SDK for PHP V3

Client: Aws\Continuum\ContinuumClient
Service ID: continuum
Version: 2022-07-26

This page describes the parameters and results for the operations of the AWS Continuum (2022-07-26), and shows how to use the Aws\Continuum\ContinuumClient object to call the described operations. This documentation is specific to the 2022-07-26 API version of the service.

Operation Summary

Each of the following operations can be created from a client using $client->getCommand('CommandName'), where "CommandName" is the name of one of the following operations. Note: a command is a value that encapsulates an operation and the parameters used to create an HTTP request.

You can also create and send a command immediately using the magic methods available on a client object: $client->commandName(/* parameters */). You can send the command asynchronously (returning a promise) by appending the word "Async" to the operation name: $client->commandNameAsync(/* parameters */).

AssociateCollector ( array $params = [] )
Associates one Collector with this Environment and configures the customer role Continuum uses to authorize access to associated Collector data.
CreateCodeFinding ( array $params = [] )
Ingests a customer-supplied security finding into an environment.
CreateCodeScan ( array $params = [] )
Creates an explicit scan request for one environment.
CreateCollector ( array $params = [] )
Creates the Collector for the caller's account.
CreateEnvironment ( array $params = [] )
Creates an environment and starts its validation and any requested provisioning.
CreateIntegration ( array $params = [] )
Creates a new integration with an external source provider.
DeleteCollector ( array $params = [] )
Deletes the Collector for the caller's account.
DeleteEnvironment ( array $params = [] )
Deletes an environment and its associated resources.
DeleteIntegration ( array $params = [] )
Deletes an integration and releases its name and account quota.
DisassociateCollector ( array $params = [] )
Removes one Collector association from this Environment, preserving its other associations.
GetCodeFinding ( array $params = [] )
Retrieves the current state and details of a finding.
GetCodeIssue ( array $params = [] )
Retrieves the current state and details of an issue.
GetCodeIssueArtifact ( array $params = [] )
Retrieves one immutable artifact attached to an issue, including its content.
GetCodeScan ( array $params = [] )
Retrieves one customer-visible environment scan.
GetCollector ( array $params = [] )
Retrieves the current state of the Collector for the caller's account.
GetCollectorDataAccessAuthorization ( array $params = [] )
Authorizes an Environment's access to a Collector's data.
GetEnvironment ( array $params = [] )
Retrieves the current state and configuration of an environment.
GetIntegration ( array $params = [] )
Retrieves information about an integration.
GetResourcePolicy ( array $params = [] )
Retrieves the resource policy attached to a Continuum resource.
ListAssociatedCollectors ( array $params = [] )
Lists the Collectors currently associated with one Environment in ascending collectorId order.
ListAssociatedEnvironments ( array $params = [] )
Lists the Environments currently associated with one Collector in lexicographically ascending environmentArn order.
ListCodeFindings ( array $params = [] )
Lists the findings in an environment in descending findingId order.
ListCodeIssueArtifacts ( array $params = [] )
Lists the artifacts attached to an issue in descending artifactId order.
ListCodeIssues ( array $params = [] )
Lists the issues in an environment in descending issueId order.
ListCodeScans ( array $params = [] )
Lists customer-visible scans for one environment in descending scanRunId order.
ListCollectors ( array $params = [] )
Lists the Collectors owned by the authenticated caller's account, including a Collector whose deletion is in progress.
ListEnvironments ( array $params = [] )
Lists all environments in your account in descending environmentId order.
ListIntegrations ( array $params = [] )
Lists the integrations in your account in descending integrationId order.
PutResourcePolicy ( array $params = [] )
Creates or replaces the resource policy attached to a Continuum resource.
StartIntegrationAuthorization ( array $params = [] )
Starts an OAuth authorization for a new integration and returns the values the caller sends to the provider's authorization endpoint.
UpdateCollector ( array $params = [] )
Updates the customer-controlled mutable properties of a Collector.
UpdateEnvironment ( array $params = [] )
Updates the customer-controlled mutable properties of an environment.
UpdateIntegration ( array $params = [] )
Rotates the credentials used by an Amazon S3 integration.

Paginators

Paginators handle automatically iterating over paginated API results. Paginators are associated with specific API operations, and they accept the parameters that the corresponding API operation accepts. You can get a paginator from a client class using getPaginator($paginatorName, $operationParameters). This client supports the following paginators:

ListAssociatedCollectors
ListAssociatedEnvironments
ListCodeFindings
ListCodeIssueArtifacts
ListCodeIssues
ListCodeScans
ListEnvironments
ListIntegrations

Waiters

Waiters allow you to poll a resource until it enters into a desired state. A waiter has a name used to describe what it does, and is associated with an API operation. When creating a waiter, you can provide the API operation parameters associated with the corresponding operation. Waiters can be accessed using the getWaiter($waiterName, $operationParameters) method of a client object. This client supports the following waiters:

Waiter name API Operation Delay Max Attempts
CodeScanSucceeded GetCodeScan 60 480

Operations

AssociateCollector

$result = $client->associateCollector([/* ... */]);
$promise = $client->associateCollectorAsync([/* ... */]);

Associates one Collector with this Environment and configures the customer role Continuum uses to authorize access to associated Collector data. The caller must have permission on the Environment and permission to pass the role. Continuum assumes the supplied role and calls GetCollectorDataAccessAuthorization on the requested Collector; only a successful authorization response permits the association. The caller does not need Collector data-access permission. The Environment retains its other Collector associations. Calling again with an existing association is safe and does not create a duplicate.

Parameter Syntax

$result = $client->associateCollector([
    'clientToken' => '<string>',
    'collectorArn' => '<string>', // REQUIRED
    'collectorDataAccessRoleArn' => '<string>', // REQUIRED
    'environmentId' => '<string>', // REQUIRED
]);

Parameter Details

Members
clientToken
Type: string

Caller-provided token that makes retried association requests idempotent. The first successful request binds the token to the complete Collector ARN, supplied role, and result for at least 24 hours. During that retry window, reusing it with a different request fails with ConflictException. A matching replay still requires the supplied role to have current Collector access. Once authorized, a matching replay returns the stored result without changing association state. Revocation can deny a replay; it does not remove the stored association or its original result.

collectorArn
Required: Yes
Type: string

The ARN of the Collector to associate with this Environment.

collectorDataAccessRoleArn
Required: Yes
Type: string

IAM role in the Environment account that Continuum assumes before authorizing access to associated Collector inventory. Every association, including a same-account association, requires this role. The supplied ARN replaces the Environment's previously stored role. The customer is responsible for granting the role access to every Collector that should contribute data.

environmentId
Required: Yes
Type: string

The unique identifier of the Environment making the association.

Result Syntax

[
    'associatedCollector' => [
        'collectorArn' => '<string>',
        'collectorId' => '<string>',
    ],
    'environmentArn' => '<string>',
    'environmentId' => '<string>',
]

Result Details

Members
associatedCollector
Required: Yes
Type: AssociatedCollector structure

The Collector identifier and ARN validated by this operation.

environmentArn
Required: Yes
Type: string

The ARN of the Environment making the association.

environmentId
Required: Yes
Type: string

The unique identifier of the Environment making the association.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

ConflictException:

The request could not be completed due to a conflict with the current state of the resource.

CreateCodeFinding

$result = $client->createCodeFinding([/* ... */]);
$promise = $client->createCodeFindingAsync([/* ... */]);

Ingests a customer-supplied security finding into an environment. Continuum validates the document synchronously against the required overlay fields for the declared format; invalid documents are rejected with a ValidationException. The maximum accepted document size is 256 KB. The environment must have a source configured, and the finding must identify a code location so Continuum can tie it to a repository in the environment's build. Continuum assigns a findingId and stores the verbatim document. When no successful build yet contains the finding's repository, the finding stays SUBMITTED until the next successful build; if that build does not contain it either, the finding is DISCARDED with discardReason SOURCE_REPO_NOT_FOUND.

Parameter Syntax

$result = $client->createCodeFinding([
    'clientToken' => '<string>',
    'environmentId' => '<string>', // REQUIRED
    'ocsfDocument' => [ // REQUIRED
    ],
]);

Parameter Details

Members
clientToken
Type: string

Caller-provided idempotency token. A retry with the same token and an identical finding document replays the original result; the same token with different content is rejected.

environmentId
Required: Yes
Type: string

The environment to ingest the finding into.

ocsfDocument
Required: Yes
Type: document (null|bool|string|numeric) or an (array|associative array) whose members are all valid documents

The OCSF finding document to ingest, verbatim. Must declare a class_uid Continuum supports (2002 Vulnerability Finding, or 2007 Application Security Posture Finding) and validate against the vendored OCSF JSON Schema for that class, including the Continuum overlay requirements that finding_info.uid be present and that vulnerabilities[0].affected_code[0].file identify the code location. With several repositories in the environment, the file path must begin with the repository name. Maximum size 256 KB. Stored verbatim and normalized into the typed Finding members returned by GetCodeFinding. GetCodeFinding does not return the document itself.

Result Syntax

[
    'createdAt' => <DateTime>,
    'findingArn' => '<string>',
    'findingId' => '<string>',
    'status' => 'SUBMITTED|VALIDATING|CONFIRMED|DISCARDED',
    'title' => '<string>',
]

Result Details

Members
createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the finding was ingested.

findingArn
Required: Yes
Type: string

The ARN of the ingested finding.

findingId
Required: Yes
Type: string

The unique identifier assigned to the finding.

status
Required: Yes
Type: string

The finding's current lifecycle status -- SUBMITTED for a newly ingested finding, or the finding's present status when an idempotent retry replays an already-processed finding.

title
Required: Yes
Type: string

The title extracted from the submitted document. Always populated at ingestion.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

ConflictException:

The request could not be completed due to a conflict with the current state of the resource.

CreateCodeScan

$result = $client->createCodeScan([/* ... */]);
$promise = $client->createCodeScanAsync([/* ... */]);

Creates an explicit scan request for one environment. CP creates durable work before any queue delivery occurs.

Retrying a request that succeeded, with the same clientToken on the same environment, returns the original scan instead of starting another one. Token handling is not yet atomic: requests with the same token that run at the same time, or a retry after a request that failed partway through, can leave an additional scan, which may end in the FAILED state with a message that it was superseded. Deleting the environment makes its tokens unusable; a later request with one of them returns ResourceNotFoundException.

Each environment can have a limited number of scans in progress at the same time. Once that limit is enforced, a request that would exceed it returns ServiceQuotaExceededException; wait for a scan to finish (ListCodeScans shows each scan's status), then retry.

Parameter Syntax

$result = $client->createCodeScan([
    'clientToken' => '<string>',
    'environmentId' => '<string>', // REQUIRED
]);

Parameter Details

Members
clientToken
Type: string

An optional token identifying one scan request for this environment. SDKs generate a token when omitted. If a request reaches the service without a token, the service generates one for that request, so each request without a token starts a new scan. To retry a request after a lost response, supply the same token on the same environment; once a request with that token has succeeded, a retry returns the original scan. Concurrent requests with the same token, or a retry after a request that failed partway through, can leave an additional scan, which may end FAILED as superseded. A token is bound to its scan for as long as the service retains the scan's build record, with no shorter expiry. Deleting the environment makes the binding inaccessible: a later request with the token returns ResourceNotFoundException.

environmentId
Required: Yes
Type: string

Environment to scan.

Result Syntax

[
    'scan' => [
        'completedAt' => <DateTime>,
        'createdAt' => <DateTime>,
        'failureMessage' => '<string>',
        'failureStage' => 'SUBMITTED|WAITING_FOR_BUILD|BUILDING|WAITING_FOR_SCAN|SCANNING',
        'origin' => 'MANUAL|SCHEDULED',
        'scanRunId' => '<string>',
        'status' => 'SUBMITTED|WAITING_FOR_BUILD|BUILDING|WAITING_FOR_SCAN|SCANNING|SUCCEEDED|FAILED',
    ],
]

Result Details

Members
scan
Required: Yes
Type: CodeScanSummary structure

The scan run this request created, or the scan run a previous request with the same clientToken already accepted.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

ConflictException:

The request could not be completed due to a conflict with the current state of the resource.

ServiceQuotaExceededException:

The request would exceed a service quota. Review your quota and request an increase if needed.

CreateCollector

$result = $client->createCollector([/* ... */]);
$promise = $client->createCollectorAsync([/* ... */]);

Creates the Collector for the caller's account. Provisions an AWS Config service-linked recorder using the caller's federated access session and begins recording infrastructure changes.

Parameter Syntax

$result = $client->createCollector([
    'clientToken' => '<string>',
    'kubernetesClusterRole' => [
        'externalId' => '<string>',
        'roleArn' => '<string>', // REQUIRED
    ],
    'type' => 'AWS_COLLECTOR',
]);

Parameter Details

Members
clientToken
Type: string

Caller-provided token that makes retried create requests return the original Collector rather than creating a duplicate.

kubernetesClusterRole

IAM role configuration used to collect Kubernetes cluster metadata. The authenticated caller must be allowed to pass its exact roleArn to Continuum.

type
Type: string

Source to collect. Defaults to AWS_COLLECTOR when omitted.

Result Syntax

[
    'collectorArn' => '<string>',
    'collectorId' => '<string>',
    'createdAt' => <DateTime>,
    'status' => 'ACTIVE|PENDING_DELETION',
    'type' => 'AWS_COLLECTOR',
]

Result Details

Members
collectorArn
Required: Yes
Type: string

The ARN of the created Collector.

collectorId
Required: Yes
Type: string

The unique identifier assigned to the Collector.

createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the Collector was created.

status
Required: Yes
Type: string

The current lifecycle status.

type
Required: Yes
Type: string

The source collected by this Collector.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

ConflictException:

The request could not be completed due to a conflict with the current state of the resource.

ServiceQuotaExceededException:

The request would exceed a service quota. Review your quota and request an increase if needed.

CreateEnvironment

$result = $client->createEnvironment([/* ... */]);
$promise = $client->createEnvironmentAsync([/* ... */]);

Creates an environment and starts its validation and any requested provisioning. Storage provisioning and dependency checks may continue after the initial 201 response; use GetEnvironment to observe completion.

Parameter Syntax

$result = $client->createEnvironment([
    'configuration' => [
        'codeConfiguration' => [
            'environmentConfiguration' => [
                'network' => [
                    'allowedDomains' => ['<string>', ...],
                ],
                'patchCreationPolicy' => 'ENABLED|DISABLED',
                'scanFrequency' => '<string>',
            ],
            'sourceConfiguration' => [
                'repositorySources' => [
                    [
                        'defaultBranch' => '<string>',
                        'integrationId' => '<string>', // REQUIRED
                        'repository' => '<string>', // REQUIRED
                    ],
                    // ...
                ],
                's3Sources' => [
                    [
                        'codePrefix' => '<string>',
                        'contextPrefix' => '<string>',
                        'integrationId' => '<string>', // REQUIRED
                    ],
                    // ...
                ],
            ],
        ],
    ],
    'name' => '<string>', // REQUIRED
]);

Parameter Details

Members
configuration

Type-specific configuration. Omission creates a code environment with the default operating policy and no sources.

name
Required: Yes
Type: string

The customer-visible name of the environment.

