Snyk

Developer security platform. Read your Organizations, projects, targets and security issues, check any package version for known vulnerabilities, and tag and classify projects.

Actions

Action	What it does
Check a package for vulnerabilities	List the known direct vulnerabilities of one package version.
Delete a project	Permanently delete a Snyk project and its test history.
Get a project	Get a Snyk project: its name, file, target, attributes, tags and settings, and optionally its latest issue counts.
Get a target	Get a Snyk target's name, address, privacy and source.
Get an issue	Get a Snyk issue: its title, severity, status, the vulnerabilities or rules behind it, where it occurs and how it can be fixed.
Get an Organization	Get a Snyk Organization's name, slug and Group.
Get the connected identity	Get who this connection acts as.
List issues	List the issues Snyk found in an Organization, or in one project, filtered by type, severity, status and date.
List Organizations	List the Snyk Organizations this connection may act in: the ones picked when signing in with Snyk.
List projects	List the projects in an Organization - each manifest, image or code base Snyk tests - with optional filters.
List targets	List an Organization's targets: the repositories, images and other sources its projects come from.
Update a project	Set a project's business criticality, environment, lifecycle, tags or test frequency.

Check a package for vulnerabilities

List the known direct vulnerabilities of one package version. Give the ecosystem, name and version, or a full package URL (purl).

Inputs

Organizationorg_idtextRequired: The Snyk Organization to act in: one of those you picked when you signed in with Snyk.
Ecosystemecosystemtext: The package's ecosystem. Not needed with a purl.One of: apk (apk (Alpine)), cargo (Cargo (Rust)), cocoapods, composer (Composer (PHP)), conan (Conan (C/C++)), deb (deb (Debian)), gem (RubyGems), generic, golang (Go), hex (Hex (Elixir)), and 7 more.
Package namepackage_nametext: The package name, with its namespace where it has one: lodash, @angular/core, org.apache.logging.log4j/log4j-core.
Versionpackage_versiontext: The exact version, for example 4.17.20.
Package URL (purl)purltext: Optional. Instead of the three fields above, a purl such as pkg:npm/lodash@4.17.20.
Page sizelimitnumber: Optional. How many to return, 1 to 1000.From 1 to 1000.
Offsetoffsetnumber: Optional. How many to skip, for the next page.At least 0.

Outputs

countnumber: How many were returned.
has_moretrue/false: Whether a full page came back, so more may follow.
itemslist: The package's direct vulnerabilities.
matchobject: Snyk's description of the match.
match_typetext: none, partial or full: how well Snyk matched the package.
packageobject: The package Snyk matched.
purltext: The package URL that was looked up.

Example output

{
  "count": 1,
  "has_more": false,
  "items": [
    {
      "effective_severity_level": "high",
      "id": "SNYK-JS-LODASH-1040724",
      "title": "Command Injection",
      "type": "issue"
    }
  ],
  "match_type": "full",
  "purl": "pkg:npm/lodash@4.17.20"
}

Delete a project

Permanently delete a Snyk project and its test history.

Inputs

Organizationorg_idtextRequired: The Snyk Organization to act in: one of those you picked when you signed in with Snyk.
Project IDproject_idtextRequired: The project's id, from 'List projects', or its address in Snyk (app.snyk.io/org/.../project/<id>).

Outputs

Confirmation of a deletion.

deletedtrue/false: Always true.
idtext: The id of the deleted record.

Example output

{
  "deleted": true,
  "id": "c8f2d9a4-3b6e-4f1a-8d2c-7e9b0a1c2d3e"
}

Get a project

Get a Snyk project: its name, file, target, attributes, tags and settings, and optionally its latest issue counts.

Inputs

Organizationorg_idtextRequired: The Snyk Organization to act in: one of those you picked when you signed in with Snyk.
Project IDproject_idtextRequired: The project's id, from 'List projects', or its address in Snyk (app.snyk.io/org/.../project/<id>).
Include issue countsinclude_issue_countstrue/false: Optional. Also return the latest issue counts by severity.Default: false.

