AWS Continuum 2022-07-26
- Client: Aws\Continuum\ContinuumClient
- Service ID: continuum
- Version: 2022-07-26
This page describes the parameters and results for the operations of the AWS Continuum (2022-07-26), and shows how to use the Aws\Continuum\ContinuumClient object to call the described operations. This documentation is specific to the 2022-07-26 API version of the service.
Operation Summary
Each of the following operations can be created from a client using
$client->getCommand('CommandName'), where "CommandName" is the
name of one of the following operations. Note: a command is a value that
encapsulates an operation and the parameters used to create an HTTP request.
You can also create and send a command immediately using the magic methods
available on a client object: $client->commandName(/* parameters */).
You can send the command asynchronously (returning a promise) by appending the
word "Async" to the operation name: $client->commandNameAsync(/* parameters */).
- AssociateCollector ( array $params = [] )
- Associates one Collector with this Environment and configures the customer role Continuum uses to authorize access to associated Collector data.
- CreateCodeFinding ( array $params = [] )
- Ingests a customer-supplied security finding into an environment.
- CreateCodeScan ( array $params = [] )
- Creates an explicit scan request for one environment.
- CreateCollector ( array $params = [] )
- Creates the Collector for the caller's account.
- CreateEnvironment ( array $params = [] )
- Creates an environment and starts its validation and any requested provisioning.
- CreateIntegration ( array $params = [] )
- Creates a new integration with an external source provider.
- DeleteCollector ( array $params = [] )
- Deletes the Collector for the caller's account.
- DeleteEnvironment ( array $params = [] )
- Deletes an environment and its associated resources.
- DeleteIntegration ( array $params = [] )
- Deletes an integration and releases its name and account quota.
- DisassociateCollector ( array $params = [] )
- Removes one Collector association from this Environment, preserving its other associations.
- GetCodeFinding ( array $params = [] )
- Retrieves the current state and details of a finding.
- GetCodeIssue ( array $params = [] )
- Retrieves the current state and details of an issue.
- GetCodeIssueArtifact ( array $params = [] )
- Retrieves one immutable artifact attached to an issue, including its content.
- GetCodeScan ( array $params = [] )
- Retrieves one customer-visible environment scan.
- GetCollector ( array $params = [] )
- Retrieves the current state of the Collector for the caller's account.
- GetCollectorDataAccessAuthorization ( array $params = [] )
- Authorizes an Environment's access to a Collector's data.
- GetEnvironment ( array $params = [] )
- Retrieves the current state and configuration of an environment.
- GetIntegration ( array $params = [] )
- Retrieves information about an integration.
- GetResourcePolicy ( array $params = [] )
- Retrieves the resource policy attached to a Continuum resource.
- ListAssociatedCollectors ( array $params = [] )
- Lists the Collectors currently associated with one Environment in ascending collectorId order.
- ListAssociatedEnvironments ( array $params = [] )
- Lists the Environments currently associated with one Collector in lexicographically ascending environmentArn order.
- ListCodeFindings ( array $params = [] )
- Lists the findings in an environment in descending findingId order.
- ListCodeIssueArtifacts ( array $params = [] )
- Lists the artifacts attached to an issue in descending artifactId order.
- ListCodeIssues ( array $params = [] )
- Lists the issues in an environment in descending issueId order.
- ListCodeScans ( array $params = [] )
- Lists customer-visible scans for one environment in descending scanRunId order.
- ListCollectors ( array $params = [] )
- Lists the Collectors owned by the authenticated caller's account, including a Collector whose deletion is in progress.
- ListEnvironments ( array $params = [] )
- Lists all environments in your account in descending environmentId order.
- ListIntegrations ( array $params = [] )
- Lists the integrations in your account in descending integrationId order.
- PutResourcePolicy ( array $params = [] )
- Creates or replaces the resource policy attached to a Continuum resource.
- StartIntegrationAuthorization ( array $params = [] )
- Starts an OAuth authorization for a new integration and returns the values the caller sends to the provider's authorization endpoint.
- UpdateCollector ( array $params = [] )
- Updates the customer-controlled mutable properties of a Collector.
- UpdateEnvironment ( array $params = [] )
- Updates the customer-controlled mutable properties of an environment.
- UpdateIntegration ( array $params = [] )
- Rotates the credentials used by an Amazon S3 integration.
Paginators
Paginators handle automatically iterating over paginated API results. Paginators are associated with specific API operations, and they accept the parameters that the corresponding API operation accepts. You can get a paginator from a client class using getPaginator($paginatorName, $operationParameters). This client supports the following paginators:
- ListAssociatedCollectors
- ListAssociatedEnvironments
- ListCodeFindings
- ListCodeIssueArtifacts
- ListCodeIssues
- ListCodeScans
- ListEnvironments
- ListIntegrations
Waiters
Waiters allow you to poll a resource until it enters into a desired state. A waiter has a name used to describe what it does, and is associated with an API operation. When creating a waiter, you can provide the API operation parameters associated with the corresponding operation. Waiters can be accessed using the getWaiter($waiterName, $operationParameters) method of a client object. This client supports the following waiters:
| Waiter name | API Operation | Delay | Max Attempts |
|---|---|---|---|
| CodeScanSucceeded | GetCodeScan | 60 | 480 |
Operations
AssociateCollector
$result = $client->associateCollector([/* ... */]); $promise = $client->associateCollectorAsync([/* ... */]);
Associates one Collector with this Environment and configures the customer role Continuum uses to authorize access to associated Collector data. The caller must have permission on the Environment and permission to pass the role. Continuum assumes the supplied role and calls GetCollectorDataAccessAuthorization on the requested Collector; only a successful authorization response permits the association. The caller does not need Collector data-access permission. The Environment retains its other Collector associations. Calling again with an existing association is safe and does not create a duplicate.
Parameter Syntax
$result = $client->associateCollector([
'clientToken' => '<string>',
'collectorArn' => '<string>', // REQUIRED
'collectorDataAccessRoleArn' => '<string>', // REQUIRED
'environmentId' => '<string>', // REQUIRED
]);
Parameter Details
Members
- clientToken
-
- Type: string
Caller-provided token that makes retried association requests idempotent. The first successful request binds the token to the complete Collector ARN, supplied role, and result for at least 24 hours. During that retry window, reusing it with a different request fails with ConflictException. A matching replay still requires the supplied role to have current Collector access. Once authorized, a matching replay returns the stored result without changing association state. Revocation can deny a replay; it does not remove the stored association or its original result.
- collectorArn
-
- Required: Yes
- Type: string
The ARN of the Collector to associate with this Environment.
- collectorDataAccessRoleArn
-
- Required: Yes
- Type: string
IAM role in the Environment account that Continuum assumes before authorizing access to associated Collector inventory. Every association, including a same-account association, requires this role. The supplied ARN replaces the Environment's previously stored role. The customer is responsible for granting the role access to every Collector that should contribute data.
- environmentId
-
- Required: Yes
- Type: string
The unique identifier of the Environment making the association.
Result Syntax
[
'associatedCollector' => [
'collectorArn' => '<string>',
'collectorId' => '<string>',
],
'environmentArn' => '<string>',
'environmentId' => '<string>',
]
Result Details
Members
- associatedCollector
-
- Required: Yes
- Type: AssociatedCollector structure
The Collector identifier and ARN validated by this operation.
- environmentArn
-
- Required: Yes
- Type: string
The ARN of the Environment making the association.
- environmentId
-
- Required: Yes
- Type: string
The unique identifier of the Environment making the association.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
- ConflictException:
The request could not be completed due to a conflict with the current state of the resource.
CreateCodeFinding
$result = $client->createCodeFinding([/* ... */]); $promise = $client->createCodeFindingAsync([/* ... */]);
Ingests a customer-supplied security finding into an environment. Continuum validates the document synchronously against the required overlay fields for the declared format; invalid documents are rejected with a ValidationException. The maximum accepted document size is 256 KB. The environment must have a source configured, and the finding must identify a code location so Continuum can tie it to a repository in the environment's build. Continuum assigns a findingId and stores the verbatim document. When no successful build yet contains the finding's repository, the finding stays SUBMITTED until the next successful build; if that build does not contain it either, the finding is DISCARDED with discardReason SOURCE_REPO_NOT_FOUND.
Parameter Syntax
$result = $client->createCodeFinding([
'clientToken' => '<string>',
'environmentId' => '<string>', // REQUIRED
'ocsfDocument' => [ // REQUIRED
],
]);
Parameter Details
Members
- clientToken
-
- Type: string
Caller-provided idempotency token. A retry with the same token and an identical finding document replays the original result; the same token with different content is rejected.
- environmentId
-
- Required: Yes
- Type: string
The environment to ingest the finding into.
- ocsfDocument
-
- Required: Yes
- Type: document (null|bool|string|numeric) or an (array|associative array) whose members are all valid documents
The OCSF finding document to ingest, verbatim. Must declare a class_uid Continuum supports (2002 Vulnerability Finding, or 2007 Application Security Posture Finding) and validate against the vendored OCSF JSON Schema for that class, including the Continuum overlay requirements that finding_info.uid be present and that vulnerabilities[0].affected_code[0].file identify the code location. With several repositories in the environment, the file path must begin with the repository name. Maximum size 256 KB. Stored verbatim and normalized into the typed Finding members returned by GetCodeFinding. GetCodeFinding does not return the document itself.
Result Syntax
[
'createdAt' => <DateTime>,
'findingArn' => '<string>',
'findingId' => '<string>',
'status' => 'SUBMITTED|VALIDATING|CONFIRMED|DISCARDED',
'title' => '<string>',
]
Result Details
Members
- createdAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the finding was ingested.