Result Syntax

[
    'createdAt' => <DateTime>,
    'environmentArn' => '<string>',
    'environmentId' => '<string>',
    'status' => 'ACTIVE',
]

Result Details

Members
createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the environment was created.

environmentArn
Required: Yes
Type: string

The ARN of the created environment.

environmentId
Required: Yes
Type: string

The unique identifier assigned to the environment.

status
Required: Yes
Type: string

The initial status of the environment. Always ACTIVE on successful creation.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

ConflictException:

The request could not be completed due to a conflict with the current state of the resource.

ServiceQuotaExceededException:

The request would exceed a service quota. Review your quota and request an increase if needed.

CreateIntegration

$result = $client->createIntegration([/* ... */]);
$promise = $client->createIntegrationAsync([/* ... */]);

Creates a new integration with an external source provider. Repeating an identical request with the same clientToken returns the original integrationId, integrationArn, and createdAt. Token records are retained for eight hours after success or terminal failure, including after the integration is deleted; replaying a deleted integration's token does not recreate it. An identical request with a retained terminal failure returns the recorded error.

Reusing a token with different parameters returns ValidationException. A fresh token starts a new create attempt; if the name is already owned by another integration, ConflictException includes that integration's identifier. An attempt still in progress may return ThrottlingException with retryAfterSeconds set to 1; retry with the same token and identical parameters.

GitHub authorization codes are single use. Retry an unresolved attempt with its original token and unchanged parameters first. If the service reports a terminal failure, an expired attempt, or a successful token exchange whose integration could not be saved, restart GitHub authorization with a fresh token and authorization code. The service does not checkpoint provider results for recovery by another request.

Parameter Syntax

$result = $client->createIntegration([
    'clientToken' => '<string>',
    'name' => '<string>', // REQUIRED
    'providerConfiguration' => [ // REQUIRED
        'github' => [
            'authorization' => [ // REQUIRED
                'authorizationCode' => '<string>', // REQUIRED
                'redirectUrl' => '<string>',
                'state' => '<string>', // REQUIRED
            ],
            'organizationName' => '<string>',
        ],
        'gitlab' => [
            'accessToken' => '<string>', // REQUIRED
            'instanceUrl' => '<string>', // REQUIRED
            'targetPath' => '<string>', // REQUIRED
            'targetType' => 'GROUP|PROJECT', // REQUIRED
        ],
        's3' => [
            'bucket' => '<string>', // REQUIRED
            'externalId' => '<string>', // REQUIRED
            'roleArn' => '<string>', // REQUIRED
        ],
    ],
]);

Parameter Details

Members
clientToken
Type: string

An optional token identifying one create attempt within the caller's account, Region, and operation. SDKs generate a token when omitted. If a request reaches the service without a token, the service generates one for that request. Each request without a token starts a new attempt. To replay an attempt, supply the same token and identical input. Authorized users and roles in the same account can retry an attempt this way. Token records are retained for eight hours after success or terminal failure, including after deletion of a successfully created integration. Different input with the same token returns ValidationException.

name
Required: Yes
Type: string

The name for the integration.

providerConfiguration
Required: Yes
Type: ProviderConfiguration structure

The provider-specific configuration required to create the integration. Only one member may be specified.

Result Syntax

[
    'createdAt' => <DateTime>,
    'integrationArn' => '<string>',
    'integrationId' => '<string>',
]

Result Details

Members
createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the integration was created.

integrationArn
Required: Yes
Type: string

The ARN of the created integration.

integrationId
Required: Yes
Type: string

The unique identifier of the created integration.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

ConflictException:

The request could not be completed due to a conflict with the current state of the resource.

ServiceQuotaExceededException:

The request would exceed a service quota. Review your quota and request an increase if needed.

DeleteCollector

$result = $client->deleteCollector([/* ... */]);
$promise = $client->deleteCollectorAsync([/* ... */]);

Deletes the Collector for the caller's account. The Collector first enters PENDING_DELETION, then the service removes its schedule, AWS Config service-linked recorder, versioned S3 bucket, KMS key, and persisted record.

Parameter Syntax

$result = $client->deleteCollector([
    'collectorId' => '<string>', // REQUIRED
]);

Parameter Details

Members
collectorId
Required: Yes
Type: string

The unique identifier of the Collector to delete.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

ConflictException:

The request could not be completed due to a conflict with the current state of the resource.

DeleteEnvironment

$result = $client->deleteEnvironment([/* ... */]);
$promise = $client->deleteEnvironmentAsync([/* ... */]);

Deletes an environment and its associated resources.

Parameter Syntax

$result = $client->deleteEnvironment([
    'environmentId' => '<string>', // REQUIRED
]);

Parameter Details

Members
environmentId
Required: Yes
Type: string

The unique identifier of the environment to delete.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

ConflictException:

The request could not be completed due to a conflict with the current state of the resource.

DeleteIntegration

$result = $client->deleteIntegration([/* ... */]);
$promise = $client->deleteIntegrationAsync([/* ... */]);

Deletes an integration and releases its name and account quota. Its retained CreateIntegration token receipt can still replay the original result without recreating the integration. Shared provider registrations are retained: deleting one integration does not remove provider access used by another integration. A fresh GitHub CreateIntegration attempt requires a fresh OAuth authorization code and a new clientToken.

Parameter Syntax

$result = $client->deleteIntegration([
    'integrationId' => '<string>', // REQUIRED
]);

Parameter Details

Members
integrationId
Required: Yes
Type: string

The unique identifier of the integration to delete.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

ConflictException:

The request could not be completed due to a conflict with the current state of the resource.

DisassociateCollector

$result = $client->disassociateCollector([/* ... */]);
$promise = $client->disassociateCollectorAsync([/* ... */]);

Removes one Collector association from this Environment, preserving its other associations. The stored Collector data-access role is cleared when no Collector associations remain. The Environment owner must have permission to disassociate. A current Collector access grant is not required, and the Collector does not need to remain active or present, so stale or revoked associations can be cleaned up.

Parameter Syntax

$result = $client->disassociateCollector([
    'collectorArn' => '<string>', // REQUIRED
    'environmentId' => '<string>', // REQUIRED
]);

Parameter Details

Members
collectorArn
Required: Yes
Type: string

The ARN of the Collector to disassociate from this Environment.

environmentId
Required: Yes
Type: string

The unique identifier of the Environment whose associations are updated.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

ConflictException:

The request could not be completed due to a conflict with the current state of the resource.

GetCodeFinding

$result = $client->getCodeFinding([/* ... */]);
$promise = $client->getCodeFindingAsync([/* ... */]);

Retrieves the current state and details of a finding.

Parameter Syntax

$result = $client->getCodeFinding([
    'environmentId' => '<string>', // REQUIRED
    'findingId' => '<string>', // REQUIRED
]);

Parameter Details

Members
environmentId
Required: Yes
Type: string

The environment that owns the finding.

findingId
Required: Yes
Type: string

The unique identifier of the finding to retrieve.

Result Syntax

[
    'affectedPackages' => [
        [
            'fixedInVersion' => '<string>',
            'name' => '<string>',
            'packageManager' => '<string>',
            'version' => '<string>',
        ],
        // ...
    ],
    'category' => '<string>',
    'completedAt' => <DateTime>,
    'createdAt' => <DateTime>,
    'createdIssueId' => '<string>',
    'cveId' => '<string>',
    'cvssBaseScore' => <float>,
    'cweIds' => ['<string>', ...],
    'detailedDescription' => '<string>',
    'discardReason' => 'SCANNER_VALIDATED_FALSE_POSITIVE|SCANNER_NEEDS_REVIEW|FALSE_POSITIVE_VALIDATED_AGAINST_CONTEXT|DUPLICATE_OF_OPEN_ISSUE|DUPLICATE_OF_CLOSED_ISSUE|COMPENSATING_CONTROL_PRESENT|OUT_OF_SCOPE|INSUFFICIENT_EVIDENCE|PROCESSING_FAILED|SOURCE_REPO_NOT_FOUND',
    'discardReasoning' => '<string>',
    'duplicateOfIssueId' => '<string>',
    'endLine' => <integer>,
    'environmentId' => '<string>',
    'filePath' => '<string>',
    'findingArn' => '<string>',
    'findingId' => '<string>',
    'findingTypes' => ['<string>', ...],
    'firstSeenAt' => <DateTime>,
    'lineNumber' => <integer>,
    'mitigation' => '<string>',
    'mitreTechniques' => ['<string>', ...],
    'ocsfClass' => 'VULNERABILITY_FINDING|APPLICATION_SECURITY_POSTURE_FINDING',
    'ocsfSchemaVersion' => '<string>',
    'owaspCategory' => '<string>',
    'posture' => [
        'application' => '<string>',
        'applicationUid' => '<string>',
        'applicationVersion' => '<string>',
        'checks' => [
            [
                'description' => '<string>',
                'name' => '<string>',
                'uid' => '<string>',
            ],
            // ...
        ],
        'control' => '<string>',
        'description' => '<string>',
        'remediation' => '<string>',
        'remediationReferences' => ['<string>', ...],
        'requirements' => ['<string>', ...],
        'standards' => ['<string>', ...],
        'status' => '<string>',
        'statusId' => <integer>,
    ],
    'productName' => '<string>',
    'productVendorName' => '<string>',
    'productVersion' => '<string>',
    'relevantInputs' => ['<string>', ...],
    'remediationReferences' => ['<string>', ...],
    'reportedAt' => <DateTime>,
    'resources' => [
        [
            'name' => '<string>',
            'region' => '<string>',
            'type' => '<string>',
            'uid' => '<string>',
        ],
        // ...
    ],
    'scanRunId' => '<string>',
    'severity' => 'UNKNOWN|INFORMATIONAL|LOW|MEDIUM|HIGH|CRITICAL|FATAL|OTHER',
    'source' => '<string>',
    'sourceFindingId' => '<string>',
    'sourceStatus' => '<string>',
    'sourceStatusId' => <integer>,
    'status' => 'SUBMITTED|VALIDATING|CONFIRMED|DISCARDED',
    'statusMessage' => '<string>',
    'statusUpdatedAt' => <DateTime>,
    'stepsToReproduce' => ['<string>', ...],
    'subCategory' => '<string>',
    'summary' => '<string>',
    'title' => '<string>',
    'type' => 'CONTINUUM_CODE_VULN|CUSTOMER_CODE_VULN',
    'validation' => [
        'blockingReason' => 'UNREACHABLE|PROTECTED|MISCLASSIFIED|EXCLUDED|NOT_FEASIBLE|RISK_MITIGATED|NONE',
        'confidence' => <float>,
        'evidence' => [
            [
                'file' => '<string>',
                'line' => <integer>,
                'snippet' => '<string>',
            ],
            // ...
        ],
        'mitigatingControls' => ['<string>', ...],
        'preconditions' => ['<string>', ...],
        'rationale' => '<string>',
        'severityAdjustment' => 'CRITICAL|HIGH|MEDIUM|LOW|INFORMATIONAL|UNCHANGED',
        'verdict' => 'TRUE_POSITIVE|FALSE_POSITIVE|BENIGN_TRUE_POSITIVE|NEEDS_REVIEW',
    ],
    'vulnerabilities' => [
        [
            'additionalCweIds' => ['<string>', ...],
            'affectedPackages' => [
                [
                    'fixedInVersion' => '<string>',
                    'name' => '<string>',
                    'packageManager' => '<string>',
                    'version' => '<string>',
                ],
                // ...
            ],
            'code' => '<string>',
            'cveId' => '<string>',
            'cvssBaseScore' => <float>,
            'cweCaption' => '<string>',
            'cweId' => '<string>',
            'description' => '<string>',
            'details' => '<string>',
            'fixCoverage' => '<string>',
            'fixCoverageId' => <integer>,
            'locations' => [
                [
                    'endLine' => <integer>,
                    'filePath' => '<string>',
                    'startLine' => <integer>,
                ],
                // ...
            ],
            'remediation' => '<string>',
            'remediationReferences' => ['<string>', ...],
            'title' => '<string>',
        ],
        // ...
    ],
    'vulnerableCode' => '<string>',
]

Result Details

Members
affectedPackages
Type: Array of AffectedPackage structures

Packages implicated by the finding.

category
Type: string

The producer's vulnerability category. Not a stable filter key across finding types -- see FindingCategory.

completedAt
Type: timestamp (string|DateTime or anything parsable by strtotime)

When processing finished, whether by creating an issue or discarding. Absent while the finding is still in flight.

createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the finding was ingested.

createdIssueId
Type: string

The issue Continuum created from this finding.

cveId
Type: string

The CVE this finding reports, for software-composition findings. Both code types can carry one: a customer document supplies it under vulnerabilities[].cve, and Continuum's scanner reports CVEs for dependency-manifest findings.

cvssBaseScore
Type: double

The CVSS base score accompanying cveId, when the producer supplies one, from 0.0 to 10.0. Not computed by Continuum. The range is enforced server-side, not by a @range trait -- the smithy-rs server SDK does not support range constraints on double shapes (smithy-rs#2007).

cweIds
Type: Array of strings

CWE identifiers classifying the finding.

detailedDescription
Type: string

The full analysis.

discardReason
Type: string

Why the finding was not escalated. Present only when status is DISCARDED.

discardReasoning
Type: string

Customer-facing explanation accompanying discardReason.

duplicateOfIssueId
Type: string

The existing issue this finding duplicates. Present only for the DUPLICATE_OF_* discard reasons.

endLine
Type: int

The last line of the affected range, from the document's affected_code[].end_line.

environmentId
Required: Yes
Type: string

The environment that owns the finding.

filePath
Type: string

The file the finding is about.

findingArn
Required: Yes
Type: string

The ARN of the finding.

findingId
Required: Yes
Type: string

The unique identifier of the finding.

findingTypes
Type: Array of strings

The producer's own classification of the finding (finding_info.types).

firstSeenAt
Type: timestamp (string|DateTime or anything parsable by strtotime)

When the producer first observed the finding (finding_info.first_seen_time). The producer's own clock, not Continuum's.

lineNumber
Type: int

The 1-indexed line the finding is about. Bounds are enforced server-side rather than by a constraint trait: a numeric constraint generates a distinct newtype per enclosing structure, so the same concept would not share a type across the create input and the read output.

mitigation
Type: string

How to fix the finding.

mitreTechniques
Type: Array of strings

MITRE ATT&CK technique identifiers, from the document's finding_info.attacks[].technique.uid.

ocsfClass
Type: string

The OCSF class the document declared. Determines whether posture is populated.

ocsfSchemaVersion
Type: string

The OCSF schema version the producer wrote against (metadata.version).

owaspCategory
Type: string

The OWASP Top 10 category, when the producer supplies one.

posture
Type: FindingPosture structure

The compliance posture, for an Application Security Posture Finding. Absent for a vulnerability finding.

productName
Type: string

The producing product and vendor (metadata.product).

productVendorName
Type: string

A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.

productVersion
Type: string

A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.

relevantInputs
Type: Array of strings

User-controlled inputs that reach the vulnerability.

remediationReferences
Type: Array of strings

Remediation references, from the document's vulnerabilities[].remediation.references.

reportedAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

When the producer reported the finding -- its own clock, which is not Continuum's ingestion time. createdAt is when Continuum accepted it; these are genuinely different instants and a reader usually wants this one.