Outputs

A Snyk project: one manifest, image or code base Snyk tests.

business_criticalitylist: critical, high, medium and/or low.
createdtext: When the project was created (ISO 8601).
environmentlist: frontend, backend, internal, external, and so on.
idtext: The record's Snyk id (a UUID).
lifecyclelist: production, development and/or sandbox.
metaobject: Monitoring times and, when asked for, the latest issue counts.
nametext: The project's name.
org_idtext: The id of the Organization it belongs to.
origintext: Where the project came from, for example github or cli.
project_typetext: The package manager or scanner, for example npm, maven or sast.
read_onlytrue/false: Whether the project is read-only.
relationshipsobject: Snyk's raw relationships block, as sent.
settingsobject: Recurring-test and pull-request settings.
statustext: active or inactive.
tagslist: The project's tags.
target_display_nametext: The target's display name.
target_filetext: The manifest or file the project tests.
target_idtext: The id of the target (repository, image, ...) it belongs to.
target_referencetext: The branch or tag tested, if any.
target_runtimetext: The runtime of the tested code, if known.
target_urltext: The target's address, if it has one.
typetext: The JSON:API record type.

Example output

{
  "business_criticality": [
    "high"
  ],
  "created": "2026-02-01T12:00:00Z",
  "environment": [
    "backend"
  ],
  "id": "c8f2d9a4-3b6e-4f1a-8d2c-7e9b0a1c2d3e",
  "lifecycle": [
    "production"
  ],
  "name": "lodol/demo-app:package.json",
  "org_id": "5b1f1b1e-7c1a-4d7e-9b1a-0c7e2e3f4a5b",
  "origin": "cli",
  "project_type": "npm",
  "read_only": false,
  "status": "active",
  "tags": [
    {
      "key": "team",
      "value": "platform"
    }
  ],
  "target_display_name": "lodol/demo-app",
  "target_file": "package.json",
  "target_id": "9e8d7c6b-5a4f-4e3d-2c1b-0a9f8e7d6c5b",
  "target_reference": "main",
  "type": "project"
}

Get a target

Get a Snyk target's name, address, privacy and source.

Inputs

Organizationorg_idtextRequired: The Snyk Organization to act in: one of those you picked when you signed in with Snyk.
Target IDtarget_idtextRequired: The target's id, from 'List targets' or a project's target_id.

Outputs

A Snyk target: a repository, image or other source holding projects.

created_attext: When it was created (ISO 8601).
display_nametext: The target's display name.
idtext: The record's Snyk id (a UUID).
integration_typetext: The integration it came through, for example github.
is_privatetrue/false: Whether the target is private.
org_idtext: The id of the Organization it belongs to.
relationshipsobject: Snyk's raw relationships block, as sent.
typetext: The JSON:API record type.
urltext: The target's remote address, if it has one.

Example output

{
  "display_name": "lodol/demo-app",
  "id": "9e8d7c6b-5a4f-4e3d-2c1b-0a9f8e7d6c5b",
  "integration_type": "cli",
  "is_private": false,
  "org_id": "5b1f1b1e-7c1a-4d7e-9b1a-0c7e2e3f4a5b",
  "type": "target",
  "url": null
}

Get an issue

Get a Snyk issue: its title, severity, status, the vulnerabilities or rules behind it, where it occurs and how it can be fixed.

Inputs

Organizationorg_idtextRequired: The Snyk Organization to act in: one of those you picked when you signed in with Snyk.
Issue IDissue_idtextRequired: The issue's id, from 'List issues'.