- findingArn
-
- Required: Yes
- Type: string
The ARN of the ingested finding.
- findingId
-
- Required: Yes
- Type: string
The unique identifier assigned to the finding.
- status
-
- Required: Yes
- Type: string
The finding's current lifecycle status -- SUBMITTED for a newly ingested finding, or the finding's present status when an idempotent retry replays an already-processed finding.
- title
-
- Required: Yes
- Type: string
The title extracted from the submitted document. Always populated at ingestion.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
- ConflictException:
The request could not be completed due to a conflict with the current state of the resource.
CreateCodeScan
$result = $client->createCodeScan([/* ... */]); $promise = $client->createCodeScanAsync([/* ... */]);
Creates an explicit scan request for one environment. CP creates durable work before any queue delivery occurs.
Retrying a request that succeeded, with the same clientToken on the same environment, returns the original scan instead of starting another one. Token handling is not yet atomic: requests with the same token that run at the same time, or a retry after a request that failed partway through, can leave an additional scan, which may end in the FAILED state with a message that it was superseded. Deleting the environment makes its tokens unusable; a later request with one of them returns ResourceNotFoundException.
Each environment can have a limited number of scans in progress at the same time. Once that limit is enforced, a request that would exceed it returns ServiceQuotaExceededException; wait for a scan to finish (ListCodeScans shows each scan's status), then retry.
Parameter Syntax
$result = $client->createCodeScan([
'clientToken' => '<string>',
'environmentId' => '<string>', // REQUIRED
]);
Parameter Details
Members
- clientToken
-
- Type: string
An optional token identifying one scan request for this environment. SDKs generate a token when omitted. If a request reaches the service without a token, the service generates one for that request, so each request without a token starts a new scan. To retry a request after a lost response, supply the same token on the same environment; once a request with that token has succeeded, a retry returns the original scan. Concurrent requests with the same token, or a retry after a request that failed partway through, can leave an additional scan, which may end FAILED as superseded. A token is bound to its scan for as long as the service retains the scan's build record, with no shorter expiry. Deleting the environment makes the binding inaccessible: a later request with the token returns ResourceNotFoundException.
- environmentId
-
- Required: Yes
- Type: string
Environment to scan.
Result Syntax
[
'scan' => [
'completedAt' => <DateTime>,
'createdAt' => <DateTime>,
'failureMessage' => '<string>',
'failureStage' => 'SUBMITTED|WAITING_FOR_BUILD|BUILDING|WAITING_FOR_SCAN|SCANNING',
'origin' => 'MANUAL|SCHEDULED',
'scanRunId' => '<string>',
'status' => 'SUBMITTED|WAITING_FOR_BUILD|BUILDING|WAITING_FOR_SCAN|SCANNING|SUCCEEDED|FAILED',
],
]
Result Details
Members
- scan
-
- Required: Yes
- Type: CodeScanSummary structure
The scan run this request created, or the scan run a previous request with the same clientToken already accepted.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
- ConflictException:
The request could not be completed due to a conflict with the current state of the resource.
- ServiceQuotaExceededException:
The request would exceed a service quota. Review your quota and request an increase if needed.
CreateCollector
$result = $client->createCollector([/* ... */]); $promise = $client->createCollectorAsync([/* ... */]);
Creates the Collector for the caller's account. Provisions an AWS Config service-linked recorder using the caller's federated access session and begins recording infrastructure changes.
Parameter Syntax
$result = $client->createCollector([
'clientToken' => '<string>',
'kubernetesClusterRole' => [
'externalId' => '<string>',
'roleArn' => '<string>', // REQUIRED
],
'type' => 'AWS_COLLECTOR',
]);
Parameter Details
Members
- clientToken
-
- Type: string
Caller-provided token that makes retried create requests return the original Collector rather than creating a duplicate.
- kubernetesClusterRole
-
- Type: KubernetesClusterRoleConfiguration structure
IAM role configuration used to collect Kubernetes cluster metadata. The authenticated caller must be allowed to pass its exact roleArn to Continuum.
- type
-
- Type: string
Source to collect. Defaults to AWS_COLLECTOR when omitted.
Result Syntax
[
'collectorArn' => '<string>',
'collectorId' => '<string>',
'createdAt' => <DateTime>,
'status' => 'ACTIVE|PENDING_DELETION',
'type' => 'AWS_COLLECTOR',
]
Result Details
Members
- collectorArn
-
- Required: Yes
- Type: string
The ARN of the created Collector.
- collectorId
-
- Required: Yes
- Type: string
The unique identifier assigned to the Collector.
- createdAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the Collector was created.
- status
-
- Required: Yes
- Type: string
The current lifecycle status.
- type
-
- Required: Yes
- Type: string
The source collected by this Collector.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
- ConflictException:
The request could not be completed due to a conflict with the current state of the resource.
- ServiceQuotaExceededException:
The request would exceed a service quota. Review your quota and request an increase if needed.
CreateEnvironment
$result = $client->createEnvironment([/* ... */]); $promise = $client->createEnvironmentAsync([/* ... */]);
Creates an environment and starts its validation and any requested provisioning. Storage provisioning and dependency checks may continue after the initial 201 response; use GetEnvironment to observe completion.
Parameter Syntax
$result = $client->createEnvironment([
'configuration' => [
'codeConfiguration' => [
'environmentConfiguration' => [
'network' => [
'allowedDomains' => ['<string>', ...],
],
'patchCreationPolicy' => 'ENABLED|DISABLED',
'scanFrequency' => '<string>',
],
'sourceConfiguration' => [
'repositorySources' => [
[
'defaultBranch' => '<string>',
'integrationId' => '<string>', // REQUIRED
'repository' => '<string>', // REQUIRED
],
// ...
],
's3Sources' => [
[
'codePrefix' => '<string>',
'contextPrefix' => '<string>',
'integrationId' => '<string>', // REQUIRED
],
// ...
],
],
],
],
'name' => '<string>', // REQUIRED
]);
Parameter Details
Members
- configuration
-
- Type: CreateEnvironmentConfiguration structure
Type-specific configuration. Omission creates a code environment with the default operating policy and no sources.
- name
-
- Required: Yes
- Type: string
The customer-visible name of the environment.
Result Syntax
[
'createdAt' => <DateTime>,
'environmentArn' => '<string>',
'environmentId' => '<string>',
'status' => 'ACTIVE',
]
Result Details
Members
- createdAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the environment was created.
- environmentArn
-
- Required: Yes
- Type: string
The ARN of the created environment.
- environmentId
-
- Required: Yes
- Type: string
The unique identifier assigned to the environment.
- status
-
- Required: Yes
- Type: string
The initial status of the environment. Always ACTIVE on successful creation.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
- ConflictException:
The request could not be completed due to a conflict with the current state of the resource.
- ServiceQuotaExceededException:
The request would exceed a service quota. Review your quota and request an increase if needed.
CreateIntegration
$result = $client->createIntegration([/* ... */]); $promise = $client->createIntegrationAsync([/* ... */]);
Creates a new integration with an external source provider. Repeating an identical request with the same clientToken returns the original integrationId, integrationArn, and createdAt. Token records are retained for eight hours after success or terminal failure, including after the integration is deleted; replaying a deleted integration's token does not recreate it. An identical request with a retained terminal failure returns the recorded error.
Reusing a token with different parameters returns ValidationException. A fresh token starts a new create attempt; if the name is already owned by another integration, ConflictException includes that integration's identifier. An attempt still in progress may return ThrottlingException with retryAfterSeconds set to 1; retry with the same token and identical parameters.
GitHub authorization codes are single use. Retry an unresolved attempt with its original token and unchanged parameters first. If the service reports a terminal failure, an expired attempt, or a successful token exchange whose integration could not be saved, restart GitHub authorization with a fresh token and authorization code. The service does not checkpoint provider results for recovery by another request.
Parameter Syntax
$result = $client->createIntegration([
'clientToken' => '<string>',
'name' => '<string>', // REQUIRED
'providerConfiguration' => [ // REQUIRED
'github' => [
'authorization' => [ // REQUIRED
'authorizationCode' => '<string>', // REQUIRED
'redirectUrl' => '<string>',
'state' => '<string>', // REQUIRED
],
'organizationName' => '<string>',
],
'gitlab' => [
'accessToken' => '<string>', // REQUIRED
'instanceUrl' => '<string>', // REQUIRED
'targetPath' => '<string>', // REQUIRED
'targetType' => 'GROUP|PROJECT', // REQUIRED
],
's3' => [
'bucket' => '<string>', // REQUIRED
'externalId' => '<string>', // REQUIRED
'roleArn' => '<string>', // REQUIRED
],
],
]);
Parameter Details
Members
- clientToken
-
- Type: string
An optional token identifying one create attempt within the caller's account, Region, and operation. SDKs generate a token when omitted. If a request reaches the service without a token, the service generates one for that request. Each request without a token starts a new attempt. To replay an attempt, supply the same token and identical input. Authorized users and roles in the same account can retry an attempt this way. Token records are retained for eight hours after success or terminal failure, including after deletion of a successfully created integration. Different input with the same token returns ValidationException.
- name
-
- Required: Yes
- Type: string
The name for the integration.
- providerConfiguration
-
- Required: Yes
- Type: ProviderConfiguration structure
The provider-specific configuration required to create the integration. Only one member may be specified.