For CreateCodeFinding, this is the submitted OCSF document's own top-level time. For findings Continuum's scanner produces, it is the finding's own creation time.

Continuum does not validate it for plausibility: a producer's value is echoed as given, so a timestamp here asserts the unit and format, not that the instant is genuine.

resources
Type: Array of FindingResource structures

Resources the document named (resources[]).

scanRunId
Type: string

The scan that produced the finding, when it came from one. For a finding Continuum's scanner produced, this is the Continuum scan run (see GetCodeScan). For a finding submitted with CreateCodeFinding, it is the OCSF document's metadata.correlation_uid, when that value is a valid ScanRunId. Absent when the finding did not come from a scan.

severity
Required: Yes
Type: string

The finding's severity.

source
Required: Yes
Type: string

The system that produced the finding.

sourceFindingId
Required: Yes
Type: string

The producer's own identifier for the finding.

sourceStatus
Type: string

The producer's own status for the finding, and the enum value behind it. Distinct from status, which is Continuum's lifecycle state -- a producer may call a finding "New" while Continuum has it SUBMITTED.

sourceStatusId
Type: int

The producer's numeric enum value for sourceStatus.

status
Required: Yes
Type: string

The current lifecycle status of the finding.

statusMessage
Type: string

Human-readable context about the current status.

statusUpdatedAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the status last transitioned.

stepsToReproduce
Type: Array of strings

Steps to reproduce or exploit the finding.

subCategory
Type: string

A more specific classification within category.

summary
Type: string

A one-paragraph description.

title
Required: Yes
Type: string

The producer's title for the finding.

type
Required: Yes
Type: string

What kind of finding this is. Determines which of the type-specific members below are populated.

validation
Type: FindingValidation structure

The validator's assessment. Absent when no validation ran.

vulnerabilities
Type: Array of FindingVulnerability structures

Every vulnerability the document reported. A document may report several; the flat cveId/cvssBaseScore/filePath/lineNumber members above carry the first one's identity so a caller that only needs "what and where" does not have to walk this list.

vulnerableCode
Type: string

The vulnerable code fragment.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

GetCodeIssue

$result = $client->getCodeIssue([/* ... */]);
$promise = $client->getCodeIssueAsync([/* ... */]);

Retrieves the current state and details of an issue.

Parameter Syntax

$result = $client->getCodeIssue([
    'environmentId' => '<string>', // REQUIRED
    'issueId' => '<string>', // REQUIRED
]);

Parameter Details

Members
environmentId
Required: Yes
Type: string

The environment that owns the issue.

issueId
Required: Yes
Type: string

The unique identifier of the issue to retrieve.

Result Syntax

[
    'confidence' => <integer>,
    'createdAt' => <DateTime>,
    'evidenceAvailability' => 'NONE|AVAILABLE',
    'findingIds' => ['<string>', ...],
    'issueArn' => '<string>',
    'issueId' => '<string>',
    'name' => '<string>',
    'patchDelivery' => [
        'failedCount' => <integer>,
        'failureReasons' => ['<string>', ...],
        'patchCount' => <integer>,
        'status' => 'PENDING|SUCCEEDED|FAILED|SKIPPED',
        'succeededCount' => <integer>,
    ],
    'phase' => 'VALIDATION|PRIORITIZATION|REMEDIATION',
    'severity' => 'LOW|MEDIUM|HIGH|CRITICAL',
    'severityReasoning' => '<string>',
    'status' => 'CREATED|IN_PROGRESS|COMPLETED|FAILED',
    'statusMessage' => '<string>',
    'statusReason' => 'INTERNAL_ERROR|REMEDIATION_FAILED',
    'statusUpdatedAt' => <DateTime>,
    'summary' => '<string>',
    'synopsis' => '<string>',
    'updatedAt' => <DateTime>,
]

Result Details

Members
confidence
Type: int

The likelihood that this issue is a true positive, expressed as a percentage (0-100).

createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the issue was created.

evidenceAvailability
Type: string

Whether the issue has any attached evidence (formerly 'artifacts': tool output, remediation proposals, patches). NONE = no evidence; AVAILABLE = at least one evidence item exists. Computed at read time.

findingIds
Required: Yes
Type: Array of strings

The findings that motivated this issue. Bare identifiers only -- a caller authorized for GetCodeIssue is not necessarily authorized to read finding detail; call GetCodeFinding for that. Every referenced finding is included regardless of origin (both CustomerUploaded and ContinuumScanner).

issueArn
Required: Yes
Type: string

The ARN of the issue.

issueId
Required: Yes
Type: string

The unique identifier of the issue.

name
Required: Yes
Type: string

The name of the issue.

patchDelivery
Type: IssuePatchDelivery structure

Customer delivery of the issue's patches, summarized from its PATCH artifacts at read time. Absent when no patch has a destination delivery.

phase
Type: string

The part of the workflow the issue is in. Present when status is IN_PROGRESS, and when status is FAILED and the failing phase is known.

severity
Type: string

Current severity: the FindingSeverity seed at create, overwritten by the authoritative severity that prioritization assigns after validation.

severityReasoning
Type: string

The justification for the current severity. Always leads with a customer-facing basis clause synthesized from how the severity was determined (e.g. "Severity from finding.", "Severity from Continuum system."); when prioritization has run, its own reasoning follows. Issues created before the basis clause was introduced return their original reasoning without it.

status
Required: Yes
Type: string

The current lifecycle status of the issue.

statusMessage
Type: string

Customer-facing explanation of statusReason. Present only when status is FAILED.

statusReason
Type: string

Why the issue failed. Present only when status is FAILED.

statusUpdatedAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the status or phase last changed.

summary
Type: string

The remediation completion summary, when the green stage has run.

synopsis
Required: Yes
Type: string

A free-form synopsis of the issue.

updatedAt
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when any field of the issue last changed. Advances on every mutation (including score-only updates that do not transition status), so it is greater than or equal to statusUpdatedAt.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

GetCodeIssueArtifact

$result = $client->getCodeIssueArtifact([/* ... */]);
$promise = $client->getCodeIssueArtifactAsync([/* ... */]);

Retrieves one immutable artifact attached to an issue, including its content.

Parameter Syntax

$result = $client->getCodeIssueArtifact([
    'artifactId' => '<string>', // REQUIRED
    'environmentId' => '<string>', // REQUIRED
    'issueId' => '<string>', // REQUIRED
]);

Parameter Details

Members
artifactId
Required: Yes
Type: string

The unique identifier of the artifact to retrieve.

environmentId
Required: Yes
Type: string

The environment that owns the issue.

issueId
Required: Yes
Type: string

The issue the artifact is attached to.

Result Syntax

[
    'artifactId' => '<string>',
    'artifactType' => 'EVIDENCE|AGENT_COMMUNICATION|VALIDATION_EVIDENCE|REMEDIATION_PROPOSAL|DECISION|PATCH',
    'body' => [
        'patch' => [
            'delivery' => [
                'status' => 'PENDING|SUCCEEDED|FAILED|SKIPPED|ABANDONED',
                'target' => [
                    'github' => [
                        'headSha' => '<string>',
                        'owner' => '<string>',
                        'pullRequestNumber' => <integer>,
                        'repository' => '<string>',
                    ],
                    's3' => [
                        'bucket' => '<string>',
                        'key' => '<string>',
                        'version' => '<string>',
                    ],
                ],
                'updatedAt' => <DateTime>,
            ],
            'format' => 'GIT_MAILBOX_PATCH|GIT_BINARY_DIFF|GIT_DIFF',
            'patch' => '<string>',
            'patchSha256' => '<string>',
            'repositoryName' => '<string>',
            'sizeBytes' => <integer>,
        ],
        'prevalidationSignals' => [
            'producedBy' => '<string>',
            'signals' => [
                [
                    'computed' => [
                        'barriers' => <integer>,
                        'impactBand' => 'VERY_LOW|LOW|MODERATE|HIGH',
                        'likelihoodBand' => 'VERY_LOW|LOW|MODERATE|HIGH',
                    ],
                    'conclusion' => '<string>',
                    'confidence' => <float>,
                    'confidenceReasoning' => [
                        'factors' => ['<string>', ...],
                        'summary' => '<string>',
                    ],
                    'dimension' => 'EXPLOITABILITY|BLAST_RADIUS|NETWORK_EXPOSURE|PRECONDITION|CODE_CONTEXT|LIKELIHOOD_ASSESSMENT|IMPACT_ASSESSMENT',
                    'exploitability' => [
                        'confidenceTier' => 'SOURCE_READ|STATIC_PROVEN|BUILD_PROVEN|RUNTIME_PROVEN',
                        'highestLayerReached' => <integer>,
                        'reachedCrownJewels' => true || false,
                        'scriptable' => true || false,
                        'sourceValidationArtifactId' => '<string>',
                        'verdict' => 'EXPLOITABLE|NOT_EXPLOITABLE|UNCERTAIN',
                    ],
                    'impactDimensions' => [
                        'attackerGains' => [
                            'basis' => 'CODE|GRAPH|FINDING|INFERRED|NO_EVIDENCE_DEFAULT',
                            'missingInfo' => '<string>',
                            'reason' => '<string>',
                            'value' => 'EXECUTE|MODIFY_PRIVILEGED|MODIFY_DATA|MODIFY_COSMETIC|READ|NEITHER',
                        ],
                        'blastRadius' => [
                            'basis' => 'CODE|GRAPH|FINDING|INFERRED|NO_EVIDENCE_DEFAULT',
                            'missingInfo' => '<string>',
                            'reason' => '<string>',
                            'value' => 'CROSS_TENANT|OTHER_USERS_IN_TENANT|OWN_SCOPE',
                        ],
                        'targetValue' => [
                            'basis' => 'CODE|GRAPH|FINDING|INFERRED|NO_EVIDENCE_DEFAULT',
                            'missingInfo' => '<string>',
                            'reason' => '<string>',
                            'value' => 'HIGH|MEDIUM|LOW',
                        ],
                    ],
                    'preconditions' => [
                        'accessLevel' => [
                            'basis' => 'CODE|GRAPH|FINDING|INFERRED|NO_EVIDENCE_DEFAULT',
                            'missingInfo' => '<string>',
                            'reason' => '<string>',
                            'value' => 'NONE|ANY_AUTHENTICATED|PRIVILEGED',
                        ],
                        'configurationNeeded' => [
                            'basis' => 'CODE|GRAPH|FINDING|INFERRED|NO_EVIDENCE_DEFAULT',
                            'missingInfo' => '<string>',
                            'reason' => '<string>',
                            'value' => true || false,
                        ],
                        'reachableFromAttacker' => [
                            'basis' => 'CODE|GRAPH|FINDING|INFERRED|NO_EVIDENCE_DEFAULT',
                            'missingInfo' => '<string>',
                            'reason' => '<string>',
                            'value' => true || false,
                        ],
                        'userInteractionRequired' => [
                            'basis' => 'CODE|GRAPH|FINDING|INFERRED|NO_EVIDENCE_DEFAULT',
                            'missingInfo' => '<string>',
                            'reason' => '<string>',
                            'value' => true || false,
                        ],
                    ],
                    'producerId' => '<string>',
                    'producerVersion' => '<string>',
                    'signalStrength' => 'NONE|WEAK|MODERATE|STRONG',
                    'subjectRef' => '<string>',
                ],
                // ...
            ],
        ],
        'raw' => '<string>',
        'remediationProposal' => [
            'filename' => '<string>',
            'format' => 'GIT_MAILBOX_PATCH|GIT_BINARY_DIFF|GIT_DIFF',
            'patch' => '<string>',
            'patchSha256' => '<string>',
        ],
        'validationEvidence' => [
            'attackFlowsConfirmed' => ['<string>', ...],
            'executedProof' => [
                'code' => [
                    'proofCode' => [
                        [
                            'content' => '<string>',
                        ],
                        // ...
                    ],
                ],
                'observedEffect' => 'DATA_LEAKED|ERROR_REVEALED|BEHAVIOR_CHANGED|NO_EFFECT',
                'output' => [
                    'consoleOutput' => '<string>',
                ],
            ],
            'exploitArtifact' => [
                'effect' => 'DATA_LEAKED|ERROR_REVEALED|BEHAVIOR_CHANGED|NO_EFFECT',
                'headers' => ['<string>', ...],
                'httpMethod' => 'GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS',
                'payload' => '<string>',
                'responseSnippet' => '<string>',
                'responseStatus' => <integer>,
                'targetUrl' => '<string>',
            ],
            'exploitable' => 'EXPLOITABLE|NOT_EXPLOITABLE|UNCERTAIN',
            'flowVerdicts' => [
                [
                    'confidence' => <float>,
                    'evidence' => ['<string>', ...],
                    'flowId' => '<string>',
                    'verdict' => 'CONFIRMED|DENIED|INCONCLUSIVE',
                ],
                // ...
            ],
            'perFindingResults' => [
                [
                    'confidence' => <float>,
                    'exploitArtifact' => [
                        'effect' => 'DATA_LEAKED|ERROR_REVEALED|BEHAVIOR_CHANGED|NO_EFFECT',
                        'headers' => ['<string>', ...],
                        'httpMethod' => 'GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS',
                        'payload' => '<string>',
                        'responseSnippet' => '<string>',
                        'responseStatus' => <integer>,
                        'targetUrl' => '<string>',
                    ],
                    'exploitable' => 'EXPLOITABLE|NOT_EXPLOITABLE|UNCERTAIN',
                    'findingId' => '<string>',
                    'flowVerdicts' => [
                        [
                            'confidence' => <float>,
                            'evidence' => ['<string>', ...],
                            'flowId' => '<string>',
                            'verdict' => 'CONFIRMED|DENIED|INCONCLUSIVE',
                        ],
                        // ...
                    ],
                    'reasoningChain' => [
                        [
                            'claim' => '<string>',
                            'confidence' => <float>,
                            'source' => '<string>',
                            'step' => <integer>,
                        ],
                        // ...
                    ],
                ],
                // ...
            ],
            'sourceAnalysis' => [
                'inferredEffect' => 'DATA_LEAKED|ERROR_REVEALED|BEHAVIOR_CHANGED|NO_EFFECT',
                'summary' => '<string>',
            ],
            'terminalStatus' => 'COMPLETED|FAILED|NO_SOURCE_AVAILABLE|PARTIAL',
        ],
    ],
    'createdAt' => <DateTime>,
    'mediaType' => '<string>',
    'metadata' => [
    ],
    'producer' => [
        'agent' => '<string>',
    ],
]

Result Details

Members
artifactId
Required: Yes
Type: string

The unique identifier of the artifact.

artifactType
Required: Yes
Type: string

Semantic category of the artifact.

body
Required: Yes
Type: IssueArtifactBody structure

The artifact body, projected against the shape defined for its artifactType. A type with a defined shape is returned as that structure, and anything else through IssueArtifactBody.raw.

createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the artifact was created.

mediaType
Required: Yes
Type: string

MIME type the producer declared for its content.

metadata
Type: document (null|bool|string|numeric) or an (array|associative array) whose members are all valid documents

Producer-defined structured metadata, when the producer supplied any.