Outputs

A Snyk issue.

coordinateslist: Where the issue occurs and how it can be fixed.
created_attext: When it was found (ISO 8601).
descriptiontext: The issue's description, if any.
effective_severity_leveltext: info, low, medium, high or critical.
idtext: The record's Snyk id (a UUID).
ignoredtrue/false: Whether the issue is ignored.
issue_typetext: package_vulnerability, license, cloud, code, custom, config or secrets (Snyk may add more).
keytext: Snyk's stable key for the issue.
org_idtext: The id of the Organization it belongs to.
problemslist: What the issue is.
project_idtext: The id of the project it was found in, if a project.
relationshipsobject: Snyk's raw relationships block, as sent.
resolutionobject: How the issue was resolved, once it is.
scan_item_idtext: The id of the project or environment it was found in.
scan_item_typetext: project or environment.
severitieslist: Severity ratings.
statustext: open or resolved.
titletext: The issue's title.
tooltext: The Snyk product that found it.
typetext: The JSON:API record type.
updated_attext: When it last changed (ISO 8601).

Example output

{
  "created_at": "2026-02-01T12:05:00Z",
  "effective_severity_level": "high",
  "id": "7d6c5b4a-3f2e-4d1c-9b8a-7f6e5d4c3b2a",
  "ignored": false,
  "issue_type": "package_vulnerability",
  "key": "SNYK-JS-LODASH-1040724",
  "org_id": "5b1f1b1e-7c1a-4d7e-9b1a-0c7e2e3f4a5b",
  "problems": [
    {
      "id": "SNYK-JS-LODASH-1040724",
      "source": "SNYK",
      "type": "vulnerability"
    }
  ],
  "project_id": "c8f2d9a4-3b6e-4f1a-8d2c-7e9b0a1c2d3e",
  "scan_item_id": "c8f2d9a4-3b6e-4f1a-8d2c-7e9b0a1c2d3e",
  "scan_item_type": "project",
  "status": "open",
  "title": "Command Injection",
  "type": "issue",
  "updated_at": "2026-02-01T12:05:00Z"
}

Get an Organization

Get a Snyk Organization's name, slug and Group.

Inputs

Organizationorg_idtextRequired: The Snyk Organization to act in: one of those you picked when you signed in with Snyk.

Outputs

A Snyk Organization.

access_requests_enabledtrue/false: Whether users may request access to it.
created_attext: When it was created (ISO 8601).
group_idtext: The id of the Group it belongs to, if any.
idtext: The record's Snyk id (a UUID).
is_personaltrue/false: Whether the Organization belongs to no Group.
nametext: The Organization's name.
relationshipsobject: Snyk's raw relationships block, as sent.
slugtext: The Organization's slug, as it appears in app.snyk.io addresses.
typetext: The JSON:API record type.
updated_attext: When it was last changed (ISO 8601).

Example output

{
  "created_at": "2026-01-10T09:00:00Z",
  "id": "5b1f1b1e-7c1a-4d7e-9b1a-0c7e2e3f4a5b",
  "is_personal": true,
  "name": "Lodol Demo",
  "slug": "lodol-demo",
  "type": "org"
}

Get the connected identity

Get who this connection acts as. For a Snyk App this is the app itself (type app_instance) rather than a person. Useful as a connection check.

Inputs

None.

Outputs

Who this connection acts as.

avatar_urltext: The avatar image address (users only).
default_org_contexttext: The id of the default Organization.
emailtext: The email address (users only).
idtext: The record's Snyk id (a UUID).
nametext: The display name.
typetext: user, service_account or app_instance (a Snyk App's own identity).
usernametext: The username (users only).

Example output

{
  "id": "5b1f1b1e-7c1a-4d7e-9b1a-0c7e2e3f4a5b",
  "name": "Lodol",
  "type": "app_instance"
}

List issues

List the issues Snyk found in an Organization, or in one project, filtered by type, severity, status and date.