Result Syntax
[
'createdAt' => <DateTime>,
'integrationArn' => '<string>',
'integrationId' => '<string>',
]
Result Details
Members
- createdAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the integration was created.
- integrationArn
-
- Required: Yes
- Type: string
The ARN of the created integration.
- integrationId
-
- Required: Yes
- Type: string
The unique identifier of the created integration.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
- ConflictException:
The request could not be completed due to a conflict with the current state of the resource.
- ServiceQuotaExceededException:
The request would exceed a service quota. Review your quota and request an increase if needed.
DeleteCollector
$result = $client->deleteCollector([/* ... */]); $promise = $client->deleteCollectorAsync([/* ... */]);
Deletes the Collector for the caller's account. The Collector first enters PENDING_DELETION, then the service removes its schedule, AWS Config service-linked recorder, versioned S3 bucket, KMS key, and persisted record.
Parameter Syntax
$result = $client->deleteCollector([
'collectorId' => '<string>', // REQUIRED
]);
Parameter Details
Members
- collectorId
-
- Required: Yes
- Type: string
The unique identifier of the Collector to delete.
Result Syntax
[]
Result Details
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
- ConflictException:
The request could not be completed due to a conflict with the current state of the resource.
DeleteEnvironment
$result = $client->deleteEnvironment([/* ... */]); $promise = $client->deleteEnvironmentAsync([/* ... */]);
Deletes an environment and its associated resources.
Parameter Syntax
$result = $client->deleteEnvironment([
'environmentId' => '<string>', // REQUIRED
]);
Parameter Details
Members
- environmentId
-
- Required: Yes
- Type: string
The unique identifier of the environment to delete.
Result Syntax
[]
Result Details
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
- ConflictException:
The request could not be completed due to a conflict with the current state of the resource.
DeleteIntegration
$result = $client->deleteIntegration([/* ... */]); $promise = $client->deleteIntegrationAsync([/* ... */]);
Deletes an integration and releases its name and account quota. Its retained CreateIntegration token receipt can still replay the original result without recreating the integration. Shared provider registrations are retained: deleting one integration does not remove provider access used by another integration. A fresh GitHub CreateIntegration attempt requires a fresh OAuth authorization code and a new clientToken.
Parameter Syntax
$result = $client->deleteIntegration([
'integrationId' => '<string>', // REQUIRED
]);
Parameter Details
Members
- integrationId
-
- Required: Yes
- Type: string
The unique identifier of the integration to delete.
Result Syntax
[]
Result Details
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
- ConflictException:
The request could not be completed due to a conflict with the current state of the resource.
DisassociateCollector
$result = $client->disassociateCollector([/* ... */]); $promise = $client->disassociateCollectorAsync([/* ... */]);
Removes one Collector association from this Environment, preserving its other associations. The stored Collector data-access role is cleared when no Collector associations remain. The Environment owner must have permission to disassociate. A current Collector access grant is not required, and the Collector does not need to remain active or present, so stale or revoked associations can be cleaned up.
Parameter Syntax
$result = $client->disassociateCollector([
'collectorArn' => '<string>', // REQUIRED
'environmentId' => '<string>', // REQUIRED
]);
Parameter Details
Members
- collectorArn
-
- Required: Yes
- Type: string
The ARN of the Collector to disassociate from this Environment.
- environmentId
-
- Required: Yes
- Type: string
The unique identifier of the Environment whose associations are updated.
Result Syntax
[]
Result Details
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
- ConflictException:
The request could not be completed due to a conflict with the current state of the resource.
GetCodeFinding
$result = $client->getCodeFinding([/* ... */]); $promise = $client->getCodeFindingAsync([/* ... */]);
Retrieves the current state and details of a finding.
Parameter Syntax
$result = $client->getCodeFinding([
'environmentId' => '<string>', // REQUIRED
'findingId' => '<string>', // REQUIRED
]);
Parameter Details
Members
- environmentId
-
- Required: Yes
- Type: string
The environment that owns the finding.
- findingId
-
- Required: Yes
- Type: string
The unique identifier of the finding to retrieve.
Result Syntax
[
'affectedPackages' => [
[
'fixedInVersion' => '<string>',
'name' => '<string>',
'packageManager' => '<string>',
'version' => '<string>',
],
// ...
],
'category' => '<string>',
'completedAt' => <DateTime>,
'createdAt' => <DateTime>,
'createdIssueId' => '<string>',
'cveId' => '<string>',
'cvssBaseScore' => <float>,
'cweIds' => ['<string>', ...],
'detailedDescription' => '<string>',
'discardReason' => 'SCANNER_VALIDATED_FALSE_POSITIVE|SCANNER_NEEDS_REVIEW|FALSE_POSITIVE_VALIDATED_AGAINST_CONTEXT|DUPLICATE_OF_OPEN_ISSUE|DUPLICATE_OF_CLOSED_ISSUE|COMPENSATING_CONTROL_PRESENT|OUT_OF_SCOPE|INSUFFICIENT_EVIDENCE|PROCESSING_FAILED|SOURCE_REPO_NOT_FOUND',
'discardReasoning' => '<string>',
'duplicateOfIssueId' => '<string>',
'endLine' => <integer>,
'environmentId' => '<string>',
'filePath' => '<string>',
'findingArn' => '<string>',
'findingId' => '<string>',
'findingTypes' => ['<string>', ...],
'firstSeenAt' => <DateTime>,
'lineNumber' => <integer>,
'mitigation' => '<string>',
'mitreTechniques' => ['<string>', ...],
'ocsfClass' => 'VULNERABILITY_FINDING|APPLICATION_SECURITY_POSTURE_FINDING',
'ocsfSchemaVersion' => '<string>',
'owaspCategory' => '<string>',
'posture' => [
'application' => '<string>',
'applicationUid' => '<string>',
'applicationVersion' => '<string>',
'checks' => [
[
'description' => '<string>',
'name' => '<string>',
'uid' => '<string>',
],
// ...
],
'control' => '<string>',
'description' => '<string>',
'remediation' => '<string>',
'remediationReferences' => ['<string>', ...],
'requirements' => ['<string>', ...],
'standards' => ['<string>', ...],
'status' => '<string>',
'statusId' => <integer>,
],
'productName' => '<string>',
'productVendorName' => '<string>',
'productVersion' => '<string>',
'relevantInputs' => ['<string>', ...],
'remediationReferences' => ['<string>', ...],
'reportedAt' => <DateTime>,
'resources' => [
[
'name' => '<string>',
'region' => '<string>',
'type' => '<string>',
'uid' => '<string>',
],
// ...
],
'scanRunId' => '<string>',
'severity' => 'UNKNOWN|INFORMATIONAL|LOW|MEDIUM|HIGH|CRITICAL|FATAL|OTHER',
'source' => '<string>',
'sourceFindingId' => '<string>',
'sourceStatus' => '<string>',
'sourceStatusId' => <integer>,
'status' => 'SUBMITTED|VALIDATING|CONFIRMED|DISCARDED',
'statusMessage' => '<string>',
'statusUpdatedAt' => <DateTime>,
'stepsToReproduce' => ['<string>', ...],
'subCategory' => '<string>',
'summary' => '<string>',
'title' => '<string>',
'type' => 'CONTINUUM_CODE_VULN|CUSTOMER_CODE_VULN',
'validation' => [
'blockingReason' => 'UNREACHABLE|PROTECTED|MISCLASSIFIED|EXCLUDED|NOT_FEASIBLE|RISK_MITIGATED|NONE',
'confidence' => <float>,
'evidence' => [
[
'file' => '<string>',
'line' => <integer>,
'snippet' => '<string>',
],
// ...
],
'mitigatingControls' => ['<string>', ...],
'preconditions' => ['<string>', ...],
'rationale' => '<string>',
'severityAdjustment' => 'CRITICAL|HIGH|MEDIUM|LOW|INFORMATIONAL|UNCHANGED',
'verdict' => 'TRUE_POSITIVE|FALSE_POSITIVE|BENIGN_TRUE_POSITIVE|NEEDS_REVIEW',
],
'vulnerabilities' => [
[
'additionalCweIds' => ['<string>', ...],
'affectedPackages' => [
[
'fixedInVersion' => '<string>',
'name' => '<string>',
'packageManager' => '<string>',
'version' => '<string>',
],
// ...
],
'code' => '<string>',
'cveId' => '<string>',
'cvssBaseScore' => <float>,
'cweCaption' => '<string>',
'cweId' => '<string>',
'description' => '<string>',
'details' => '<string>',
'fixCoverage' => '<string>',
'fixCoverageId' => <integer>,
'locations' => [
[
'endLine' => <integer>,
'filePath' => '<string>',
'startLine' => <integer>,
],
// ...
],
'remediation' => '<string>',
'remediationReferences' => ['<string>', ...],
'title' => '<string>',
],
// ...
],
'vulnerableCode' => '<string>',
]
Result Details
Members
- affectedPackages
-
- Type: Array of AffectedPackage structures
Packages implicated by the finding.
- category
-
- Type: string
The producer's vulnerability category. Not a stable filter key across finding types -- see FindingCategory.
- completedAt
-
- Type: timestamp (string|DateTime or anything parsable by strtotime)
When processing finished, whether by creating an issue or discarding. Absent while the finding is still in flight.
- createdAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the finding was ingested.
- createdIssueId
-
- Type: string
The issue Continuum created from this finding.
- cveId
-
- Type: string
The CVE this finding reports, for software-composition findings. Both code types can carry one: a customer document supplies it under vulnerabilities[].cve, and Continuum's scanner reports CVEs for dependency-manifest findings.