Returned only for an artifactType whose content has no defined shape, so that the artifact stays inspectable. For an artifactType with a defined shape, body carries the content and this member is omitted.

producer
Required: Yes
Type: IssueArtifactProducerSummary structure

The agent that produced the artifact.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

GetCodeScan

$result = $client->getCodeScan([/* ... */]);
$promise = $client->getCodeScanAsync([/* ... */]);

Retrieves one customer-visible environment scan.

Parameter Syntax

$result = $client->getCodeScan([
    'environmentId' => '<string>', // REQUIRED
    'scanRunId' => '<string>', // REQUIRED
]);

Parameter Details

Members
environmentId
Required: Yes
Type: string

Environment that owns the scan.

scanRunId
Required: Yes
Type: string

Scan to retrieve.

Result Syntax

[
    'scan' => [
        'completedAt' => <DateTime>,
        'createdAt' => <DateTime>,
        'failureMessage' => '<string>',
        'failureStage' => 'SUBMITTED|WAITING_FOR_BUILD|BUILDING|WAITING_FOR_SCAN|SCANNING',
        'origin' => 'MANUAL|SCHEDULED',
        'scanRunId' => '<string>',
        'status' => 'SUBMITTED|WAITING_FOR_BUILD|BUILDING|WAITING_FOR_SCAN|SCANNING|SUCCEEDED|FAILED',
    ],
]

Result Details

Members
scan
Required: Yes
Type: CodeScanData structure

Complete customer-visible scan data.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

GetCollector

$result = $client->getCollector([/* ... */]);
$promise = $client->getCollectorAsync([/* ... */]);

Retrieves the current state of the Collector for the caller's account.

Parameter Syntax

$result = $client->getCollector([
    'collectorId' => '<string>', // REQUIRED
]);

Parameter Details

Members
collectorId
Required: Yes
Type: string

The unique identifier of the Collector to retrieve.

Result Syntax

[
    'collectorArn' => '<string>',
    'collectorId' => '<string>',
    'configRecorderArn' => '<string>',
    'createdAt' => <DateTime>,
    'kubernetesClusterRoleArn' => '<string>',
    'status' => 'ACTIVE|PENDING_DELETION',
    'type' => 'AWS_COLLECTOR',
    'updatedAt' => <DateTime>,
]

Result Details

Members
collectorArn
Required: Yes
Type: string

The ARN of the Collector.

collectorId
Required: Yes
Type: string

The unique identifier of the Collector.

configRecorderArn
Type: string

The ARN of the provisioned AWS Config Recorder.

createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the Collector was created.

kubernetesClusterRoleArn
Type: string

IAM role used to collect Kubernetes cluster metadata.

status
Required: Yes
Type: string

The current lifecycle status.

type
Required: Yes
Type: string

The source collected by this Collector.

updatedAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The time of the last successful UpdateCollector call, returned at whole-second precision in the same date-time format as createdAt.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

GetCollectorDataAccessAuthorization

$result = $client->getCollectorDataAccessAuthorization([/* ... */]);
$promise = $client->getCollectorDataAccessAuthorizationAsync([/* ... */]);

Authorizes an Environment's access to a Collector's data. Continuum calls this operation with the Environment's Collector data-access role before it reads the Collector's inventory, so grant continuum:GetCollectorDataAccessAuthorization to that role and, for a Collector in another account, in the Collector's resource policy. The operation evaluates the action against the exact Collector ARN and the Collector's current resource policy using IAM and the caller's authenticated request context, with environmentArn as the continuum:EnvironmentArn condition key. A successful request returns HTTP 200 with no response members. If access is not granted, the operation returns AccessDeniedException without disclosing Collector existence, ownership, or the policy layer that denied access. The service does not reinterpret the policy using only an account ID.

Parameter Syntax

$result = $client->getCollectorDataAccessAuthorization([
    'accountId' => '<string>', // REQUIRED
    'collectorId' => '<string>', // REQUIRED
    'environmentArn' => '<string>',
]);

Parameter Details

Members
accountId
Required: Yes
Type: string

The AWS account that owns the Collector.

collectorId
Required: Yes
Type: string

The unique identifier of the Collector.

environmentArn
Type: string

The full ARN of the Environment requesting the Collector's data. The Environment must be in the caller's account. Continuum supplies this value as the continuum:EnvironmentArn condition key.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

GetEnvironment

$result = $client->getEnvironment([/* ... */]);
$promise = $client->getEnvironmentAsync([/* ... */]);

Retrieves the current state and configuration of an environment.

Parameter Syntax

$result = $client->getEnvironment([
    'environmentId' => '<string>', // REQUIRED
]);

Parameter Details

Members
environmentId
Required: Yes
Type: string

The unique identifier of the environment to retrieve.

Result Syntax

[
    'configuration' => [
        'codeConfiguration' => [
            'collectorDetails' => [
                'collectorDataAccessRoleArn' => '<string>',
            ],
            'environmentConfiguration' => [
                'network' => [
                    'allowedDomains' => ['<string>', ...],
                ],
                'patchCreationPolicy' => 'ENABLED|DISABLED',
                'scanFrequency' => '<string>',
            ],
            'latestScan' => [
                'completedAt' => <DateTime>,
                'createdAt' => <DateTime>,
                'failureMessage' => '<string>',
                'failureStage' => 'SUBMITTED|WAITING_FOR_BUILD|BUILDING|WAITING_FOR_SCAN|SCANNING',
                'origin' => 'MANUAL|SCHEDULED',
                'scanRunId' => '<string>',
                'status' => 'SUBMITTED|WAITING_FOR_BUILD|BUILDING|WAITING_FOR_SCAN|SCANNING|SUCCEEDED|FAILED',
            ],
            'sourceConfiguration' => [
                'repositorySources' => [
                    [
                        'defaultBranch' => '<string>',
                        'integrationId' => '<string>',
                        'repository' => '<string>',
                    ],
                    // ...
                ],
                's3Sources' => [
                    [
                        'codePrefix' => '<string>',
                        'contextPrefix' => '<string>',
                        'integrationId' => '<string>',
                    ],
                    // ...
                ],
            ],
        ],
    ],
    'createdAt' => <DateTime>,
    'environmentArn' => '<string>',
    'environmentId' => '<string>',
    'name' => '<string>',
    'status' => 'ACTIVE',
    'statusMessage' => '<string>',
    'statusUpdatedAt' => <DateTime>,
    'updatedAt' => <DateTime>,
]

Result Details

Members
configuration
Required: Yes
Type: EnvironmentConfigurationDetails structure

Type-specific configuration and state, including code sources, operating policy, Collector details, and the latest scan.

createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the environment was created.

environmentArn
Required: Yes
Type: string

The ARN of the environment.

environmentId
Required: Yes
Type: string

The unique identifier of the environment.

name
Required: Yes
Type: string

The customer-visible name of the environment.

status
Required: Yes
Type: string

The current operational status of the environment.

statusMessage
Type: string

Human-readable details about the current status. Present when the status requires additional context (e.g., failure reason).

statusUpdatedAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the status last transitioned.

updatedAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the environment's properties were last updated.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

GetIntegration

$result = $client->getIntegration([/* ... */]);
$promise = $client->getIntegrationAsync([/* ... */]);

Retrieves information about an integration.

Parameter Syntax

$result = $client->getIntegration([
    'integrationId' => '<string>', // REQUIRED
]);

Parameter Details

Members
integrationId
Required: Yes
Type: string

The unique identifier of the integration to retrieve.

Result Syntax

[
    'createdAt' => <DateTime>,
    'integrationArn' => '<string>',
    'integrationId' => '<string>',
    'integrationType' => 'GITHUB|GITLAB|S3',
    'name' => '<string>',
    'providerDetails' => [
        'github' => [
            'organizationName' => '<string>',
        ],
        'gitlab' => [
            'expiresAt' => <DateTime>,
            'instanceUrl' => '<string>',
            'targetPath' => '<string>',
            'targetType' => 'GROUP|PROJECT',
            'tokenRotation' => 'AUTOMATIC|NONE',
        ],
        's3' => [
            'bucket' => '<string>',
            'roleArn' => '<string>',
        ],
    ],
    'updatedAt' => <DateTime>,
]

Result Details

Members
createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the integration was created.

integrationArn
Required: Yes
Type: string

The ARN of the integration.

integrationId
Required: Yes
Type: string

The unique identifier of the integration.

integrationType
Required: Yes
Type: string

The immutable provider type for the integration.

name
Required: Yes
Type: string

The name of the integration.

providerDetails
Required: Yes
Type: ProviderDetails structure

Provider-specific details for the integration.

updatedAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the integration was last updated.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

GetResourcePolicy

$result = $client->getResourcePolicy([/* ... */]);
$promise = $client->getResourcePolicyAsync([/* ... */]);

Retrieves the resource policy attached to a Continuum resource.

Parameter Syntax

$result = $client->getResourcePolicy([
    'arn' => '<string>', // REQUIRED
]);

Parameter Details

Members
arn
Required: Yes
Type: string

The ARN of a resource in the caller's account.

Result Syntax

[
    'arn' => '<string>',
    'policy' => '<string>',
    'revisionId' => '<string>',
]

Result Details

Members
arn
Required: Yes
Type: string

The ARN of a Continuum resource that supports a resource policy. Collectors are the only supported resource type; other well-formed Continuum ARNs are rejected with ValidationException.

policy
Required: Yes
Type: string

A resource policy in displayable JSON form.

revisionId
Required: Yes
Type: string

Opaque optimistic-concurrency token for a resource policy.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

ListAssociatedCollectors

$result = $client->listAssociatedCollectors([/* ... */]);
$promise = $client->listAssociatedCollectorsAsync([/* ... */]);

Lists the Collectors currently associated with one Environment in ascending collectorId order. Each entry carries the Collector ARN, so a listed association can be passed straight to DisassociateCollector, including when the Collector belongs to another account. An association recorded before Continuum persisted the ARN is omitted from the response, because without the ARN it cannot be acted on.

Parameter Syntax

$result = $client->listAssociatedCollectors([
    'environmentId' => '<string>', // REQUIRED
    'maxResults' => <integer>,
    'nextToken' => '<string>',
]);

Parameter Details

Members
environmentId
Required: Yes
Type: string

The unique identifier of the Environment whose associations to list.

maxResults
Type: int

Maximum number of associated Collectors to return.

nextToken
Type: string

Pagination token returned by a prior request.

Result Syntax

[
    'associatedCollectors' => [
        [
            'collectorArn' => '<string>',
            'collectorId' => '<string>',
        ],
        // ...
    ],
    'nextToken' => '<string>',
]

Result Details

Members
associatedCollectors
Required: Yes
Type: Array of AssociatedCollector structures

The Collectors associated with this Environment, ordered by collectorId ascending. Empty when the Environment has no associations, and also when every association on the page predates Continuum persisting the ARN — the page is still advanced by nextToken in that case.

nextToken
Type: string

Pagination token for the next page, if present.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

ListAssociatedEnvironments

$result = $client->listAssociatedEnvironments([/* ... */]);
$promise = $client->listAssociatedEnvironmentsAsync([/* ... */]);

Lists the Environments currently associated with one Collector in lexicographically ascending environmentArn order. The ARN identifies each Environment across accounts within the Collector's Region.

Parameter Syntax

$result = $client->listAssociatedEnvironments([
    'collectorId' => '<string>', // REQUIRED
    'maxResults' => <integer>,
    'nextToken' => '<string>',
]);

Parameter Details

Members
collectorId
Required: Yes
Type: string

The unique identifier of the Collector whose associations to list.

maxResults
Type: int

Maximum number of Environment associations to return.

nextToken
Type: string

Pagination token returned by a prior request.

Result Syntax

[
    'associatedEnvironments' => [
        [
            'createdAt' => <DateTime>,
            'environmentArn' => '<string>',
            'environmentId' => '<string>',
            'name' => '<string>',
            'status' => 'ACTIVE',
        ],
        // ...
    ],
    'nextToken' => '<string>',
]

Result Details

Members
associatedEnvironments
Required: Yes
Type: Array of AssociatedEnvironment structures

Summaries of the Environments associated with this Collector, ordered by environmentArn lexicographically ascending. Each summary has the same fields as a ListEnvironments item but uses an independent model shape. Empty when the Collector has no associations.

nextToken
Type: string

Pagination token for the next page, if present.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

ListCodeFindings

$result = $client->listCodeFindings([/* ... */]);
$promise = $client->listCodeFindingsAsync([/* ... */]);

Lists the findings in an environment in descending findingId order.

Parameter Syntax

$result = $client->listCodeFindings([
    'environmentId' => '<string>', // REQUIRED
    'maxResults' => <integer>,
    'nextToken' => '<string>',
]);

Parameter Details

Members
environmentId
Required: Yes
Type: string

The environment whose findings to list.

maxResults
Type: int

The maximum number of results to return in a single call.

nextToken
Type: string

A pagination token returned by a previous call. Set to null for the first request; use the returned token for subsequent calls.

Result Syntax

[
    'items' => [
        [
            'category' => '<string>',
            'completedAt' => <DateTime>,
            'createdAt' => <DateTime>,
            'createdIssueId' => '<string>',
            'discardReason' => 'SCANNER_VALIDATED_FALSE_POSITIVE|SCANNER_NEEDS_REVIEW|FALSE_POSITIVE_VALIDATED_AGAINST_CONTEXT|DUPLICATE_OF_OPEN_ISSUE|DUPLICATE_OF_CLOSED_ISSUE|COMPENSATING_CONTROL_PRESENT|OUT_OF_SCOPE|INSUFFICIENT_EVIDENCE|PROCESSING_FAILED|SOURCE_REPO_NOT_FOUND',
            'discardReasoning' => '<string>',
            'duplicateOfIssueId' => '<string>',
            'environmentId' => '<string>',
            'filePath' => '<string>',
            'findingArn' => '<string>',
            'findingId' => '<string>',
            'reportedAt' => <DateTime>,
            'scanRunId' => '<string>',
            'severity' => 'UNKNOWN|INFORMATIONAL|LOW|MEDIUM|HIGH|CRITICAL|FATAL|OTHER',
            'source' => '<string>',
            'sourceFindingId' => '<string>',
            'status' => 'SUBMITTED|VALIDATING|CONFIRMED|DISCARDED',
            'statusMessage' => '<string>',
            'statusUpdatedAt' => <DateTime>,
            'title' => '<string>',
            'type' => 'CONTINUUM_CODE_VULN|CUSTOMER_CODE_VULN',
        ],
        // ...
    ],
    'nextToken' => '<string>',
]

Result Details

Members
items
Required: Yes
Type: Array of FindingSummary structures

The findings in the environment, ordered by findingId descending.

nextToken
Type: string

A pagination token to retrieve the next page of results. Absent when there are no more results.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

ListCodeIssueArtifacts

$result = $client->listCodeIssueArtifacts([/* ... */]);
$promise = $client->listCodeIssueArtifactsAsync([/* ... */]);

Lists the artifacts attached to an issue in descending artifactId order. Content is returned by GetCodeIssueArtifact.