Inputs

Organizationorg_idtextRequired: The Snyk Organization to act in: one of those you picked when you signed in with Snyk.
Project IDproject_idtext: Optional. Only issues found in this project.
Issue typeissue_typetext: Optional. Only issues of this type.One of: package_vulnerability (Package vulnerability), license, cloud, code (Code (SAST)), custom, config (Configuration (IaC)), secrets.
Severitiesseveritieslist: Optional. Only issues of these severities.One or more of: info, low, medium, high, critical.
Statusesstatuseslist: Optional. Open, resolved, or both.One or more of: open, resolved.
Ignoredignoredtext: Optional. Only ignored, or only not-ignored, issues.One of: yes, no.
Found aftercreated_afterdate and time: Optional. Only issues found after this time.
Updated afterupdated_afterdate and time: Optional. Only issues changed after this time.
Page sizelimitnumber: Optional. How many to return per page, 1 to 100. Snyk's default is 10.From 1 to 100.
Page cursorstarting_aftertext: Optional. The next_cursor of the previous page, to fetch the next one.

Outputs

countnumber: How many issues are on this page.
has_moretrue/false: Whether another page is available.
itemslist: The issues.
next_cursortext: Pass as 'Page cursor' to fetch the next page; empty on the last.
totalnumber: The total count, when Snyk reports one.

Example output

{
  "count": 1,
  "has_more": false,
  "items": [
    {
      "created_at": "2026-02-01T12:05:00Z",
      "effective_severity_level": "high",
      "id": "7d6c5b4a-3f2e-4d1c-9b8a-7f6e5d4c3b2a",
      "ignored": false,
      "issue_type": "package_vulnerability",
      "key": "SNYK-JS-LODASH-1040724",
      "org_id": "5b1f1b1e-7c1a-4d7e-9b1a-0c7e2e3f4a5b",
      "problems": [
        {
          "id": "SNYK-JS-LODASH-1040724",
          "source": "SNYK",
          "type": "vulnerability"
        }
      ],
      "project_id": "c8f2d9a4-3b6e-4f1a-8d2c-7e9b0a1c2d3e",
      "scan_item_id": "c8f2d9a4-3b6e-4f1a-8d2c-7e9b0a1c2d3e",
      "scan_item_type": "project",
      "status": "open",
      "title": "Command Injection",
      "type": "issue",
      "updated_at": "2026-02-01T12:05:00Z"
    }
  ],
  "next_cursor": null
}

List Organizations

List the Snyk Organizations this connection may act in: the ones picked when signing in with Snyk.

Inputs

Name containsnametext: Optional. Only Organizations whose name contains this.
Slugslugtext: Optional. Only the Organization with exactly this slug.
Page sizelimitnumber: Optional. How many to return per page, 1 to 100. Snyk's default is 10.From 1 to 100.
Page cursorstarting_aftertext: Optional. The next_cursor of the previous page, to fetch the next one.

Outputs

countnumber: How many Organizations are on this page.
has_moretrue/false: Whether another page is available.
itemslist: The Organizations.
next_cursortext: Pass as 'Page cursor' to fetch the next page; empty on the last.
totalnumber: The total count, when Snyk reports one.

Example output

{
  "count": 1,
  "has_more": false,
  "items": [
    {
      "created_at": "2026-01-10T09:00:00Z",
      "id": "5b1f1b1e-7c1a-4d7e-9b1a-0c7e2e3f4a5b",
      "is_personal": true,
      "name": "Lodol Demo",
      "slug": "lodol-demo",
      "type": "org"
    }
  ],
  "next_cursor": null
}

List projects

List the projects in an Organization - each manifest, image or code base Snyk tests - with optional filters.