- cvssBaseScore
-
- Type: double
The CVSS base score accompanying
cveId, when the producer supplies one, from 0.0 to 10.0. Not computed by Continuum. The range is enforced server-side, not by a @range trait -- the smithy-rs server SDK does not support range constraints on double shapes (smithy-rs#2007). - cweIds
-
- Type: Array of strings
CWE identifiers classifying the finding.
- detailedDescription
-
- Type: string
The full analysis.
- discardReason
-
- Type: string
Why the finding was not escalated. Present only when status is DISCARDED.
- discardReasoning
-
- Type: string
Customer-facing explanation accompanying
discardReason. - duplicateOfIssueId
-
- Type: string
The existing issue this finding duplicates. Present only for the DUPLICATE_OF_* discard reasons.
- endLine
-
- Type: int
The last line of the affected range, from the document's affected_code[].end_line.
- environmentId
-
- Required: Yes
- Type: string
The environment that owns the finding.
- filePath
-
- Type: string
The file the finding is about.
- findingArn
-
- Required: Yes
- Type: string
The ARN of the finding.
- findingId
-
- Required: Yes
- Type: string
The unique identifier of the finding.
- findingTypes
-
- Type: Array of strings
The producer's own classification of the finding (finding_info.types).
- firstSeenAt
-
- Type: timestamp (string|DateTime or anything parsable by strtotime)
When the producer first observed the finding (finding_info.first_seen_time). The producer's own clock, not Continuum's.
- lineNumber
-
- Type: int
The 1-indexed line the finding is about. Bounds are enforced server-side rather than by a constraint trait: a numeric constraint generates a distinct newtype per enclosing structure, so the same concept would not share a type across the create input and the read output.
- mitigation
-
- Type: string
How to fix the finding.
- mitreTechniques
-
- Type: Array of strings
MITRE ATT&CK technique identifiers, from the document's finding_info.attacks[].technique.uid.
- ocsfClass
-
- Type: string
The OCSF class the document declared. Determines whether
postureis populated. - ocsfSchemaVersion
-
- Type: string
The OCSF schema version the producer wrote against (metadata.version).
- owaspCategory
-
- Type: string
The OWASP Top 10 category, when the producer supplies one.
- posture
-
- Type: FindingPosture structure
The compliance posture, for an Application Security Posture Finding. Absent for a vulnerability finding.
- productName
-
- Type: string
The producing product and vendor (metadata.product).
- productVendorName
-
- Type: string
A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use
cweIdswhen a stable classification is needed. - productVersion
-
- Type: string
A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use
cweIdswhen a stable classification is needed. - relevantInputs
-
- Type: Array of strings
User-controlled inputs that reach the vulnerability.
- remediationReferences
-
- Type: Array of strings
Remediation references, from the document's vulnerabilities[].remediation.references.
- reportedAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
When the producer reported the finding -- its own clock, which is not Continuum's ingestion time.
createdAtis when Continuum accepted it; these are genuinely different instants and a reader usually wants this one.For CreateCodeFinding, this is the submitted OCSF document's own top-level
time. For findings Continuum's scanner produces, it is the finding's own creation time.Continuum does not validate it for plausibility: a producer's value is echoed as given, so a
timestamphere asserts the unit and format, not that the instant is genuine. - resources
-
- Type: Array of FindingResource structures
Resources the document named (resources[]).
- scanRunId
-
- Type: string
The scan that produced the finding, when it came from one. For a finding Continuum's scanner produced, this is the Continuum scan run (see GetCodeScan). For a finding submitted with CreateCodeFinding, it is the OCSF document's
metadata.correlation_uid, when that value is a valid ScanRunId. Absent when the finding did not come from a scan. - severity
-
- Required: Yes
- Type: string
The finding's severity.
- source
-
- Required: Yes
- Type: string
The system that produced the finding.
- sourceFindingId
-
- Required: Yes
- Type: string
The producer's own identifier for the finding.
- sourceStatus
-
- Type: string
The producer's own status for the finding, and the enum value behind it. Distinct from
status, which is Continuum's lifecycle state -- a producer may call a finding "New" while Continuum has it SUBMITTED. - sourceStatusId
-
- Type: int
The producer's numeric enum value for
sourceStatus. - status
-
- Required: Yes
- Type: string
The current lifecycle status of the finding.
- statusMessage
-
- Type: string
Human-readable context about the current status.
- statusUpdatedAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the status last transitioned.
- stepsToReproduce
-
- Type: Array of strings
Steps to reproduce or exploit the finding.
- subCategory
-
- Type: string
A more specific classification within
category. - summary
-
- Type: string
A one-paragraph description.
- title
-
- Required: Yes
- Type: string
The producer's title for the finding.
- type
-
- Required: Yes
- Type: string
What kind of finding this is. Determines which of the type-specific members below are populated.
- validation
-
- Type: FindingValidation structure
The validator's assessment. Absent when no validation ran.
- vulnerabilities
-
- Type: Array of FindingVulnerability structures
Every vulnerability the document reported. A document may report several; the flat
cveId/cvssBaseScore/filePath/lineNumbermembers above carry the first one's identity so a caller that only needs "what and where" does not have to walk this list. - vulnerableCode
-
- Type: string
The vulnerable code fragment.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
GetCodeIssue
$result = $client->getCodeIssue([/* ... */]); $promise = $client->getCodeIssueAsync([/* ... */]);
Retrieves the current state and details of an issue.
Parameter Syntax
$result = $client->getCodeIssue([
'environmentId' => '<string>', // REQUIRED
'issueId' => '<string>', // REQUIRED
]);
Parameter Details
Members
- environmentId
-
- Required: Yes
- Type: string
The environment that owns the issue.
- issueId
-
- Required: Yes
- Type: string
The unique identifier of the issue to retrieve.
Result Syntax
[
'confidence' => <integer>,
'createdAt' => <DateTime>,
'evidenceAvailability' => 'NONE|AVAILABLE',
'findingIds' => ['<string>', ...],
'issueArn' => '<string>',
'issueId' => '<string>',
'name' => '<string>',
'patchDelivery' => [
'failedCount' => <integer>,
'failureReasons' => ['<string>', ...],
'patchCount' => <integer>,
'status' => 'PENDING|SUCCEEDED|FAILED|SKIPPED',
'succeededCount' => <integer>,
],
'phase' => 'VALIDATION|PRIORITIZATION|REMEDIATION',
'severity' => 'LOW|MEDIUM|HIGH|CRITICAL',
'severityReasoning' => '<string>',
'status' => 'CREATED|IN_PROGRESS|COMPLETED|FAILED',
'statusMessage' => '<string>',
'statusReason' => 'INTERNAL_ERROR|REMEDIATION_FAILED',
'statusUpdatedAt' => <DateTime>,
'summary' => '<string>',
'synopsis' => '<string>',
'updatedAt' => <DateTime>,
]
Result Details
Members
- confidence
-
- Type: int
The likelihood that this issue is a true positive, expressed as a percentage (0-100).
- createdAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the issue was created.
- evidenceAvailability
-
- Type: string
Whether the issue has any attached evidence (formerly 'artifacts': tool output, remediation proposals, patches). NONE = no evidence; AVAILABLE = at least one evidence item exists. Computed at read time.
- findingIds
-
- Required: Yes
- Type: Array of strings
The findings that motivated this issue. Bare identifiers only -- a caller authorized for GetCodeIssue is not necessarily authorized to read finding detail; call GetCodeFinding for that. Every referenced finding is included regardless of origin (both CustomerUploaded and ContinuumScanner).
- issueArn
-
- Required: Yes
- Type: string
The ARN of the issue.
- issueId
-
- Required: Yes
- Type: string
The unique identifier of the issue.
- name
-
- Required: Yes
- Type: string
The name of the issue.
- patchDelivery
-
- Type: IssuePatchDelivery structure
Customer delivery of the issue's patches, summarized from its PATCH artifacts at read time. Absent when no patch has a destination delivery.
- phase
-
- Type: string
The part of the workflow the issue is in. Present when status is IN_PROGRESS, and when status is FAILED and the failing phase is known.
- severity
-
- Type: string
Current severity: the FindingSeverity seed at create, overwritten by the authoritative severity that prioritization assigns after validation.
- severityReasoning
-
- Type: string
The justification for the current severity. Always leads with a customer-facing basis clause synthesized from how the severity was determined (e.g. "Severity from finding.", "Severity from Continuum system."); when prioritization has run, its own reasoning follows. Issues created before the basis clause was introduced return their original reasoning without it.
- status
-
- Required: Yes
- Type: string
The current lifecycle status of the issue.
- statusMessage
-
- Type: string
Customer-facing explanation of statusReason. Present only when status is FAILED.
- statusReason
-
- Type: string
Why the issue failed. Present only when status is FAILED.
- statusUpdatedAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the status or phase last changed.
- summary
-
- Type: string
The remediation completion summary, when the green stage has run.
- synopsis
-
- Required: Yes
- Type: string
A free-form synopsis of the issue.
- updatedAt
-
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when any field of the issue last changed. Advances on every mutation (including score-only updates that do not transition status), so it is greater than or equal to statusUpdatedAt.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
GetCodeIssueArtifact
$result = $client->getCodeIssueArtifact([/* ... */]); $promise = $client->getCodeIssueArtifactAsync([/* ... */]);
Retrieves one immutable artifact attached to an issue, including its content.