Parameter Syntax

$result = $client->listCodeIssueArtifacts([
    'artifactType' => 'EVIDENCE|AGENT_COMMUNICATION|VALIDATION_EVIDENCE|REMEDIATION_PROPOSAL|DECISION|PATCH',
    'environmentId' => '<string>', // REQUIRED
    'issueId' => '<string>', // REQUIRED
    'maxResults' => <integer>,
    'nextToken' => '<string>',
]);

Parameter Details

Members
artifactType
Type: string

Optional filter for a semantic artifact category. Omit to list all artifacts attached to the issue.

environmentId
Required: Yes
Type: string

The environment that owns the issue.

issueId
Required: Yes
Type: string

The issue whose artifacts to list.

maxResults
Type: int

The maximum number of results to return in a single call.

nextToken
Type: string

A pagination token returned by a previous call. Set to null for the first request; use the returned token for subsequent calls.

Result Syntax

[
    'items' => [
        [
            'artifactId' => '<string>',
            'artifactType' => 'EVIDENCE|AGENT_COMMUNICATION|VALIDATION_EVIDENCE|REMEDIATION_PROPOSAL|DECISION|PATCH',
            'contentSizeBytes' => <integer>,
            'createdAt' => <DateTime>,
            'mediaType' => '<string>',
            'producer' => [
                'agent' => '<string>',
            ],
        ],
        // ...
    ],
    'nextToken' => '<string>',
]

Result Details

Members
items
Required: Yes
Type: Array of IssueArtifactItem structures

The artifacts attached to the issue, ordered by artifactId descending.

nextToken
Type: string

A pagination token to retrieve the next page of results. Absent when there are no more results.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

ListCodeIssues

$result = $client->listCodeIssues([/* ... */]);
$promise = $client->listCodeIssuesAsync([/* ... */]);

Lists the issues in an environment in descending issueId order.

Parameter Syntax

$result = $client->listCodeIssues([
    'environmentId' => '<string>', // REQUIRED
    'maxResults' => <integer>,
    'nextToken' => '<string>',
]);

Parameter Details

Members
environmentId
Required: Yes
Type: string

The environment whose issues to list.

maxResults
Type: int

The maximum number of results to return in a single call.

nextToken
Type: string

A pagination token returned by a previous call. Set to null for the first request; use the returned token for subsequent calls.

Result Syntax

[
    'items' => [
        [
            'confidence' => <integer>,
            'createdAt' => <DateTime>,
            'issueArn' => '<string>',
            'issueId' => '<string>',
            'name' => '<string>',
            'phase' => 'VALIDATION|PRIORITIZATION|REMEDIATION',
            'severity' => 'LOW|MEDIUM|HIGH|CRITICAL',
            'status' => 'CREATED|IN_PROGRESS|COMPLETED|FAILED',
            'statusMessage' => '<string>',
            'statusReason' => 'INTERNAL_ERROR|REMEDIATION_FAILED',
            'statusUpdatedAt' => <DateTime>,
            'updatedAt' => <DateTime>,
        ],
        // ...
    ],
    'nextToken' => '<string>',
]

Result Details

Members
items
Required: Yes
Type: Array of IssueSummary structures

The issues in the environment, ordered by issueId descending.

nextToken
Type: string

A pagination token to retrieve the next page of results. Absent when there are no more results.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

ListCodeScans

$result = $client->listCodeScans([/* ... */]);
$promise = $client->listCodeScansAsync([/* ... */]);

Lists customer-visible scans for one environment in descending scanRunId order.

Parameter Syntax

$result = $client->listCodeScans([
    'environmentId' => '<string>', // REQUIRED
    'maxResults' => <integer>,
    'nextToken' => '<string>',
]);

Parameter Details

Members
environmentId
Required: Yes
Type: string

Environment whose scans to list.

maxResults
Type: int

Maximum number of scans to return.

nextToken
Type: string

Pagination token returned by a prior request.

Result Syntax

[
    'nextToken' => '<string>',
    'scans' => [
        [
            'completedAt' => <DateTime>,
            'createdAt' => <DateTime>,
            'failureMessage' => '<string>',
            'failureStage' => 'SUBMITTED|WAITING_FOR_BUILD|BUILDING|WAITING_FOR_SCAN|SCANNING',
            'origin' => 'MANUAL|SCHEDULED',
            'scanRunId' => '<string>',
            'status' => 'SUBMITTED|WAITING_FOR_BUILD|BUILDING|WAITING_FOR_SCAN|SCANNING|SUCCEEDED|FAILED',
        ],
        // ...
    ],
]

Result Details

Members
nextToken
Type: string

Pagination token for the next page, if present.

scans
Required: Yes
Type: Array of CodeScanSummary structures

Customer-visible scans ordered by scanRunId descending.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

ListCollectors

$result = $client->listCollectors([/* ... */]);
$promise = $client->listCollectorsAsync([/* ... */]);

Lists the Collectors owned by the authenticated caller's account, including a Collector whose deletion is in progress. A Collector that is still being created is omitted. The account-scoped Collector quota currently permits at most one result, so no result ordering applies.

Parameter Syntax

$result = $client->listCollectors([
]);

Parameter Details

Members

Result Syntax

[
    'items' => [
        [
            'collectorArn' => '<string>',
            'collectorId' => '<string>',
            'createdAt' => <DateTime>,
            'status' => 'ACTIVE|PENDING_DELETION',
            'type' => 'AWS_COLLECTOR',
        ],
        // ...
    ],
]

Result Details

Members
items
Required: Yes
Type: Array of CollectorSummary structures

The Collectors owned by the authenticated caller's account. At most one result is currently returned, so no result ordering applies.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

ListEnvironments

$result = $client->listEnvironments([/* ... */]);
$promise = $client->listEnvironmentsAsync([/* ... */]);

Lists all environments in your account in descending environmentId order. This complete-inventory operation intentionally has no response filters; see the input documentation for the API standards justification.

Parameter Syntax

$result = $client->listEnvironments([
    'maxResults' => <integer>,
    'nextToken' => '<string>',
]);

Parameter Details

Members
maxResults
Type: int

The maximum number of results to return in a single call.

nextToken
Type: string

A pagination token returned by a previous call. Set to null for the first request; use the returned token for subsequent calls.

Result Syntax

[
    'items' => [
        [
            'createdAt' => <DateTime>,
            'environmentArn' => '<string>',
            'environmentId' => '<string>',
            'name' => '<string>',
            'status' => 'ACTIVE',
        ],
        // ...
    ],
    'nextToken' => '<string>',
]

Result Details

Members
items
Required: Yes
Type: Array of EnvironmentListEntry structures

Common metadata for the environments in the account, ordered by environmentId descending.

nextToken
Type: string

A pagination token to retrieve the next page of results. Absent when there are no more results.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

ListIntegrations

$result = $client->listIntegrations([/* ... */]);
$promise = $client->listIntegrationsAsync([/* ... */]);

Lists the integrations in your account in descending integrationId order.

Parameter Syntax

$result = $client->listIntegrations([
    'maxResults' => <integer>,
    'nextToken' => '<string>',
]);

Parameter Details

Members
maxResults
Type: int

The maximum number of results to return in a single call.

nextToken
Type: string

A pagination token returned by a previous call. Set to null for the first request; use the returned token for subsequent calls.

Result Syntax

[
    'items' => [
        [
            'createdAt' => <DateTime>,
            'integrationArn' => '<string>',
            'integrationId' => '<string>',
            'integrationType' => 'GITHUB|GITLAB|S3',
            'name' => '<string>',
            'providerDetails' => [
                'github' => [
                    'organizationName' => '<string>',
                ],
                'gitlab' => [
                    'expiresAt' => <DateTime>,
                    'instanceUrl' => '<string>',
                    'targetPath' => '<string>',
                    'targetType' => 'GROUP|PROJECT',
                    'tokenRotation' => 'AUTOMATIC|NONE',
                ],
                's3' => [
                    'bucket' => '<string>',
                    'roleArn' => '<string>',
                ],
            ],
            'updatedAt' => <DateTime>,
        ],
        // ...
    ],
    'nextToken' => '<string>',
]

Result Details

Members
items
Required: Yes
Type: Array of IntegrationSummary structures

The integrations in the account, ordered by integrationId descending.

nextToken
Type: string

A pagination token to retrieve the next page of results. Absent when there are no more results.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

PutResourcePolicy

$result = $client->putResourcePolicy([/* ... */]);
$promise = $client->putResourcePolicyAsync([/* ... */]);

Creates or replaces the resource policy attached to a Continuum resource.

Parameter Syntax

$result = $client->putResourcePolicy([
    'arn' => '<string>', // REQUIRED
    'expectedRevisionId' => '<string>',
    'policy' => '<string>',
]);

Parameter Details

Members
arn
Required: Yes
Type: string

The ARN of a resource in the caller's account.

expectedRevisionId
Type: string

Optional optimistic-concurrency token for the currently observed policy.

policy
Type: string

Omit or supply an empty Statement array to clear resource-policy grants and store the canonical empty-statement policy. Cross-account access is denied; same-account access remains subject to identity policies. Use an explicit Deny statement to deny same-account principals too.

Result Syntax

[
    'arn' => '<string>',
    'policy' => '<string>',
    'revisionId' => '<string>',
]

Result Details

Members
arn
Required: Yes
Type: string

The ARN of a Continuum resource that supports a resource policy. Collectors are the only supported resource type; other well-formed Continuum ARNs are rejected with ValidationException.

policy
Required: Yes
Type: string

A resource policy in displayable JSON form.

revisionId
Required: Yes
Type: string

Opaque optimistic-concurrency token for a resource policy.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

ConflictException:

The request could not be completed due to a conflict with the current state of the resource.

StartIntegrationAuthorization

$result = $client->startIntegrationAuthorization([/* ... */]);
$promise = $client->startIntegrationAuthorizationAsync([/* ... */]);

Starts an OAuth authorization for a new integration and returns the values the caller sends to the provider's authorization endpoint. The authorization belongs to the calling AWS account, can be redeemed once by CreateIntegration from that same account, and expires after ten minutes.

Parameter Syntax

$result = $client->startIntegrationAuthorization([
    'name' => '<string>',
    'providerType' => 'GITHUB', // REQUIRED
]);

Parameter Details

Members
name
Type: string

The name the integration will be created with. When specified, the request fails with ConflictException if an integration with this name already exists in the account, before the caller leaves for the provider. The name is only checked: it is not reserved, stored, or authorized. CreateIntegration requires its own name, checks it again, and may use a different one.

providerType
Required: Yes
Type: string

The provider to authorize. Only GITHUB is supported.

Result Syntax

[
    'codeChallenge' => '<string>',
    'codeChallengeMethod' => 'S256',
    'expiresAt' => <DateTime>,
    'state' => '<string>',
]

Result Details

Members
codeChallenge
Required: Yes
Type: string

The PKCE code challenge to send as the OAuth code_challenge parameter.

codeChallengeMethod
Required: Yes
Type: string

The PKCE challenge method to send as the OAuth code_challenge_method parameter.

expiresAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The time after which CreateIntegration no longer accepts this authorization.

state
Required: Yes
Type: string

An opaque value to send as the OAuth state parameter. Pass the value the provider returns in its callback to CreateIntegration as authorization.state.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

ConflictException:

The request could not be completed due to a conflict with the current state of the resource.

UpdateCollector

$result = $client->updateCollector([/* ... */]);
$promise = $client->updateCollectorAsync([/* ... */]);

Updates the customer-controlled mutable properties of a Collector. Only the name and Kubernetes cluster IAM role can be changed.

Parameter Syntax

$result = $client->updateCollector([
    'collectorId' => '<string>', // REQUIRED
    'kubernetesClusterRole' => [
        'remove' => [
        ],
        'set' => [
            'externalId' => '<string>',
            'roleArn' => '<string>', // REQUIRED
        ],
    ],
    'name' => '<string>',
]);

Parameter Details

Members
collectorId
Required: Yes
Type: string

The unique identifier of the Collector to update.

kubernetesClusterRole
Type: KubernetesClusterRoleUpdate structure

Atomic update to the IAM role configuration used to collect Kubernetes cluster metadata. The set variant requires a complete configuration; the authenticated caller must be allowed to pass its exact roleArn to Continuum. The remove variant clears both the role and external ID.

name
Type: string

The new customer-visible name.

Result Syntax

[
    'collectorArn' => '<string>',
    'collectorId' => '<string>',
    'configRecorderArn' => '<string>',
    'createdAt' => <DateTime>,
    'kubernetesClusterRoleArn' => '<string>',
    'status' => 'ACTIVE|PENDING_DELETION',
    'type' => 'AWS_COLLECTOR',
    'updatedAt' => <DateTime>,
]

Result Details

Members
collectorArn
Required: Yes
Type: string

The ARN of the updated Collector.

collectorId
Required: Yes
Type: string

The unique identifier of the updated Collector.

configRecorderArn
Type: string

The ARN of the provisioned AWS Config Recorder.

createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the Collector was created.

kubernetesClusterRoleArn
Type: string

IAM role used to collect Kubernetes cluster metadata.

status
Required: Yes
Type: string

The current lifecycle status.

type
Required: Yes
Type: string

The source collected by this Collector.

updatedAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The time of the last successful UpdateCollector call, returned at whole-second precision in the same date-time format as createdAt.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

ConflictException:

The request could not be completed due to a conflict with the current state of the resource.

UpdateEnvironment

$result = $client->updateEnvironment([/* ... */]);
$promise = $client->updateEnvironmentAsync([/* ... */]);

Updates the customer-controlled mutable properties of an environment. Only the name, the environment's S3 integration source and repository selections, its scan frequency, its network policy, and its patch creation policy can be changed.

Parameter Syntax

$result = $client->updateEnvironment([
    'configuration' => [
        'codeConfiguration' => [
            'environmentConfiguration' => [
                'network' => [
                    'allowedDomains' => ['<string>', ...],
                ],
                'patchCreationPolicy' => 'ENABLED|DISABLED',
                'scanFrequency' => '<string>',
            ],
            'sourceConfiguration' => [
                'repositorySources' => [
                    [
                        'defaultBranch' => '<string>',
                        'integrationId' => '<string>', // REQUIRED
                        'repository' => '<string>', // REQUIRED
                    ],
                    // ...
                ],
                's3Sources' => [
                    [
                        'codePrefix' => '<string>',
                        'contextPrefix' => '<string>',
                        'integrationId' => '<string>', // REQUIRED
                    ],
                    // ...
                ],
            ],
        ],
    ],
    'environmentId' => '<string>', // REQUIRED
    'name' => '<string>',
]);

Parameter Details

Members
configuration

Type-specific configuration changes. Omission preserves the configuration.

environmentId
Required: Yes
Type: string

The unique identifier of the environment to update.

name
Type: string

The new customer-visible name.