Inputs

Organizationorg_idtextRequired: The Snyk Organization to act in: one of those you picked when you signed in with Snyk.
Target IDtarget_idtext: Optional. Only projects of this target.
Name starts withname_starts_withtext: Optional. Only projects whose name starts with this.
Project typesproject_typestext: Optional. Comma-separated project types, for example npm, maven, pip or sast.
Originsoriginstext: Optional. Comma-separated origins, for example github or cli.
Tagstagslist: Optional. Only projects with these tags, each written key:value, for example team:platform.
Business criticalitybusiness_criticalitylist: Optional. Choose one or more.One or more of: critical, high, medium, low.
Environmentenvironmentlist: Optional. Choose one or more.One or more of: frontend, backend, internal, external, mobile, saas, onprem (On-premises), hosted, distributed.
Lifecyclelifecyclelist: Optional. Choose one or more.One or more of: production, development, sandbox.
Include issue countsinclude_issue_countstrue/false: Optional. Also return the latest issue counts by severity.Default: false.
Page sizelimitnumber: Optional. How many to return per page, 1 to 100. Snyk's default is 10.From 1 to 100.
Page cursorstarting_aftertext: Optional. The next_cursor of the previous page, to fetch the next one.

Outputs

countnumber: How many projects are on this page.
has_moretrue/false: Whether another page is available.
itemslist: The projects.
next_cursortext: Pass as 'Page cursor' to fetch the next page; empty on the last.
totalnumber: The total count, when Snyk reports one.

Example output

{
  "count": 1,
  "has_more": false,
  "items": [
    {
      "business_criticality": [
        "high"
      ],
      "created": "2026-02-01T12:00:00Z",
      "environment": [
        "backend"
      ],
      "id": "c8f2d9a4-3b6e-4f1a-8d2c-7e9b0a1c2d3e",
      "lifecycle": [
        "production"
      ],
      "name": "lodol/demo-app:package.json",
      "org_id": "5b1f1b1e-7c1a-4d7e-9b1a-0c7e2e3f4a5b",
      "origin": "cli",
      "project_type": "npm",
      "read_only": false,
      "status": "active",
      "tags": [
        {
          "key": "team",
          "value": "platform"
        }
      ],
      "target_display_name": "lodol/demo-app",
      "target_file": "package.json",
      "target_id": "9e8d7c6b-5a4f-4e3d-2c1b-0a9f8e7d6c5b",
      "target_reference": "main",
      "type": "project"
    }
  ],
  "next_cursor": null
}

List targets

List an Organization's targets: the repositories, images and other sources its projects come from.

Inputs

Organizationorg_idtextRequired: The Snyk Organization to act in: one of those you picked when you signed in with Snyk.
Name starts withdisplay_nametext: Optional. Only targets whose name starts with this.
Remote URLurltext: Optional. Only the target with this remote address.
Sourcessource_typeslist: Optional. Only targets from these sources.One or more of: bitbucket-server, gitlab, github-enterprise, bitbucket-cloud, bitbucket-connect-app, azure-repos, github, github-cloud-app, github-server-app, cli, and 23 more.
Privateis_privatetext: Optional. Only private, or only public, targets.One of: yes, no.
Include targets without projectsinclude_emptytrue/false: Optional. Snyk leaves them out unless this is on.Default: false.
Created on or aftercreated_afterdate and time: Optional. Only targets created at or after this time.
Page sizelimitnumber: Optional. How many to return per page, 1 to 100. Snyk's default is 10.From 1 to 100.
Page cursorstarting_aftertext: Optional. The next_cursor of the previous page, to fetch the next one.

Outputs

countnumber: How many targets are on this page.
has_moretrue/false: Whether another page is available.
itemslist: The targets.
next_cursortext: Pass as 'Page cursor' to fetch the next page; empty on the last.
totalnumber: The total count, when Snyk reports one.

Example output

{
  "count": 1,
  "has_more": false,
  "items": [
    {
      "display_name": "lodol/demo-app",
      "id": "9e8d7c6b-5a4f-4e3d-2c1b-0a9f8e7d6c5b",
      "integration_type": "cli",
      "is_private": false,
      "org_id": "5b1f1b1e-7c1a-4d7e-9b1a-0c7e2e3f4a5b",
      "type": "target",
      "url": null
    }
  ],
  "next_cursor": null
}

Update a project

Set a project's business criticality, environment, lifecycle, tags or test frequency. Only what you fill in changes; a list you fill in replaces the project's current list.