Parameter Syntax
$result = $client->getCodeIssueArtifact([
'artifactId' => '<string>', // REQUIRED
'environmentId' => '<string>', // REQUIRED
'issueId' => '<string>', // REQUIRED
]);
Parameter Details
Members
- artifactId
-
- Required: Yes
- Type: string
The unique identifier of the artifact to retrieve.
- environmentId
-
- Required: Yes
- Type: string
The environment that owns the issue.
- issueId
-
- Required: Yes
- Type: string
The issue the artifact is attached to.
Result Syntax
[
'artifactId' => '<string>',
'artifactType' => 'EVIDENCE|AGENT_COMMUNICATION|VALIDATION_EVIDENCE|REMEDIATION_PROPOSAL|DECISION|PATCH',
'body' => [
'patch' => [
'delivery' => [
'status' => 'PENDING|SUCCEEDED|FAILED|SKIPPED|ABANDONED',
'target' => [
'github' => [
'headSha' => '<string>',
'owner' => '<string>',
'pullRequestNumber' => <integer>,
'repository' => '<string>',
],
's3' => [
'bucket' => '<string>',
'key' => '<string>',
'version' => '<string>',
],
],
'updatedAt' => <DateTime>,
],
'format' => 'GIT_MAILBOX_PATCH|GIT_BINARY_DIFF|GIT_DIFF',
'patch' => '<string>',
'patchSha256' => '<string>',
'repositoryName' => '<string>',
'sizeBytes' => <integer>,
],
'prevalidationSignals' => [
'producedBy' => '<string>',
'signals' => [
[
'computed' => [
'barriers' => <integer>,
'impactBand' => 'VERY_LOW|LOW|MODERATE|HIGH',
'likelihoodBand' => 'VERY_LOW|LOW|MODERATE|HIGH',
],
'conclusion' => '<string>',
'confidence' => <float>,
'confidenceReasoning' => [
'factors' => ['<string>', ...],
'summary' => '<string>',
],
'dimension' => 'EXPLOITABILITY|BLAST_RADIUS|NETWORK_EXPOSURE|PRECONDITION|CODE_CONTEXT|LIKELIHOOD_ASSESSMENT|IMPACT_ASSESSMENT',
'exploitability' => [
'confidenceTier' => 'SOURCE_READ|STATIC_PROVEN|BUILD_PROVEN|RUNTIME_PROVEN',
'highestLayerReached' => <integer>,
'reachedCrownJewels' => true || false,
'scriptable' => true || false,
'sourceValidationArtifactId' => '<string>',
'verdict' => 'EXPLOITABLE|NOT_EXPLOITABLE|UNCERTAIN',
],
'impactDimensions' => [
'attackerGains' => [
'basis' => 'CODE|GRAPH|FINDING|INFERRED|NO_EVIDENCE_DEFAULT',
'missingInfo' => '<string>',
'reason' => '<string>',
'value' => 'EXECUTE|MODIFY_PRIVILEGED|MODIFY_DATA|MODIFY_COSMETIC|READ|NEITHER',
],
'blastRadius' => [
'basis' => 'CODE|GRAPH|FINDING|INFERRED|NO_EVIDENCE_DEFAULT',
'missingInfo' => '<string>',
'reason' => '<string>',
'value' => 'CROSS_TENANT|OTHER_USERS_IN_TENANT|OWN_SCOPE',
],
'targetValue' => [
'basis' => 'CODE|GRAPH|FINDING|INFERRED|NO_EVIDENCE_DEFAULT',
'missingInfo' => '<string>',
'reason' => '<string>',
'value' => 'HIGH|MEDIUM|LOW',
],
],
'preconditions' => [
'accessLevel' => [
'basis' => 'CODE|GRAPH|FINDING|INFERRED|NO_EVIDENCE_DEFAULT',
'missingInfo' => '<string>',
'reason' => '<string>',
'value' => 'NONE|ANY_AUTHENTICATED|PRIVILEGED',
],
'configurationNeeded' => [
'basis' => 'CODE|GRAPH|FINDING|INFERRED|NO_EVIDENCE_DEFAULT',
'missingInfo' => '<string>',
'reason' => '<string>',
'value' => true || false,
],
'reachableFromAttacker' => [
'basis' => 'CODE|GRAPH|FINDING|INFERRED|NO_EVIDENCE_DEFAULT',
'missingInfo' => '<string>',
'reason' => '<string>',
'value' => true || false,
],
'userInteractionRequired' => [
'basis' => 'CODE|GRAPH|FINDING|INFERRED|NO_EVIDENCE_DEFAULT',
'missingInfo' => '<string>',
'reason' => '<string>',
'value' => true || false,
],
],
'producerId' => '<string>',
'producerVersion' => '<string>',
'signalStrength' => 'NONE|WEAK|MODERATE|STRONG',
'subjectRef' => '<string>',
],
// ...
],
],
'raw' => '<string>',
'remediationProposal' => [
'filename' => '<string>',
'format' => 'GIT_MAILBOX_PATCH|GIT_BINARY_DIFF|GIT_DIFF',
'patch' => '<string>',
'patchSha256' => '<string>',
],
'validationEvidence' => [
'attackFlowsConfirmed' => ['<string>', ...],
'executedProof' => [
'code' => [
'proofCode' => [
[
'content' => '<string>',
],
// ...
],
],
'observedEffect' => 'DATA_LEAKED|ERROR_REVEALED|BEHAVIOR_CHANGED|NO_EFFECT',
'output' => [
'consoleOutput' => '<string>',
],
],
'exploitArtifact' => [
'effect' => 'DATA_LEAKED|ERROR_REVEALED|BEHAVIOR_CHANGED|NO_EFFECT',
'headers' => ['<string>', ...],
'httpMethod' => 'GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS',
'payload' => '<string>',
'responseSnippet' => '<string>',
'responseStatus' => <integer>,
'targetUrl' => '<string>',
],
'exploitable' => 'EXPLOITABLE|NOT_EXPLOITABLE|UNCERTAIN',
'flowVerdicts' => [
[
'confidence' => <float>,
'evidence' => ['<string>', ...],
'flowId' => '<string>',
'verdict' => 'CONFIRMED|DENIED|INCONCLUSIVE',
],
// ...
],
'perFindingResults' => [
[
'confidence' => <float>,
'exploitArtifact' => [
'effect' => 'DATA_LEAKED|ERROR_REVEALED|BEHAVIOR_CHANGED|NO_EFFECT',
'headers' => ['<string>', ...],
'httpMethod' => 'GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS',
'payload' => '<string>',
'responseSnippet' => '<string>',
'responseStatus' => <integer>,
'targetUrl' => '<string>',
],
'exploitable' => 'EXPLOITABLE|NOT_EXPLOITABLE|UNCERTAIN',
'findingId' => '<string>',
'flowVerdicts' => [
[
'confidence' => <float>,
'evidence' => ['<string>', ...],
'flowId' => '<string>',
'verdict' => 'CONFIRMED|DENIED|INCONCLUSIVE',
],
// ...
],
'reasoningChain' => [
[
'claim' => '<string>',
'confidence' => <float>,
'source' => '<string>',
'step' => <integer>,
],
// ...
],
],
// ...
],
'sourceAnalysis' => [
'inferredEffect' => 'DATA_LEAKED|ERROR_REVEALED|BEHAVIOR_CHANGED|NO_EFFECT',
'summary' => '<string>',
],
'terminalStatus' => 'COMPLETED|FAILED|NO_SOURCE_AVAILABLE|PARTIAL',
],
],
'createdAt' => <DateTime>,
'mediaType' => '<string>',
'metadata' => [
],
'producer' => [
'agent' => '<string>',
],
]
Result Details
Members
- artifactId
-
- Required: Yes
- Type: string
The unique identifier of the artifact.
- artifactType
-
- Required: Yes
- Type: string
Semantic category of the artifact.
- body
-
- Required: Yes
- Type: IssueArtifactBody structure
The artifact body, projected against the shape defined for its artifactType. A type with a defined shape is returned as that structure, and anything else through
IssueArtifactBody.raw. - createdAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the artifact was created.
- mediaType
-
- Required: Yes
- Type: string
MIME type the producer declared for its content.
- metadata
-
- Type: document (null|bool|string|numeric) or an (array|associative array) whose members are all valid documents
Producer-defined structured metadata, when the producer supplied any.
Returned only for an artifactType whose content has no defined shape, so that the artifact stays inspectable. For an artifactType with a defined shape,
bodycarries the content and this member is omitted. - producer
-
- Required: Yes
- Type: IssueArtifactProducerSummary structure
The agent that produced the artifact.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
GetCodeScan
$result = $client->getCodeScan([/* ... */]); $promise = $client->getCodeScanAsync([/* ... */]);
Retrieves one customer-visible environment scan.
Parameter Syntax
$result = $client->getCodeScan([
'environmentId' => '<string>', // REQUIRED
'scanRunId' => '<string>', // REQUIRED
]);
Parameter Details
Members
- environmentId
-
- Required: Yes
- Type: string
Environment that owns the scan.
- scanRunId
-
- Required: Yes
- Type: string
Scan to retrieve.
Result Syntax
[
'scan' => [
'completedAt' => <DateTime>,
'createdAt' => <DateTime>,
'failureMessage' => '<string>',
'failureStage' => 'SUBMITTED|WAITING_FOR_BUILD|BUILDING|WAITING_FOR_SCAN|SCANNING',
'origin' => 'MANUAL|SCHEDULED',
'scanRunId' => '<string>',
'status' => 'SUBMITTED|WAITING_FOR_BUILD|BUILDING|WAITING_FOR_SCAN|SCANNING|SUCCEEDED|FAILED',
],
]
Result Details
Members
- scan
-
- Required: Yes
- Type: CodeScanData structure
Complete customer-visible scan data.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
GetCollector
$result = $client->getCollector([/* ... */]); $promise = $client->getCollectorAsync([/* ... */]);
Retrieves the current state of the Collector for the caller's account.