Result Syntax

[
    'configuration' => [
        'codeConfiguration' => [
            'collectorDetails' => [
                'collectorDataAccessRoleArn' => '<string>',
            ],
            'environmentConfiguration' => [
                'network' => [
                    'allowedDomains' => ['<string>', ...],
                ],
                'patchCreationPolicy' => 'ENABLED|DISABLED',
                'scanFrequency' => '<string>',
            ],
            'latestScan' => [
                'completedAt' => <DateTime>,
                'createdAt' => <DateTime>,
                'failureMessage' => '<string>',
                'failureStage' => 'SUBMITTED|WAITING_FOR_BUILD|BUILDING|WAITING_FOR_SCAN|SCANNING',
                'origin' => 'MANUAL|SCHEDULED',
                'scanRunId' => '<string>',
                'status' => 'SUBMITTED|WAITING_FOR_BUILD|BUILDING|WAITING_FOR_SCAN|SCANNING|SUCCEEDED|FAILED',
            ],
            'sourceConfiguration' => [
                'repositorySources' => [
                    [
                        'defaultBranch' => '<string>',
                        'integrationId' => '<string>',
                        'repository' => '<string>',
                    ],
                    // ...
                ],
                's3Sources' => [
                    [
                        'codePrefix' => '<string>',
                        'contextPrefix' => '<string>',
                        'integrationId' => '<string>',
                    ],
                    // ...
                ],
            ],
        ],
    ],
    'createdAt' => <DateTime>,
    'environmentArn' => '<string>',
    'environmentId' => '<string>',
    'name' => '<string>',
    'status' => 'ACTIVE',
    'statusMessage' => '<string>',
    'statusUpdatedAt' => <DateTime>,
]

Result Details

Members
configuration
Required: Yes
Type: EnvironmentConfigurationDetails structure

Type-specific state, including Collector details and the latest scan. Read source and operating-policy settings through GetEnvironment.

createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the environment was created. Uses the existing GetEnvironment/ListEnvironments ISO-8601 wire format for this field.

environmentArn
Required: Yes
Type: string

The ARN of the updated environment.

environmentId
Required: Yes
Type: string

The unique identifier of the updated environment.

name
Required: Yes
Type: string

The current customer-visible name of the environment.

status
Required: Yes
Type: string

The current operational status of the environment.

statusMessage
Type: string

Human-readable details about the current status.

statusUpdatedAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the status last transitioned. Uses the existing GetEnvironment/ListEnvironments ISO-8601 wire format for this field.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

ConflictException:

The request could not be completed due to a conflict with the current state of the resource.

UpdateIntegration

$result = $client->updateIntegration([/* ... */]);
$promise = $client->updateIntegrationAsync([/* ... */]);

Rotates the credentials used by an Amazon S3 integration. Only S3 integrations can be updated; GitHub integrations cannot be modified. The integration's name, provider type, and bucket remain fixed.

The caller must have iam:PassRole permission for the supplied role, including when only the external ID changes. Continuum verifies that the role can be assumed with the requested external ID and can access the existing bucket before saving both credentials atomically. Omitting externalId preserves its current value. Repeating both current credentials leaves updatedAt unchanged, but still requires authorization and access validation.

Parameter Syntax

$result = $client->updateIntegration([
    'integrationId' => '<string>', // REQUIRED
    'providerConfiguration' => [ // REQUIRED
        's3' => [
            'externalId' => '<string>',
            'roleArn' => '<string>', // REQUIRED
        ],
    ],
]);

Parameter Details

Members
integrationId
Required: Yes
Type: string

The unique identifier of the S3 integration to update.

providerConfiguration
Required: Yes
Type: UpdateProviderConfiguration structure

The provider-specific changes to apply. The member must match the integration's provider type, and only S3 integrations can be updated.

Result Syntax

[
    'createdAt' => <DateTime>,
    'integrationArn' => '<string>',
    'integrationId' => '<string>',
    'integrationType' => 'GITHUB|GITLAB|S3',
    'name' => '<string>',
    'providerDetails' => [
        'github' => [
            'organizationName' => '<string>',
        ],
        'gitlab' => [
            'expiresAt' => <DateTime>,
            'instanceUrl' => '<string>',
            'targetPath' => '<string>',
            'targetType' => 'GROUP|PROJECT',
            'tokenRotation' => 'AUTOMATIC|NONE',
        ],
        's3' => [
            'bucket' => '<string>',
            'roleArn' => '<string>',
        ],
    ],
    'updatedAt' => <DateTime>,
]

Result Details

Members
createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

When the integration was created.

integrationArn
Required: Yes
Type: string

The Amazon Resource Name (ARN) of an Integration resource, of the form arn:{partition}:continuum:{region}:{account}:integrations/{integrationId}.

integrationId
Required: Yes
Type: string

The unique identifier for an Integration resource.

integrationType
Required: Yes
Type: string

The immutable provider type for an integration.

name
Required: Yes
Type: string

The name for an integration.

providerDetails
Required: Yes
Type: ProviderDetails structure

Provider-specific details for an integration. Only one member will be present.

updatedAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

When the integration was last updated.

Errors

ValidationException:
This error does not currently have a description.
InternalServerException:

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

ThrottlingException:

The request was denied due to request throttling.

AccessDeniedException:

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

ConflictException:

The request could not be completed due to a conflict with the current state of the resource.

Shapes

AccessDeniedException

Description

The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.

Members
message
Required: Yes
Type: string

Error description.

AffectedPackage

Description

A software package implicated by a finding.

Members
fixedInVersion
Type: string

The earliest version that resolves the issue, when one is known.

name
Required: Yes
Type: string

The package name.

packageManager
Type: string

The ecosystem supplying the package.

version
Type: string

The affected version.

AssociatedCollector

Description

One Collector associated with an Environment.

Members
collectorArn
Required: Yes
Type: string

The ARN of the associated Collector. The account and Region encoded in this ARN identify cross-account and cross-Region associations.

collectorId
Required: Yes
Type: string

The unique identifier of the associated Collector.

AssociatedEnvironment

Description

A summary of one Environment associated with a Collector. This shape intentionally remains distinct from EnvironmentSummary so the two list operations can evolve independently.

Members
createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the associated Environment was created.

environmentArn
Required: Yes
Type: string

The ARN of the associated Environment. The account encoded in this ARN identifies cross-account associations; association mutations require its Region to match the Collector's Region.

environmentId
Required: Yes
Type: string

The unique identifier of the associated Environment.

name
Required: Yes
Type: string

The customer-visible name of the associated Environment.

status
Required: Yes
Type: string

The current operational status of the associated Environment.

CodeConfigurationDetails

Description

Code-specific environment properties. GetEnvironment returns the source and operating policy; UpdateEnvironment returns Collector details and the latest scan.

Members
collectorDetails
Type: CollectorDetails structure

Collector data access configuration. Omitted when no Collector data access role is configured.

environmentConfiguration
Type: EnvironmentConfiguration structure

Operating policy in the shape accepted by CreateEnvironment and UpdateEnvironment.

latestScan
Type: CodeScanSummary structure

The newest scan requested for this environment, if one exists.

sourceConfiguration

Sources in the shape accepted by CreateEnvironment and UpdateEnvironment.

CodeScanData

Description

Complete customer-visible data for one environment scan.

Kept distinct from CodeScanSummary so GetCodeScan can grow independently of ListCodeScans without changing its response contract.

Members
completedAt
Type: timestamp (string|DateTime or anything parsable by strtotime)

Time at which a terminal result was recorded.

createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

Time at which Continuum accepted the scan request.

failureMessage
Type: string

Failure detail present for unsuccessful scans.

failureStage
Type: string

Phase this scan failed in. Present only when status is FAILED, and absent for a scan that failed before this field existed.

origin
Required: Yes
Type: string

Why the scan was created. Always present.

scanRunId
Required: Yes
Type: string

The unique scan identifier.

status
Required: Yes
Type: string

Current customer-visible status.

CodeScanSummary

Description

Customer-visible summary of one environment scan.

Members
completedAt
Type: timestamp (string|DateTime or anything parsable by strtotime)

Time at which a terminal result was recorded.

createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

Time at which Continuum accepted the scan request.

failureMessage
Type: string

Failure detail present for unsuccessful scans.

failureStage
Type: string

Phase this scan failed in. Present only when status is FAILED, and absent for a scan that failed before this field existed.

origin
Required: Yes
Type: string

Why the scan was created. Always present.

scanRunId
Required: Yes
Type: string

The unique scan identifier.

status
Required: Yes
Type: string

Current customer-visible status.

CollectorDetails

Description

Collector data access configuration returned for an environment.

Members
collectorDataAccessRoleArn
Type: string

IAM role that Continuum assumes to authorize its access to associated Collector inventory. Required for nonempty Collector inventory resolution, in the same account or across accounts. This is independent from any S3 source role.

CollectorSummary

Description

A summary of a Collector returned in list responses.

Members
collectorArn
Required: Yes
Type: string

The ARN of the Collector.

collectorId
Required: Yes
Type: string

The unique identifier of the Collector.

createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the Collector was created.

status
Required: Yes
Type: string

The current lifecycle status.

type
Required: Yes
Type: string

The source collected by this Collector.

ConflictException

Description

The request could not be completed due to a conflict with the current state of the resource.

Members
message
Required: Yes
Type: string

Description of the conflict.

CreateCodeConfiguration

Description

Source and operating-policy settings for a new code environment.

Members
environmentConfiguration
Type: EnvironmentConfiguration structure

Environment-level operating policy.

sourceConfiguration

Source configuration for the environment.

CreateEnvironmentConfiguration

Description

Type-specific configuration for a new environment. Omission creates a code environment with the default operating policy and no sources.

Members
codeConfiguration
Type: CreateCodeConfiguration structure

Configuration for a code-scanning environment.

DestinationTarget

Description

Identity only. Future providers may add union members without duplicating state.

Members
github
Type: GitHubTarget structure

The GitHub repository the patch is delivered to, including the pull request once it is opened.

s3
Type: S3Target structure

The S3 object the patch is delivered to.

Document

Members

EnvironmentConfiguration

Description

Environment-level operating policy.

Members
network

Network policy for agent execution.

patchCreationPolicy
Type: string

Whether Continuum creates a patch for a proposed remediation. Defaults to DISABLED.

scanFrequency
Type: string

Recurring scan interval: P1D (1 day), P2D (2 days), or P7D (7 days). PT0H disables recurring scans. Defaults to P1D when creating an environment.

EnvironmentConfigurationDetails

Description

Type-specific configuration and state returned by GetEnvironment and UpdateEnvironment.

Members
codeConfiguration
Type: CodeConfigurationDetails structure

Configuration and scan state for a code-scanning environment.

EnvironmentListEntry

Description

Summary of an environment returned in list responses.

Members
createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the environment was created. Preserve the existing EnvironmentSummary.createdAt date-time wire format.

environmentArn
Required: Yes
Type: string

The ARN of the environment.

environmentId
Required: Yes
Type: string

The unique identifier of the environment.

name
Required: Yes
Type: string

The customer-visible name of the environment.

status
Required: Yes
Type: string

The current operational status of the environment.

EnvironmentNetworkConfiguration

Description

Network policy for agent execution.

Members
allowedDomains
Type: Array of strings

Domains that an environment's agent execution may contact.

EnvironmentRepositorySource

Description

One repository selected from a previously-created integration.

Members
defaultBranch
Type: string

Branch used when a scan does not choose a more specific revision.

integrationId
Required: Yes
Type: string

Integration that provides the selected repository.

repository
Required: Yes
Type: string

Repository selected from that integration in owner/repository form.

EnvironmentS3IntegrationSource

Description

An S3 source for one environment, backed by a previously-created S3 integration.

Members
codePrefix
Type: string

Prefix containing source code. Defaults to code/ when omitted.

contextPrefix
Type: string

Prefix containing customer-authored context. Defaults to context/ when omitted.

integrationId
Required: Yes
Type: string

Identifier of an S3 integration in the caller's account. The integration supplies the bucket, the read role, and the external ID Continuum uses to read the prefixes.

EnvironmentSourceConfiguration

Description

GA source configuration for code and customer-authored context.

Members
repositorySources
Type: Array of EnvironmentRepositorySource structures

Explicit repository selections from previously-created integrations.

s3Sources
Type: Array of EnvironmentS3IntegrationSource structures

S3 sources backed by previously-created S3 integrations.

FindingComplianceCheck

Description

One compliance check behind a posture finding.

Members
description
Type: string

Free-form prose about a finding (summary, detailed analysis, rationale, remediation guidance). Capped well below the finding document's own 256 KB limit, since several of these can appear on one finding.

name
Type: string

A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.

uid
Type: string

A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.

FindingEvidence

Description

A code citation supporting a validation verdict.

Members
file
Type: string

The file the evidence was found in.

line
Type: int

The 1-indexed line, when known.

snippet
Type: string

The cited excerpt.

FindingLocation

Description

A code location a finding points at.

Members
endLine
Type: int

1-indexed last line, when the producer reported a range.

filePath
Type: string

Repository-relative path.

startLine
Type: int

1-indexed first line of the affected range.

FindingPosture

Description

The compliance posture a finding reports, for the Application Security Posture Finding class. Absent for a vulnerability finding.

Members
application
Type: string

The application the posture was assessed against.

applicationUid
Type: string

A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.

applicationVersion
Type: string

A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.

checks
Type: Array of FindingComplianceCheck structures

The individual checks performed.

control
Type: string

The control assessed, and the producer's description of it.

description
Type: string

Free-form prose about a finding (summary, detailed analysis, rationale, remediation guidance). Capped well below the finding document's own 256 KB limit, since several of these can appear on one finding.

remediation
Type: string

Free-form prose about a finding (summary, detailed analysis, rationale, remediation guidance). Capped well below the finding document's own 256 KB limit, since several of these can appear on one finding.

remediationReferences
Type: Array of strings

A free-form list of strings carried verbatim from a producer.

requirements
Type: Array of strings

A free-form list of strings carried verbatim from a producer.

standards
Type: Array of strings

Standards and requirements the control maps to.

status
Type: string

The producer's compliance status, and the enum value behind it.

statusId
Type: int

The producer's numeric enum value for status.

FindingResource

Description

A cloud or application resource a finding concerns.

Members
name
Type: string

A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.

region
Type: string

A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.

type
Type: string

A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.

uid
Type: string

A resource identifier -- a cloud ARN, a context-graph node id, or whatever identifier scheme the producer uses.

FindingSummary

Description

A summary of a finding returned in list responses. Shares FindingLifecycleFields with the read operations so the list and get projections cannot drift. Carries a lean content subset -- fetch the finding for its full contents.

