateOfIssueId (string) --
The existing issue this finding duplicates. Present only for the DUPLICATE_OF_* discard reasons.
createdIssueId (string) --
The issue Continuum created from this finding.
completedAt (datetime) --
When processing finished, whether by creating an issue or discarding. Absent while the finding is still in flight.
Retrieves the resource policy attached to a Continuum resource.
See also: AWS API Documentation
Request Syntax
client.get_resource_policy(
arn='string'
)
string
[REQUIRED]
The ARN of a resource in the caller's account.
dict
Response Syntax
{
'arn': 'string',
'policy': 'string',
'revisionId': 'string'
}
Response Structure
(dict) --
Contains the resource policy.
arn (string) --
The ARN of a Continuum resource that supports a resource policy. Collectors are the only supported resource type; other well-formed Continuum ARNs are rejected with ValidationException.
policy (string) --
A resource policy in displayable JSON form.
revisionId (string) --
Opaque optimistic-concurrency token for a resource policy.
Creates or replaces the resource policy attached to a Continuum resource.
See also: AWS API Documentation
Request Syntax
client.put_resource_policy(
arn='string',
policy='string',
expectedRevisionId='string'
)
string
[REQUIRED]
The ARN of a resource in the caller's account.
string
Omit or supply an empty Statement array to clear resource-policy grants and store the canonical empty-statement policy. Cross-account access is denied; same-account access remains subject to identity policies. Use an explicit Deny statement to deny same-account principals too.
string
Optional optimistic-concurrency token for the currently observed policy.
dict
Response Syntax
{
'arn': 'string',
'policy': 'string',
'revisionId': 'string'
}
Response Structure
(dict) --
Contains the stored resource policy.
arn (string) --
The ARN of a Continuum resource that supports a resource policy. Collectors are the only supported resource type; other well-formed Continuum ARNs are rejected with ValidationException.
policy (string) --
A resource policy in displayable JSON form.
revisionId (string) --
Opaque optimistic-concurrency token for a resource policy.
Lists the integrations in your account in descending integrationId order.
See also: AWS API Documentation
Request Syntax
client.list_integrations(
maxResults=123,
nextToken='string'
)
integer
The maximum number of results to return in a single call.
string
A pagination token returned by a previous call. Set to null for the first request; use the returned token for subsequent calls.
dict
Response Syntax
{
'items': [
{
'integrationId': 'string',
'integrationArn': 'string',
'name': 'string',
'integrationType': 'GITHUB'|'GITLAB'|'S3',
'providerDetails': {
'github': {
'organizationName': 'string'
},
'gitlab': {
'instanceUrl': 'string',
'targetType': 'GROUP'|'PROJECT',
'targetPath': 'string',
'tokenRotation': 'AUTOMATIC'|'NONE',
'expiresAt': datetime(2015, 1, 1)
},
's3': {
'bucket': 'string',
'roleArn': 'string'
}
},
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
Contains the list of integration summaries and an optional pagination token.
items (list) --
The integrations in the account, ordered by integrationId descending.
(dict) --
A summary of an integration returned in list responses.
integrationId (string) --
The unique identifier of the integration.
integrationArn (string) --
The ARN of the integration.
name (string) --
The name of the integration.
integrationType (string) --
The immutable provider type for the integration.
providerDetails (dict) --
Provider-specific details for the integration.
github (dict) --
Details for a GitHub.com integration.
organizationName (string) --
The name of the GitHub organization associated with the integration.
gitlab (dict) --
Details for a GitLab integration.
instanceUrl (string) --
The HTTPS base URL of the GitLab instance.
targetType (string) --
Whether the integration targets a group or a single project.
targetPath (string) --
The group or project path the integration targets.
tokenRotation (string) --
How the integration's access token is rotated. AUTOMATIC only when the pasted token had the self-rotate scope and rotation was opted in at installation time.
expiresAt (datetime) --
The expiry of the stored access token, for non-rotating tokens only. A rotated token's original expiry is stale, so this is omitted when tokenRotation is AUTOMATIC.
s3 (dict) --
Public details for a customer-managed S3 integration.
bucket (string) --
Customer-managed S3 bucket name.
roleArn (string) --
IAM role assumed by Continuum to read a customer-managed S3 integration.
createdAt (datetime) --
The timestamp when the integration was created.
updatedAt (datetime) --
The timestamp when the integration was last updated.
nextToken (string) --
A pagination token to retrieve the next page of results. Absent when there are no more results.
Deletes the Collector for the caller's account. The Collector first enters PENDING_DELETION, then the service removes its schedule, AWS Config service-linked recorder, versioned S3 bucket, KMS key, and persisted record.
See also: AWS API Documentation
Request Syntax
client.delete_collector(
collectorId='string'
)
string
[REQUIRED]
The unique identifier of the Collector to delete.
None