Parameter Syntax
$result = $client->getCollector([
'collectorId' => '<string>', // REQUIRED
]);
Parameter Details
Members
- collectorId
-
- Required: Yes
- Type: string
The unique identifier of the Collector to retrieve.
Result Syntax
[
'collectorArn' => '<string>',
'collectorId' => '<string>',
'configRecorderArn' => '<string>',
'createdAt' => <DateTime>,
'kubernetesClusterRoleArn' => '<string>',
'status' => 'ACTIVE|PENDING_DELETION',
'type' => 'AWS_COLLECTOR',
'updatedAt' => <DateTime>,
]
Result Details
Members
- collectorArn
-
- Required: Yes
- Type: string
The ARN of the Collector.
- collectorId
-
- Required: Yes
- Type: string
The unique identifier of the Collector.
- configRecorderArn
-
- Type: string
The ARN of the provisioned AWS Config Recorder.
- createdAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the Collector was created.
- kubernetesClusterRoleArn
-
- Type: string
IAM role used to collect Kubernetes cluster metadata.
- status
-
- Required: Yes
- Type: string
The current lifecycle status.
- type
-
- Required: Yes
- Type: string
The source collected by this Collector.
- updatedAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The time of the last successful UpdateCollector call, returned at whole-second precision in the same date-time format as createdAt.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
GetCollectorDataAccessAuthorization
$result = $client->getCollectorDataAccessAuthorization([/* ... */]); $promise = $client->getCollectorDataAccessAuthorizationAsync([/* ... */]);
Authorizes an Environment's access to a Collector's data. Continuum calls this operation with the Environment's Collector data-access role before it reads the Collector's inventory, so grant continuum:GetCollectorDataAccessAuthorization to that role and, for a Collector in another account, in the Collector's resource policy. The operation evaluates the action against the exact Collector ARN and the Collector's current resource policy using IAM and the caller's authenticated request context, with environmentArn as the continuum:EnvironmentArn condition key. A successful request returns HTTP 200 with no response members. If access is not granted, the operation returns AccessDeniedException without disclosing Collector existence, ownership, or the policy layer that denied access. The service does not reinterpret the policy using only an account ID.
Parameter Syntax
$result = $client->getCollectorDataAccessAuthorization([
'accountId' => '<string>', // REQUIRED
'collectorId' => '<string>', // REQUIRED
'environmentArn' => '<string>',
]);
Parameter Details
Members
- accountId
-
- Required: Yes
- Type: string
The AWS account that owns the Collector.
- collectorId
-
- Required: Yes
- Type: string
The unique identifier of the Collector.
- environmentArn
-
- Type: string
The full ARN of the Environment requesting the Collector's data. The Environment must be in the caller's account. Continuum supplies this value as the continuum:EnvironmentArn condition key.
Result Syntax
[]
Result Details
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
GetEnvironment
$result = $client->getEnvironment([/* ... */]); $promise = $client->getEnvironmentAsync([/* ... */]);
Retrieves the current state and configuration of an environment.
Parameter Syntax
$result = $client->getEnvironment([
'environmentId' => '<string>', // REQUIRED
]);
Parameter Details
Members
- environmentId
-
- Required: Yes
- Type: string
The unique identifier of the environment to retrieve.
Result Syntax
[
'configuration' => [
'codeConfiguration' => [
'collectorDetails' => [
'collectorDataAccessRoleArn' => '<string>',
],
'environmentConfiguration' => [
'network' => [
'allowedDomains' => ['<string>', ...],
],
'patchCreationPolicy' => 'ENABLED|DISABLED',
'scanFrequency' => '<string>',
],
'latestScan' => [
'completedAt' => <DateTime>,
'createdAt' => <DateTime>,
'failureMessage' => '<string>',
'failureStage' => 'SUBMITTED|WAITING_FOR_BUILD|BUILDING|WAITING_FOR_SCAN|SCANNING',
'origin' => 'MANUAL|SCHEDULED',
'scanRunId' => '<string>',
'status' => 'SUBMITTED|WAITING_FOR_BUILD|BUILDING|WAITING_FOR_SCAN|SCANNING|SUCCEEDED|FAILED',
],
'sourceConfiguration' => [
'repositorySources' => [
[
'defaultBranch' => '<string>',
'integrationId' => '<string>',
'repository' => '<string>',
],
// ...
],
's3Sources' => [
[
'codePrefix' => '<string>',
'contextPrefix' => '<string>',
'integrationId' => '<string>',
],
// ...
],
],
],
],
'createdAt' => <DateTime>,
'environmentArn' => '<string>',
'environmentId' => '<string>',
'name' => '<string>',
'status' => 'ACTIVE',
'statusMessage' => '<string>',
'statusUpdatedAt' => <DateTime>,
'updatedAt' => <DateTime>,
]
Result Details
Members
- configuration
-
- Required: Yes
- Type: EnvironmentConfigurationDetails structure
Type-specific configuration and state, including code sources, operating policy, Collector details, and the latest scan.
- createdAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the environment was created.
- environmentArn
-
- Required: Yes
- Type: string
The ARN of the environment.
- environmentId
-
- Required: Yes
- Type: string
The unique identifier of the environment.
- name
-
- Required: Yes
- Type: string
The customer-visible name of the environment.
- status
-
- Required: Yes
- Type: string
The current operational status of the environment.
- statusMessage
-
- Type: string
Human-readable details about the current status. Present when the status requires additional context (e.g., failure reason).
- statusUpdatedAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the status last transitioned.
- updatedAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the environment's properties were last updated.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
GetIntegration
$result = $client->getIntegration([/* ... */]); $promise = $client->getIntegrationAsync([/* ... */]);
Retrieves information about an integration.
Parameter Syntax
$result = $client->getIntegration([
'integrationId' => '<string>', // REQUIRED
]);
Parameter Details
Members
- integrationId
-
- Required: Yes
- Type: string
The unique identifier of the integration to retrieve.
Result Syntax
[
'createdAt' => <DateTime>,
'integrationArn' => '<string>',
'integrationId' => '<string>',
'integrationType' => 'GITHUB|GITLAB|S3',
'name' => '<string>',
'providerDetails' => [
'github' => [
'organizationName' => '<string>',
],
'gitlab' => [
'expiresAt' => <DateTime>,
'instanceUrl' => '<string>',
'targetPath' => '<string>',
'targetType' => 'GROUP|PROJECT',
'tokenRotation' => 'AUTOMATIC|NONE',
],
's3' => [
'bucket' => '<string>',
'roleArn' => '<string>',
],
],
'updatedAt' => <DateTime>,
]
Result Details
Members
- createdAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the integration was created.
- integrationArn
-
- Required: Yes
- Type: string
The ARN of the integration.
- integrationId
-
- Required: Yes
- Type: string
The unique identifier of the integration.
- integrationType
-
- Required: Yes
- Type: string
The immutable provider type for the integration.
- name
-
- Required: Yes
- Type: string
The name of the integration.
- providerDetails
-
- Required: Yes
- Type: ProviderDetails structure
Provider-specific details for the integration.
- updatedAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the integration was last updated.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
GetResourcePolicy
$result = $client->getResourcePolicy([/* ... */]); $promise = $client->getResourcePolicyAsync([/* ... */]);
Retrieves the resource policy attached to a Continuum resource.
Parameter Syntax
$result = $client->getResourcePolicy([
'arn' => '<string>', // REQUIRED
]);
Parameter Details
Members
- arn
-
- Required: Yes
- Type: string
The ARN of a resource in the caller's account.
Result Syntax
[
'arn' => '<string>',
'policy' => '<string>',
'revisionId' => '<string>',
]
Result Details
Members
- arn
-
- Required: Yes
- Type: string
The ARN of a Continuum resource that supports a resource policy. Collectors are the only supported resource type; other well-formed Continuum ARNs are rejected with ValidationException.
- policy
-
- Required: Yes
- Type: string
A resource policy in displayable JSON form.
- revisionId
-
- Required: Yes
- Type: string
Opaque optimistic-concurrency token for a resource policy.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
ListAssociatedCollectors
$result = $client->listAssociatedCollectors([/* ... */]); $promise = $client->listAssociatedCollectorsAsync([/* ... */]);
Lists the Collectors currently associated with one Environment in ascending collectorId order. Each entry carries the Collector ARN, so a listed association can be passed straight to DisassociateCollector, including when the Collector belongs to another account. An association recorded before Continuum persisted the ARN is omitted from the response, because without the ARN it cannot be acted on.
Parameter Syntax
$result = $client->listAssociatedCollectors([
'environmentId' => '<string>', // REQUIRED
'maxResults' => <integer>,
'nextToken' => '<string>',
]);
Parameter Details
Members
- environmentId
-
- Required: Yes
- Type: string
The unique identifier of the Environment whose associations to list.
- maxResults
-
- Type: int
Maximum number of associated Collectors to return.
- nextToken
-
- Type: string
Pagination token returned by a prior request.
Result Syntax
[
'associatedCollectors' => [
[
'collectorArn' => '<string>',
'collectorId' => '<string>',
],
// ...