Inputs

Organizationorg_idtextRequired: The Snyk Organization to act in: one of those you picked when you signed in with Snyk.
Project IDproject_idtextRequired: The project's id, from 'List projects', or its address in Snyk (app.snyk.io/org/.../project/<id>).
Business criticalitybusiness_criticalitylist: Optional. Choose one or more.One or more of: critical, high, medium, low.
Environmentenvironmentlist: Optional. Choose one or more.One or more of: frontend, backend, internal, external, mobile, saas, onprem (On-premises), hosted, distributed.
Lifecyclelifecyclelist: Optional. Choose one or more.One or more of: production, development, sandbox.
Tagstagslist: Optional. The project's tags, each written key:value, for example team:platform. Replaces its current tags.
Test frequencytest_frequencytext: Optional. How often Snyk re-tests the project. Also controls when automated fix PRs may be opened.One of: daily, weekly, never.

Outputs

A Snyk project: one manifest, image or code base Snyk tests.

business_criticalitylist: critical, high, medium and/or low.
createdtext: When the project was created (ISO 8601).
environmentlist: frontend, backend, internal, external, and so on.
idtext: The record's Snyk id (a UUID).
lifecyclelist: production, development and/or sandbox.
metaobject: Monitoring times and, when asked for, the latest issue counts.
nametext: The project's name.
org_idtext: The id of the Organization it belongs to.
origintext: Where the project came from, for example github or cli.
project_typetext: The package manager or scanner, for example npm, maven or sast.
read_onlytrue/false: Whether the project is read-only.
relationshipsobject: Snyk's raw relationships block, as sent.
settingsobject: Recurring-test and pull-request settings.
statustext: active or inactive.
tagslist: The project's tags.
target_display_nametext: The target's display name.
target_filetext: The manifest or file the project tests.
target_idtext: The id of the target (repository, image, ...) it belongs to.
target_referencetext: The branch or tag tested, if any.
target_runtimetext: The runtime of the tested code, if known.
target_urltext: The target's address, if it has one.
typetext: The JSON:API record type.

Example output

{
  "business_criticality": [
    "high"
  ],
  "created": "2026-02-01T12:00:00Z",
  "environment": [
    "backend"
  ],
  "id": "c8f2d9a4-3b6e-4f1a-8d2c-7e9b0a1c2d3e",
  "lifecycle": [
    "production"
  ],
  "name": "lodol/demo-app:package.json",
  "org_id": "5b1f1b1e-7c1a-4d7e-9b1a-0c7e2e3f4a5b",
  "origin": "cli",
  "project_type": "npm",
  "read_only": false,
  "status": "active",
  "tags": [
    {
      "key": "team",
      "value": "platform"
    }
  ],
  "target_display_name": "lodol/demo-app",
  "target_file": "package.json",
  "target_id": "9e8d7c6b-5a4f-4e3d-2c1b-0a9f8e7d6c5b",
  "target_reference": "main",
  "type": "project"
}

ActionsCopy Anchor Link

Check a package for vulnerabilitiesCopy Anchor Link

Inputs

Outputs

Delete a projectCopy Anchor Link

Inputs

Outputs

Get a projectCopy Anchor Link

Inputs

Outputs

Get a targetCopy Anchor Link

Inputs

Outputs

Get an issueCopy Anchor Link

Inputs

Outputs

Get an OrganizationCopy Anchor Link

Inputs

Outputs

Get the connected identityCopy Anchor Link

Inputs

Outputs

List issuesCopy Anchor Link

Inputs

Outputs

List OrganizationsCopy Anchor Link

Inputs

Outputs

List projectsCopy Anchor Link

Inputs

Outputs

List targetsCopy Anchor Link

Inputs

Outputs

Update a projectCopy Anchor Link

Inputs

Outputs

On this page

Actions

Check a package for vulnerabilities

Delete a project

Get a project

Get a target

Get an issue

Get an Organization

Get the connected identity

List issues

List Organizations

List projects

List targets

Update a project