Members
category
Type: string

The producer's vulnerability category.

completedAt
Type: timestamp (string|DateTime or anything parsable by strtotime)

When processing finished, whether by creating an issue or discarding. Absent while the finding is still in flight.

createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the finding was ingested.

createdIssueId
Type: string

The issue Continuum created from this finding.

discardReason
Type: string

Why the finding was not escalated. Present only when status is DISCARDED.

discardReasoning
Type: string

Customer-facing explanation accompanying discardReason.

duplicateOfIssueId
Type: string

The existing issue this finding duplicates. Present only for the DUPLICATE_OF_* discard reasons.

environmentId
Required: Yes
Type: string

The environment that owns the finding.

filePath
Type: string

The file the finding is about, when it has a code location.

findingArn
Required: Yes
Type: string

The ARN of the finding.

findingId
Required: Yes
Type: string

The unique identifier of the finding.

reportedAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

When the producer reported the finding -- its own clock, which is not Continuum's ingestion time. createdAt is when Continuum accepted it; these are genuinely different instants and a reader usually wants this one.

For CreateCodeFinding, this is the submitted OCSF document's own top-level time. For findings Continuum's scanner produces, it is the finding's own creation time.

Continuum does not validate it for plausibility: a producer's value is echoed as given, so a timestamp here asserts the unit and format, not that the instant is genuine.

scanRunId
Type: string

The scan that produced the finding, when it came from one. For a finding Continuum's scanner produced, this is the Continuum scan run (see GetCodeScan). For a finding submitted with CreateCodeFinding, it is the OCSF document's metadata.correlation_uid, when that value is a valid ScanRunId. Absent when the finding did not come from a scan.

severity
Required: Yes
Type: string

The finding's severity.

source
Required: Yes
Type: string

The system that produced the finding.

sourceFindingId
Required: Yes
Type: string

The producer's own identifier for the finding.

status
Required: Yes
Type: string

The current lifecycle status of the finding.

statusMessage
Type: string

Human-readable context about the current status.

statusUpdatedAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the status last transitioned.

title
Required: Yes
Type: string

The producer's title for the finding.

type
Required: Yes
Type: string

What kind of finding this is.

FindingValidation

Description

A validator's assessment of a finding. Present only when validation actually ran -- absent for finding types that are ingested untested, rather than reporting a verdict Continuum did not reach.

Members
blockingReason
Type: string

Why the validator reached that verdict.

confidence
Type: double

The validator's confidence, from 0.0 to 1.0 inclusive. Advisory: it does not drive Continuum's own routing decisions. The range is enforced server-side, not by a @range trait -- the smithy-rs server SDK does not support range constraints on double shapes (smithy-rs#2007).

evidence
Type: Array of FindingEvidence structures

Code citations supporting the verdict.

mitigatingControls
Type: Array of strings

Controls the validator found that reduce exploitability.

preconditions
Type: Array of strings

Conditions exploitation depends on, which bound the severity.

rationale
Type: string

The validator's reasoning.

severityAdjustment
Type: string

The validator's severity conclusion.

verdict
Required: Yes
Type: string

The validator's conclusion.

FindingVulnerability

Description

One vulnerability reported by a finding. A customer document may report several; each carries its own identity, locations and remediation.

Members
additionalCweIds
Type: Array of strings

Further CWEs the producer attributed to this same vulnerability.

affectedPackages
Type: Array of AffectedPackage structures

Software packages implicated by a finding.

code
Type: string

The vulnerable fragment, when the producer supplied one.

cveId
Type: string

A CVE identifier, e.g. "CVE-2020-8203".

cvssBaseScore
Type: double

The CVSS base score for cveId, when the producer supplies one, from 0.0 to 10.0.

cweCaption
Type: string

The producer's human-readable caption for cweId.

cweId
Type: string

Primary CWE for this vulnerability, e.g. "CWE-89".

description
Type: string

Free-form prose about a finding (summary, detailed analysis, rationale, remediation guidance). Capped well below the finding document's own 256 KB limit, since several of these can appear on one finding.

details
Type: string

The producer's extended analysis for this vulnerability.

fixCoverage
Type: string

The producer's description of how completely a fix is available.

fixCoverageId
Type: int

The producer's enum value behind fixCoverage.

locations
Type: Array of FindingLocation structures

Every location this vulnerability was reported at.

remediation
Type: string

Free-form prose about a finding (summary, detailed analysis, rationale, remediation guidance). Capped well below the finding document's own 256 KB limit, since several of these can appear on one finding.

remediationReferences
Type: Array of strings

A free-form list of strings carried verbatim from a producer.

title
Type: string

The title of a finding, from the producer's own title -- OCSF finding_info.title, or the scanner's finding title. Length matches the OCSF title constraint.

FlowVerdict

Description

Validation's verdict for one attack flow.

Members
confidence
Type: double

Confidence in this flow's verdict. Absent when out of range.

evidence
Type: Array of strings

Citations supporting the verdict.

flowId
Required: Yes
Type: string

Identifier of the attack flow assessed.

verdict
Required: Yes
Type: string

Outcome for this flow.

GitHubAuthorizationConfiguration

Description

Write-only OAuth credentials used to authorize a GitHub.com integration. Not stored or returned after creation.

Members
authorizationCode
Required: Yes
Type: string

The OAuth authorization code returned by GitHub after the user authorizes the application.

redirectUrl
Type: string

The redirect URL used to obtain the authorization code. Must match one of the redirect URLs registered on the GitHub App. If omitted, the App's default redirect URL is used. Not stored or returned after creation.

state
Required: Yes
Type: string

The state returned by GitHub in the OAuth callback. It must be the state that StartIntegrationAuthorization returned to the same AWS account, and the authorization request must have sent that call's codeChallenge. The state can be redeemed once. A stage that enforces authorization sessions rejects a missing, expired, already used, or other-account state with ValidationException; restart the authorization with StartIntegrationAuthorization.

GitHubConfiguration

Description

Configuration for a GitHub.com integration using the OAuth authorization code flow.

Members
authorization
Required: Yes
Type: GitHubAuthorizationConfiguration structure

OAuth authorization used to establish the integration. Required on create; not returned on read operations.

organizationName
Type: string

The name of the GitHub organization to associate with the integration. If not specified, the integration is associated with the authenticated user's personal account.

GitHubDetails

Description

Details for a GitHub.com integration.

Members
organizationName
Type: string

The name of the GitHub organization associated with the integration.

GitHubTarget

Description

The GitHub repository a patch is delivered to, and the pull request that carries it once opened.

Members
headSha
Type: string

The head commit SHA of the pull request. Absent until the pull request is opened.

owner
Required: Yes
Type: string

The GitHub user or organization that owns the repository.

pullRequestNumber
Type: long (int|float)

Repository-scoped pull request number assigned by GitHub.

repository
Required: Yes
Type: string

The repository name.

GitLabConfiguration

Description

Configuration for a GitLab integration using a pasted access token.

Members
accessToken
Required: Yes
Type: string

The GitLab access token (personal, group or project). Write-only; not stored or returned after creation. If the token carries the self-rotate scope, rotation is opted in and Continuum manages the token thereafter.

instanceUrl
Required: Yes
Type: string

The HTTPS base URL of the GitLab instance (gitlab.com or self-managed).

targetPath
Required: Yes
Type: string

The group or project path the integration targets.

targetType
Required: Yes
Type: string

Whether the integration targets a group or a single project.

GitLabDetails

Description

Details for a GitLab integration.

Members
expiresAt
Type: timestamp (string|DateTime or anything parsable by strtotime)

The expiry of the stored access token, for non-rotating tokens only. A rotated token's original expiry is stale, so this is omitted when tokenRotation is AUTOMATIC.

instanceUrl
Required: Yes
Type: string

The HTTPS base URL of the GitLab instance.

targetPath
Required: Yes
Type: string

The group or project path the integration targets.

targetType
Required: Yes
Type: string

Whether the integration targets a group or a single project.

tokenRotation
Required: Yes
Type: string

How the integration's access token is rotated. AUTOMATIC only when the pasted token had the self-rotate scope and rotation was opted in at installation time.

IntegrationSummary

Description

A summary of an integration returned in list responses.

Members
createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the integration was created.

integrationArn
Required: Yes
Type: string

The ARN of the integration.

integrationId
Required: Yes
Type: string

The unique identifier of the integration.

integrationType
Required: Yes
Type: string

The immutable provider type for the integration.

name
Required: Yes
Type: string

The name of the integration.

providerDetails
Required: Yes
Type: ProviderDetails structure

Provider-specific details for the integration.

updatedAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the integration was last updated.

InternalServerException

Description

The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.

Members
message
Required: Yes
Type: string

Error description.

IssueArtifactBody

Description

The projected body of an artifact. The active member is selected by the artifact's artifactType, and for a type that carries more than one payload kind by the stored content's own discriminator; raw carries content for types with no defined shape yet and for content that did not match its shape.

Members
patch
Type: PatchBody structure

Projected PATCH content: the remediation patch for one repository, with the descriptors needed to verify and apply it and the state of its delivery to the customer's own bucket or repository.

Every PATCH projects here. The descriptors come from members Control Plane computes or owns when it stores the patch, not from producer metadata, so this member is the whole PATCH contract and metadata is omitted for it.

prevalidationSignals
Type: PrevalidationSignalsBody structure

Projected EVIDENCE content whose stored envelope declares artifact_kind: prevalidation_signals — the severity signals prioritization uses.

One artifactType can select different members here: EVIDENCE also carries the prioritization markdown narrative, which is not JSON and so returns through raw. The member is therefore chosen by artifactType AND, for a type that carries more than one payload kind, the content's own discriminator.

raw
Type: string

The producer's content verbatim, for an artifactType with no defined shape or content that failed to parse against its shape.

remediationProposal
Type: RemediationProposalBody structure

Projected REMEDIATION_PROPOSAL content: a patch the remediation agent produced, with the descriptors needed to apply and verify it.

REMEDIATION_PROPOSAL content that does not match this shape is returned through raw.

validationEvidence
Type: ValidationEvidenceBody structure

Projected VALIDATION_EVIDENCE content.

IssueArtifactItem

Description

A summary of an artifact returned in list responses.

Members
artifactId
Required: Yes
Type: string

The unique identifier of the artifact.

artifactType
Required: Yes
Type: string

Semantic category of the artifact.

contentSizeBytes
Required: Yes
Type: long (int|float)

Size of the artifact content in bytes. The content itself is returned by GetCodeIssueArtifact.

createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the artifact was created.

mediaType
Required: Yes
Type: string

MIME type of the artifact content.

producer
Required: Yes
Type: IssueArtifactProducerSummary structure

The agent that produced the artifact.

IssueArtifactProducerSummary

Description

The agent that produced an artifact.

Members
agent
Required: Yes
Type: string

Stable producer name, such as ContinuumValidation.

IssuePatchDelivery

Description

Customer delivery of the patches Continuum produced for an issue, summarized across the issue's PATCH artifacts when the issue is read. Each artifact keeps its own delivery.destination with the full detail; this summary lets a caller see a failed delivery without listing artifacts.

Members
failedCount
Required: Yes
Type: int

Number of those patches whose delivery failed or exhausted its retries.

failureReasons
Type: Array of strings

Distinct reasons of the failed deliveries, in ascending order. Present only when failedCount is greater than zero.

patchCount
Required: Yes
Type: int

Number of the issue's patches that have a destination delivery.

status
Required: Yes
Type: string

The overall result, in priority order: FAILED when any patch's destination delivery failed or exhausted its retries; otherwise PENDING while any is still in progress; otherwise SUCCEEDED when at least one was delivered; otherwise SKIPPED.

succeededCount
Required: Yes
Type: int

Number of those patches delivered to their destination.

IssueSummary

Description

A summary of an issue returned in list responses.

Members
confidence
Type: int

The likelihood that this issue is a true positive, expressed as a percentage (0-100).

createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the issue was created.

issueArn
Required: Yes
Type: string

The ARN of the issue.

issueId
Required: Yes
Type: string

The unique identifier of the issue.

name
Required: Yes
Type: string

The name of the issue.

phase
Type: string

The part of the workflow the issue is in. Present when status is IN_PROGRESS, and when status is FAILED and the failing phase is known.

severity
Type: string

Scanner-derived severity assigned to the issue.

status
Required: Yes
Type: string

The current lifecycle status of the issue.

statusMessage
Type: string

Customer-facing explanation of statusReason. Present only when status is FAILED.

statusReason
Type: string

Why the issue failed. Present only when status is FAILED.

statusUpdatedAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when the status or phase last changed.

updatedAt
Type: timestamp (string|DateTime or anything parsable by strtotime)

The timestamp when any field of the issue last changed. Advances on every mutation (including score-only updates that do not transition status), so it is greater than or equal to statusUpdatedAt.

KubernetesClusterRoleConfiguration

Description

Complete configuration for the IAM role Continuum assumes to collect Kubernetes cluster metadata.

Members
externalId
Type: string

Optional external ID Continuum supplies when assuming roleArn. This must match the role trust policy when configured and does not replace the caller's iam:PassRole permission.

roleArn
Required: Yes
Type: string

IAM role the authenticated caller passes to Continuum.

KubernetesClusterRoleUpdate

Description

One complete mutation of the Collector's Kubernetes IAM role configuration.

Members
remove
Type: RemoveKubernetesClusterRole structure

Remove the configured role and external ID.

set

Replace the complete role configuration.

PatchBody

Description

Projected content for a PATCH artifact: the remediation patch for one repository, with the descriptors needed to verify and apply it and the state of its delivery to the customer's own bucket or repository.

Members
delivery
Type: PatchDelivery structure

Delivery of the patch to the customer's bucket or repository. Absent when the artifact has no delivery destination.

format
Type: string

The patch's wire format, read from the patch itself, which determines how to apply it. Absent when the patch starts with neither a git mailbox header nor a diff --git header.

patch
Required: Yes
Type: string

The patch exactly as stored, unmodified. Control Plane accepted it only as a text unified diff, so git apply applies it.

patchSha256
Required: Yes
Type: string

SHA-256 of the patch's UTF-8 bytes in lowercase hex, computed by Control Plane when it stored the patch.

Lets a caller confirm the patch it applies is byte-for-byte the one that was reviewed. Computed over the patch bytes, so it is verifiable against patch without trusting this value.

repositoryName
Type: string

The repository the patch applies to, as named in the source snapshot it was generated against.

sizeBytes
Required: Yes
Type: long (int|float)

Size of the patch in UTF-8 bytes, the unit the digest is computed over.

PatchDelivery

Description

Delivery of a patch to a destination the customer owns: an object in the environment's source bucket or a pull request in the source repository.

Members
status
Required: Yes
Type: string

How far delivery to the destination has progressed.

target
Type: DestinationTarget structure

Where the patch was or will be delivered. Absent while the destination is still being resolved, or when delivery was skipped before a destination was known.

updatedAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

When the delivery status last changed.

PerFindingResult

Description

Validation's result for one finding within a multi-finding bundle.

Members
confidence
Type: double

Confidence in this finding's verdict. Absent when out of range.

exploitArtifact
Type: ValidationExploitArtifact structure

Exploit artifact produced for this finding, when there was one.

exploitable
Required: Yes
Type: string

Exploitability verdict for this finding.

findingId
Required: Yes
Type: string

The finding assessed.

flowVerdicts
Type: Array of FlowVerdict structures

Per-flow verdicts recorded for this finding.

reasoningChain
Type: Array of ReasoningStep structures

Reasoning chain recorded for this finding.