],
'nextToken' => '<string>',
]
Result Details
Members
- associatedCollectors
-
- Required: Yes
- Type: Array of AssociatedCollector structures
The Collectors associated with this Environment, ordered by collectorId ascending. Empty when the Environment has no associations, and also when every association on the page predates Continuum persisting the ARN — the page is still advanced by
nextTokenin that case. - nextToken
-
- Type: string
Pagination token for the next page, if present.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
ListAssociatedEnvironments
$result = $client->listAssociatedEnvironments([/* ... */]); $promise = $client->listAssociatedEnvironmentsAsync([/* ... */]);
Lists the Environments currently associated with one Collector in lexicographically ascending environmentArn order. The ARN identifies each Environment across accounts within the Collector's Region.
Parameter Syntax
$result = $client->listAssociatedEnvironments([
'collectorId' => '<string>', // REQUIRED
'maxResults' => <integer>,
'nextToken' => '<string>',
]);
Parameter Details
Members
- collectorId
-
- Required: Yes
- Type: string
The unique identifier of the Collector whose associations to list.
- maxResults
-
- Type: int
Maximum number of Environment associations to return.
- nextToken
-
- Type: string
Pagination token returned by a prior request.
Result Syntax
[
'associatedEnvironments' => [
[
'createdAt' => <DateTime>,
'environmentArn' => '<string>',
'environmentId' => '<string>',
'name' => '<string>',
'status' => 'ACTIVE',
],
// ...
],
'nextToken' => '<string>',
]
Result Details
Members
- associatedEnvironments
-
- Required: Yes
- Type: Array of AssociatedEnvironment structures
Summaries of the Environments associated with this Collector, ordered by environmentArn lexicographically ascending. Each summary has the same fields as a ListEnvironments item but uses an independent model shape. Empty when the Collector has no associations.
- nextToken
-
- Type: string
Pagination token for the next page, if present.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
ListCodeFindings
$result = $client->listCodeFindings([/* ... */]); $promise = $client->listCodeFindingsAsync([/* ... */]);
Lists the findings in an environment in descending findingId order.
Parameter Syntax
$result = $client->listCodeFindings([
'environmentId' => '<string>', // REQUIRED
'maxResults' => <integer>,
'nextToken' => '<string>',
]);
Parameter Details
Members
- environmentId
-
- Required: Yes
- Type: string
The environment whose findings to list.
- maxResults
-
- Type: int
The maximum number of results to return in a single call.
- nextToken
-
- Type: string
A pagination token returned by a previous call. Set to null for the first request; use the returned token for subsequent calls.
Result Syntax
[
'items' => [
[
'category' => '<string>',
'completedAt' => <DateTime>,
'createdAt' => <DateTime>,
'createdIssueId' => '<string>',
'discardReason' => 'SCANNER_VALIDATED_FALSE_POSITIVE|SCANNER_NEEDS_REVIEW|FALSE_POSITIVE_VALIDATED_AGAINST_CONTEXT|DUPLICATE_OF_OPEN_ISSUE|DUPLICATE_OF_CLOSED_ISSUE|COMPENSATING_CONTROL_PRESENT|OUT_OF_SCOPE|INSUFFICIENT_EVIDENCE|PROCESSING_FAILED|SOURCE_REPO_NOT_FOUND',
'discardReasoning' => '<string>',
'duplicateOfIssueId' => '<string>',
'environmentId' => '<string>',
'filePath' => '<string>',
'findingArn' => '<string>',
'findingId' => '<string>',
'reportedAt' => <DateTime>,
'scanRunId' => '<string>',
'severity' => 'UNKNOWN|INFORMATIONAL|LOW|MEDIUM|HIGH|CRITICAL|FATAL|OTHER',
'source' => '<string>',
'sourceFindingId' => '<string>',
'status' => 'SUBMITTED|VALIDATING|CONFIRMED|DISCARDED',
'statusMessage' => '<string>',
'statusUpdatedAt' => <DateTime>,
'title' => '<string>',
'type' => 'CONTINUUM_CODE_VULN|CUSTOMER_CODE_VULN',
],
// ...
],
'nextToken' => '<string>',
]
Result Details
Members
- items
-
- Required: Yes
- Type: Array of FindingSummary structures
The findings in the environment, ordered by findingId descending.
- nextToken
-
- Type: string
A pagination token to retrieve the next page of results. Absent when there are no more results.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
ListCodeIssueArtifacts
$result = $client->listCodeIssueArtifacts([/* ... */]); $promise = $client->listCodeIssueArtifactsAsync([/* ... */]);
Lists the artifacts attached to an issue in descending artifactId order. Content is returned by GetCodeIssueArtifact.
Parameter Syntax
$result = $client->listCodeIssueArtifacts([
'artifactType' => 'EVIDENCE|AGENT_COMMUNICATION|VALIDATION_EVIDENCE|REMEDIATION_PROPOSAL|DECISION|PATCH',
'environmentId' => '<string>', // REQUIRED
'issueId' => '<string>', // REQUIRED
'maxResults' => <integer>,
'nextToken' => '<string>',
]);
Parameter Details
Members
- artifactType
-
- Type: string
Optional filter for a semantic artifact category. Omit to list all artifacts attached to the issue.
- environmentId
-
- Required: Yes
- Type: string
The environment that owns the issue.
- issueId
-
- Required: Yes
- Type: string
The issue whose artifacts to list.
- maxResults
-
- Type: int
The maximum number of results to return in a single call.
- nextToken
-
- Type: string
A pagination token returned by a previous call. Set to null for the first request; use the returned token for subsequent calls.
Result Syntax
[
'items' => [
[
'artifactId' => '<string>',
'artifactType' => 'EVIDENCE|AGENT_COMMUNICATION|VALIDATION_EVIDENCE|REMEDIATION_PROPOSAL|DECISION|PATCH',
'contentSizeBytes' => <integer>,
'createdAt' => <DateTime>,
'mediaType' => '<string>',
'producer' => [
'agent' => '<string>',
],
],
// ...
],
'nextToken' => '<string>',
]
Result Details
Members
- items
-
- Required: Yes
- Type: Array of IssueArtifactItem structures
The artifacts attached to the issue, ordered by artifactId descending.
- nextToken
-
- Type: string
A pagination token to retrieve the next page of results. Absent when there are no more results.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
ListCodeIssues
$result = $client->listCodeIssues([/* ... */]); $promise = $client->listCodeIssuesAsync([/* ... */]);
Lists the issues in an environment in descending issueId order.
Parameter Syntax
$result = $client->listCodeIssues([
'environmentId' => '<string>', // REQUIRED
'maxResults' => <integer>,
'nextToken' => '<string>',
]);
Parameter Details
Members
- environmentId
-
- Required: Yes
- Type: string
The environment whose issues to list.
- maxResults
-
- Type: int
The maximum number of results to return in a single call.
- nextToken
-
- Type: string
A pagination token returned by a previous call. Set to null for the first request; use the returned token for subsequent calls.
Result Syntax
[
'items' => [
[
'confidence' => <integer>,
'createdAt' => <DateTime>,
'issueArn' => '<string>',
'issueId' => '<string>',
'name' => '<string>',
'phase' => 'VALIDATION|PRIORITIZATION|REMEDIATION',
'severity' => 'LOW|MEDIUM|HIGH|CRITICAL',
'status' => 'CREATED|IN_PROGRESS|COMPLETED|FAILED',
'statusMessage' => '<string>',
'statusReason' => 'INTERNAL_ERROR|REMEDIATION_FAILED',
'statusUpdatedAt' => <DateTime>,
'updatedAt' => <DateTime>,
],
// ...
],
'nextToken' => '<string>',
]
Result Details
Members
- items
-
- Required: Yes
- Type: Array of IssueSummary structures
The issues in the environment, ordered by issueId descending.
- nextToken
-
- Type: string
A pagination token to retrieve the next page of results. Absent when there are no more results.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
ListCodeScans
$result = $client->listCodeScans([/* ... */]); $promise = $client->listCodeScansAsync([/* ... */]);
Lists customer-visible scans for one environment in descending scanRunId order.
Parameter Syntax
$result = $client->listCodeScans([
'environmentId' => '<string>', // REQUIRED
'maxResults' => <integer>,
'nextToken' => '<string>',
]);
Parameter Details
Members
- environmentId
-
- Required: Yes
- Type: string
Environment whose scans to list.
- maxResults
-
- Type: int
Maximum number of scans to return.
- nextToken
-
- Type: string
Pagination token returned by a prior request.
Result Syntax
[
'nextToken' => '<string>',
'scans' => [
[
'completedAt' => <DateTime>,
'createdAt' => <DateTime>,
'failureMessage' => '<string>',
'failureStage' => 'SUBMITTED|WAITING_FOR_BUILD|BUILDING|WAITING_FOR_SCAN|SCANNING',
'origin' => 'MANUAL|SCHEDULED',
'scanRunId' => '<string>',
'status' => 'SUBMITTED|WAITING_FOR_BUILD|BUILDING|WAITING_FOR_SCAN|SCANNING|SUCCEEDED|FAILED',
],
// ...
],
]
Result Details
Members
- nextToken
-
- Type: string
Pagination token for the next page, if present.
- scans
-
- Required: Yes
- Type: Array of CodeScanSummary structures
Customer-visible scans ordered by scanRunId descending.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
ListCollectors
$result = $client->listCollectors([/* ... */]); $promise = $client->listCollectorsAsync([/* ... */]);
Lists the Collectors owned by the authenticated caller's account, including a Collector whose deletion is in progress. A Collector that is still being created is omitted. The account-scoped Collector quota currently permits at most one result, so no result ordering applies.