PrevalidationSignal

Description

One producer's conclusion about one subject on one scoring dimension.

Members
computed
Type: SignalComputation structure

The deterministic values the producer computed from its assessment.

conclusion
Type: string

The producer's conclusion.

confidence
Type: double

The producer's confidence in this conclusion, on its native 0-1 scale. Absent when the stored value falls outside 0-1.

confidenceReasoning
Type: SignalConfidenceReasoning structure

Why the producer is or is not sure, kept structured rather than prose.

dimension
Type: string

The axis this signal speaks to. Absent when the producer reported a dimension with no mapping yet.

exploitability
Type: SignalExploitability structure

What validation established about exploitability, on an exploitability signal. This summarizes the verdict the signal was derived from; the proof itself is the VALIDATION_EVIDENCE artifact it cites.

impactDimensions
Type: SignalImpactDimensions structure

The three impact dimensions an impact signal assessed, each with the basis the producer had for it. These are what the computed impact band is derived from.

preconditions
Type: SignalPreconditions structure

The four exploit preconditions a likelihood signal assessed, each with the basis the producer had for it.

producerId
Type: string

Stable name of the producer that emitted this signal.

producerVersion
Type: string

Version of that producer.

signalStrength
Type: string

The signal's own rating. This is an input to scoring and is NOT the finding's severity.

subjectRef
Type: string

What this signal is about, such as a finding or issue reference.

PrevalidationSignalsBody

Description

Projected content for an EVIDENCE artifact carrying prioritization's prevalidation signals.

Members
producedBy
Type: string

The agent that produced this signal set.

signals
Type: Array of PrevalidationSignal structures

The signals backing the Issue's proposed severity.

ProviderConfiguration

Description

Provider-specific configuration for creating an integration. Only one member may be specified.

Members
github
Type: GitHubConfiguration structure

Configuration for a GitHub.com integration.

gitlab
Type: GitLabConfiguration structure

Configuration for a GitLab integration.

s3
Type: S3Configuration structure

Configuration for a customer-managed S3 integration.

ProviderDetails

Description

Provider-specific details for an integration. Only one member will be present.

Members
github
Type: GitHubDetails structure

Details for a GitHub.com integration.

gitlab
Type: GitLabDetails structure

Details for a GitLab integration.

s3
Type: S3Details structure

Public details for a customer-managed S3 integration.

ReasoningStep

Description

One step in the validation agent's reasoning chain.

Members
claim
Required: Yes
Type: string

The claim or conclusion reached at this step.

confidence
Type: double

Confidence in this individual claim, on the producer's native 0-1 scale.

source
Required: Yes
Type: string

Citation supporting the claim.

step
Required: Yes
Type: int

Position of this step in the chain.

RemediationProposalBody

Description

Projected content for a REMEDIATION_PROPOSAL artifact: the patch the remediation agent produced, with the descriptors needed to apply and verify it.

Members
filename
Type: string

Filename the producer suggests for the patch, when it named one.

format
Type: string

The patch's wire format, which determines how to apply it. Absent when the producer recorded a format with no mapping yet.

patch
Required: Yes
Type: string

The patch exactly as the remediation agent produced it, unmodified.

patchSha256
Type: string

SHA-256 of the patch bytes in lowercase hex, as recorded by the producer.

Lets a caller confirm the patch it applies is byte-for-byte the one that was reviewed. Computed over the patch bytes, so it is verifiable against patch without trusting this value.

RemoveKubernetesClusterRole

Description

Empty marker selecting removal in KubernetesClusterRoleUpdate.

Members

ResourceNotFoundException

Description

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.

Members
message
Required: Yes
Type: string

Description of the resource that was not found.

S3Configuration

Description

Configuration for a customer-managed S3 integration.

Members
bucket
Required: Yes
Type: string

Customer-managed source bucket name.

externalId
Required: Yes
Type: string

Caller-provided external ID required by the role trust policy.

roleArn
Required: Yes
Type: string

Role Continuum will assume to read from the source bucket.

S3Details

Description

Public details for a customer-managed S3 integration. The sensitive external ID is intentionally omitted.

Members
bucket
Required: Yes
Type: string

Customer-managed S3 bucket name.

roleArn
Required: Yes
Type: string

IAM role assumed by Continuum to read a customer-managed S3 integration.

S3Target

Description

The S3 object a patch is delivered to.

Members
bucket
Required: Yes
Type: string

Customer-managed S3 bucket name.

key
Required: Yes
Type: string

The object key of the delivered patch.

version
Type: string

The S3 version ID of the delivered object, when the bucket is versioned.

ServiceQuotaExceededException

Description

The request would exceed a service quota. Review your quota and request an increase if needed.

Members
message
Required: Yes
Type: string

Description of the quota that was exceeded.

quotaCode
Type: string

The quota code for the exceeded limit.

serviceCode
Type: string

The service code for the exceeded limit.

SignalAccessPrecondition

Description

The assessed access-level precondition with the basis behind it.

Members
basis
Type: string

Where the producer's determination came from.

missingInfo
Type: string

What the producer could not determine, when anything was missing.

reason
Type: string

The producer's explanation.

value
Type: string

The level of access exploitation requires. Absent when the producer reported a level with no mapping yet.

SignalAttackerGainsDimension

Description

The assessed attacker-gains dimension with the basis behind it.

Members
basis
Type: string

Where the producer's determination came from.

missingInfo
Type: string

What the producer could not determine, when anything was missing.

reason
Type: string

The producer's explanation.

value
Type: string

The capability exploitation grants. Absent when the producer reported a value with no mapping yet.

SignalBlastRadiusDimension

Description

The assessed blast-radius dimension with the basis behind it.

Members
basis
Type: string

Where the producer's determination came from.

missingInfo
Type: string

What the producer could not determine, when anything was missing.

reason
Type: string

The producer's explanation.

value
Type: string

How far the consequences reach. Absent when the producer reported a value with no mapping yet.

SignalComputation

Description

Deterministic values the producer computed from its assessment, as distinct from the assessment itself.

Members
barriers
Type: int

How many of the four exploit preconditions act as barriers (0-4).

impactBand
Type: string

Computed impact band, on an impact signal.

likelihoodBand
Type: string

Computed likelihood band, on a likelihood signal.

SignalConfidenceReasoning

Description

A producer's structured rationale for a signal's confidence.

Members
factors
Type: Array of strings

The individual factors behind it.

summary
Required: Yes
Type: string

One-line rationale.

SignalExploitability

Description

What validation established about exploitability, as summarized onto the scoring signal derived from it.

Members
confidenceTier
Type: string

How strong the evidence behind the verdict is.

highestLayerReached
Type: int

The highest impact layer validation reached, 1-5, as a measure of how far the attack path was walked.

reachedCrownJewels
Type: boolean

Whether validation reached the high-value sink the attack path posited.

A Boolean rather than an enum: the sink was either reached or it was not, and how far the walk got when it was not is already carried, with more precision, by highestLayerReached. An unknown is the absent member.

scriptable
Type: boolean

Whether the proven exploit is automatable rather than one-off.

A Boolean for the same reason as SignalPrecondition.value: validation records a bool, and an unknown is the absent member.

sourceValidationArtifactId
Type: string

The VALIDATION_EVIDENCE artifact on this same issue holding the proof this verdict summarizes. Fetch it with GetCodeIssueArtifact for the full reasoning chain and exploit artifact.

verdict
Type: string

Validation's verdict. UNCERTAIN covers a run that was inconclusive — out of budget, an ambiguous failure, or no decisive layer reached — and is never a refutation.

SignalImpactDimensions

Description

The three impact dimensions an impact signal assessed. The computed impact band is derived from attackerGains and blastRadius, then shifted by targetValue.

Members
attackerGains

What the attacker gains from exploitation.

blastRadius
Type: SignalBlastRadiusDimension structure

How far the consequences reach.

targetValue
Type: SignalTargetValueDimension structure

How valuable the target is, which can shift the band off its base value.

SignalPrecondition

Description

One assessed precondition with the basis behind it.

Members
basis
Type: string

Where the producer's determination came from.

missingInfo
Type: string

What the producer could not determine, when anything was missing.

reason
Type: string

The producer's explanation.

value
Type: boolean

The producer's determination.

A Boolean rather than an enum, against the Common Terms preference for enums on extensibility grounds. The question each precondition answers is closed — is the code reachable, is configuration required, must a user other than the attacker interact — and the only third state, "not determined", is already expressed by omitting this member, which the projection does whenever the stored value is not a bool. An enum would give two ways to say the same thing, while basis and missingInfo already qualify how firm the answer is.

SignalPreconditions

Description

The four preconditions a likelihood signal assessed.

Members
accessLevel
Type: SignalAccessPrecondition structure

What level of access exploitation requires.

configurationNeeded
Type: SignalPrecondition structure

Whether exploitation depends on a non-default configuration.

reachableFromAttacker
Type: SignalPrecondition structure

Whether the vulnerable code path is reachable by an attacker.

userInteractionRequired
Type: SignalPrecondition structure

Whether exploitation requires a user other than the attacker to take part, for example by opening a link or a file (CVSS User Interaction).

SignalTargetValueDimension

Description

The assessed target-value dimension with the basis behind it.

Members
basis
Type: string

Where the producer's determination came from.

missingInfo
Type: string

What the producer could not determine, when anything was missing.

reason
Type: string

The producer's explanation.

value
Type: string

How valuable the target is. Absent when the producer reported a value with no mapping yet.

ThrottlingException

Description

The request was denied due to request throttling.

Members
message
Required: Yes
Type: string

Description of the throttling error.

UpdateCodeConfiguration

Description

Mutable source and operating-policy settings for a code environment.

Members
environmentConfiguration
Type: EnvironmentConfiguration structure

Operating-policy changes. network replaces the environment's network policy; a network without allowedDomains allows no domains. Builds accepted before the change keep the domains they were accepted with. patchCreationPolicy replaces the patch creation policy. scanFrequency updates scan cadence. Omitted members preserve their stored values.

sourceConfiguration

Source changes. s3Sources replaces the environment's S3 source, and repositorySources replaces its repository selections.

UpdateEnvironmentConfiguration

Description

Type-specific changes to an environment. Omitted members preserve stored values.

Members
codeConfiguration
Type: UpdateCodeConfiguration structure

Changes to a code-scanning environment.

UpdateProviderConfiguration

Description

Provider-specific changes for updating an integration. Only S3 integrations can be updated, so S3 is the only member.

Members
s3
Type: UpdateS3Configuration structure

Replacement credentials for a customer-managed S3 integration.

UpdateS3Configuration

Description

Replacement credentials for a customer-managed S3 integration. The bucket cannot be changed.

Members
externalId
Type: string

The replacement external ID used when assuming the supplied role. If omitted, the existing external ID is preserved. This value is sensitive and is never included in the public integration response.

roleArn
Required: Yes
Type: string

The role to use. Supply the current role when rotating only the external ID. The caller must be allowed to pass this exact role to Continuum.

ValidationEvidenceBody

Description

Projected content for a VALIDATION_EVIDENCE artifact: the validation agent's durable proof of exploitability.

Members
attackFlowsConfirmed
Type: Array of strings

Identifiers of attack flows upgraded to Confirmed provenance.

executedProof
Type: ValidationExecutedProof structure

Proof the agent produced by executing code against the repository under test, with the output that execution produced.

exploitArtifact
Type: ValidationExploitArtifact structure

Concrete payload and its observed effect, when validation produced one by sending an HTTP request.

Only an HTTP proof projects here. A validation agent that proves exploitability by RUNNING code against the repository projects executedProof, and one that proves it by reading the source projects sourceAnalysis. All three are mutually exclusive: at most one is present.

exploitable
Required: Yes
Type: string

Exploitability verdict. Explicit UNCERTAIN replaces the producer's tri-state exploitable: true | false | null, so an absent verdict is never confused with a negative one.

flowVerdicts
Type: Array of FlowVerdict structures

One verdict per attack flow assessed in the bundle.

perFindingResults
Type: Array of PerFindingResult structures

Per-finding breakdown for a multi-finding bundle. Absent for a single-finding bundle.

sourceAnalysis
Type: ValidationSourceAnalysis structure

Proof the agent produced by reading the repository's source, with nothing built or run.

terminalStatus
Type: string

How the validation run ended. Absent when the producer reported a status with no mapping yet: the rest of the body still projects, so one unmapped enum never costs a customer the whole artifact.

ValidationException

Members
fieldList
Type: Array of ValidationExceptionField structures
message
Required: Yes
Type: string

ValidationExceptionField

Members
message
Required: Yes
Type: string
path
Required: Yes
Type: string

ValidationExecutedProof

Description

Proof of exploitability the validation agent produced by executing code against the repository under test, with the output that execution produced.

Members
code
Required: Yes
Type: ValidationProofCode structure

The code that was run. Not a request payload: it imports the repository's own modules and drives the vulnerable code path directly.

observedEffect
Type: string

Effect the execution actually produced. observedEffect rather than effect: this one was witnessed, and the name has to stay distinguishable from ValidationSourceAnalysis.inferredEffect, which was not.

output
Type: ValidationProofOutput structure

What the execution printed, including the agent's own PASS/FAIL assertions. Absent when the run printed nothing retained.

ValidationExploitArtifact

Description

A concrete exploit payload and the effect validation observed from it.

Members
effect
Required: Yes
Type: string

Effect observed from sending the payload.

headers
Type: Associative array of custom strings keys (ArtifactCitation) to strings

Headers sent with the payload.

httpMethod
Required: Yes
Type: string

HTTP method the payload was sent with.

payload
Required: Yes
Type: string

The exact payload sent.

responseSnippet
Type: string

Leading portion of the response body, bounded by the producer.

responseStatus
Type: int

HTTP status observed in the response.

targetUrl
Required: Yes
Type: string

Target the payload was sent to.

ValidationProofCode

Description

The executed proof's program. Further members, such as command, workingDirectory and supportingInputs, can be added later as optional details.

Members
proofCode
Required: Yes
Type: Array of ValidationProofMaterial structures

Proof program files, main file first, in their retained order.

ValidationProofMaterial

Description

One proof program file. Further members, such as path and purpose, can be added later as optional details.

Members
content
Required: Yes
Type: string

The file's non-blank text, exactly as retained.

ValidationProofOutput

Description

Retained run output. Further members, such as completion and outputCompleteness, can be added later as optional details.

Members
consoleOutput
Required: Yes
Type: string

What the run printed: standard output and standard error merged, as retained. The text may be empty.

ValidationSourceAnalysis

Description

Proof of exploitability the validation agent produced by reading the repository's source, with nothing built or run. Further members, such as diagram and references, can be added later as optional details.

Members
inferredEffect
Type: string

Effect the agent concluded WOULD occur. Deliberately not effect: nothing was executed, so this is reasoned from the source and must not be read as an observation. See ValidationExecutedProof.observedEffect.

summary
Required: Yes
Type: string

The non-blank analysis as Markdown: the annotated entry-to-sink walk, its citations, and why the checked guards are absent or bypassed.