Parameter Syntax
$result = $client->listCollectors([ ]);
Parameter Details
Members
Result Syntax
[
'items' => [
[
'collectorArn' => '<string>',
'collectorId' => '<string>',
'createdAt' => <DateTime>,
'status' => 'ACTIVE|PENDING_DELETION',
'type' => 'AWS_COLLECTOR',
],
// ...
],
]
Result Details
Members
- items
-
- Required: Yes
- Type: Array of CollectorSummary structures
The Collectors owned by the authenticated caller's account. At most one result is currently returned, so no result ordering applies.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
ListEnvironments
$result = $client->listEnvironments([/* ... */]); $promise = $client->listEnvironmentsAsync([/* ... */]);
Lists all environments in your account in descending environmentId order. This complete-inventory operation intentionally has no response filters; see the input documentation for the API standards justification.
Parameter Syntax
$result = $client->listEnvironments([
'maxResults' => <integer>,
'nextToken' => '<string>',
]);
Parameter Details
Members
- maxResults
-
- Type: int
The maximum number of results to return in a single call.
- nextToken
-
- Type: string
A pagination token returned by a previous call. Set to null for the first request; use the returned token for subsequent calls.
Result Syntax
[
'items' => [
[
'createdAt' => <DateTime>,
'environmentArn' => '<string>',
'environmentId' => '<string>',
'name' => '<string>',
'status' => 'ACTIVE',
],
// ...
],
'nextToken' => '<string>',
]
Result Details
Members
- items
-
- Required: Yes
- Type: Array of EnvironmentListEntry structures
Common metadata for the environments in the account, ordered by environmentId descending.
- nextToken
-
- Type: string
A pagination token to retrieve the next page of results. Absent when there are no more results.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
ListIntegrations
$result = $client->listIntegrations([/* ... */]); $promise = $client->listIntegrationsAsync([/* ... */]);
Lists the integrations in your account in descending integrationId order.
Parameter Syntax
$result = $client->listIntegrations([
'maxResults' => <integer>,
'nextToken' => '<string>',
]);
Parameter Details
Members
- maxResults
-
- Type: int
The maximum number of results to return in a single call.
- nextToken
-
- Type: string
A pagination token returned by a previous call. Set to null for the first request; use the returned token for subsequent calls.
Result Syntax
[
'items' => [
[
'createdAt' => <DateTime>,
'integrationArn' => '<string>',
'integrationId' => '<string>',
'integrationType' => 'GITHUB|GITLAB|S3',
'name' => '<string>',
'providerDetails' => [
'github' => [
'organizationName' => '<string>',
],
'gitlab' => [
'expiresAt' => <DateTime>,
'instanceUrl' => '<string>',
'targetPath' => '<string>',
'targetType' => 'GROUP|PROJECT',
'tokenRotation' => 'AUTOMATIC|NONE',
],
's3' => [
'bucket' => '<string>',
'roleArn' => '<string>',
],
],
'updatedAt' => <DateTime>,
],
// ...
],
'nextToken' => '<string>',
]
Result Details
Members
- items
-
- Required: Yes
- Type: Array of IntegrationSummary structures
The integrations in the account, ordered by integrationId descending.
- nextToken
-
- Type: string
A pagination token to retrieve the next page of results. Absent when there are no more results.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
PutResourcePolicy
$result = $client->putResourcePolicy([/* ... */]); $promise = $client->putResourcePolicyAsync([/* ... */]);
Creates or replaces the resource policy attached to a Continuum resource.
Parameter Syntax
$result = $client->putResourcePolicy([
'arn' => '<string>', // REQUIRED
'expectedRevisionId' => '<string>',
'policy' => '<string>',
]);
Parameter Details
Members
- arn
-
- Required: Yes
- Type: string
The ARN of a resource in the caller's account.
- expectedRevisionId
-
- Type: string
Optional optimistic-concurrency token for the currently observed policy.
- policy
-
- Type: string
Omit or supply an empty Statement array to clear resource-policy grants and store the canonical empty-statement policy. Cross-account access is denied; same-account access remains subject to identity policies. Use an explicit Deny statement to deny same-account principals too.
Result Syntax
[
'arn' => '<string>',
'policy' => '<string>',
'revisionId' => '<string>',
]
Result Details
Members
- arn
-
- Required: Yes
- Type: string
The ARN of a Continuum resource that supports a resource policy. Collectors are the only supported resource type; other well-formed Continuum ARNs are rejected with ValidationException.
- policy
-
- Required: Yes
- Type: string
A resource policy in displayable JSON form.
- revisionId
-
- Required: Yes
- Type: string
Opaque optimistic-concurrency token for a resource policy.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
- ConflictException:
The request could not be completed due to a conflict with the current state of the resource.
StartIntegrationAuthorization
$result = $client->startIntegrationAuthorization([/* ... */]); $promise = $client->startIntegrationAuthorizationAsync([/* ... */]);
Starts an OAuth authorization for a new integration and returns the values the caller sends to the provider's authorization endpoint. The authorization belongs to the calling AWS account, can be redeemed once by CreateIntegration from that same account, and expires after ten minutes.
Parameter Syntax
$result = $client->startIntegrationAuthorization([
'name' => '<string>',
'providerType' => 'GITHUB', // REQUIRED
]);
Parameter Details
Members
- name
-
- Type: string
The name the integration will be created with. When specified, the request fails with ConflictException if an integration with this name already exists in the account, before the caller leaves for the provider. The name is only checked: it is not reserved, stored, or authorized. CreateIntegration requires its own name, checks it again, and may use a different one.
- providerType
-
- Required: Yes
- Type: string
The provider to authorize. Only GITHUB is supported.
Result Syntax
[
'codeChallenge' => '<string>',
'codeChallengeMethod' => 'S256',
'expiresAt' => <DateTime>,
'state' => '<string>',
]
Result Details
Members
- codeChallenge
-
- Required: Yes
- Type: string
The PKCE code challenge to send as the OAuth
code_challengeparameter. - codeChallengeMethod
-
- Required: Yes
- Type: string
The PKCE challenge method to send as the OAuth
code_challenge_methodparameter. - expiresAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The time after which CreateIntegration no longer accepts this authorization.
- state
-
- Required: Yes
- Type: string
An opaque value to send as the OAuth
stateparameter. Pass the value the provider returns in its callback to CreateIntegration asauthorization.state.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
- ConflictException:
The request could not be completed due to a conflict with the current state of the resource.
UpdateCollector
$result = $client->updateCollector([/* ... */]); $promise = $client->updateCollectorAsync([/* ... */]);
Updates the customer-controlled mutable properties of a Collector. Only the name and Kubernetes cluster IAM role can be changed.
Parameter Syntax
$result = $client->updateCollector([
'collectorId' => '<string>', // REQUIRED
'kubernetesClusterRole' => [
'remove' => [
],
'set' => [
'externalId' => '<string>',
'roleArn' => '<string>', // REQUIRED
],
],
'name' => '<string>',
]);
Parameter Details
Members
- collectorId
-
- Required: Yes
- Type: string
The unique identifier of the Collector to update.
- kubernetesClusterRole
-
- Type: KubernetesClusterRoleUpdate structure
Atomic update to the IAM role configuration used to collect Kubernetes cluster metadata. The set variant requires a complete configuration; the authenticated caller must be allowed to pass its exact roleArn to Continuum. The remove variant clears both the role and external ID.
- name
-
- Type: string
The new customer-visible name.
Result Syntax
[
'collectorArn' => '<string>',
'collectorId' => '<string>',
'configRecorderArn' => '<string>',
'createdAt' => <DateTime>,
'kubernetesClusterRoleArn' => '<string>',
'status' => 'ACTIVE|PENDING_DELETION',
'type' => 'AWS_COLLECTOR',
'updatedAt' => <DateTime>,
]
Result Details
Members
- collectorArn
-
- Required: Yes
- Type: string
The ARN of the updated Collector.
- collectorId
-
- Required: Yes
- Type: string
The unique identifier of the updated Collector.
- configRecorderArn
-
- Type: string
The ARN of the provisioned AWS Config Recorder.
- createdAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the Collector was created.
- kubernetesClusterRoleArn
-
- Type: string
IAM role used to collect Kubernetes cluster metadata.
- status
-
- Required: Yes
- Type: string
The current lifecycle status.
- type
-
- Required: Yes
- Type: string
The source collected by this Collector.
- updatedAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The time of the last successful UpdateCollector call, returned at whole-second precision in the same date-time format as createdAt.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
- ConflictException:
The request could not be completed due to a conflict with the current state of the resource.
UpdateEnvironment
$result = $client->updateEnvironment([/* ... */]); $promise = $client->updateEnvironmentAsync([/* ... */]);
Updates the customer-controlled mutable properties of an environment. Only the name, the environment's S3 integration source and repository selections, its scan frequency, its network policy, and its patch creation policy can be changed.
Parameter Syntax
$result = $client->updateEnvironment([
'configuration' => [
'codeConfiguration' => [
'environmentConfiguration' => [
'network' => [
'allowedDomains' => ['<string>', ...],
],
'patchCreationPolicy' => 'ENABLED|DISABLED',
'scanFrequency' => '<string>',
],
'sourceConfiguration' => [
'repositorySources' => [
[
'defaultBranch' => '<string>',
'integrationId' => '<string>', // REQUIRED
'repository' => '<string>', // REQUIRED
],
// ...
],
's3Sources' => [
[
'codePrefix' => '<string>',
'contextPrefix' => '<string>',
'integrationId' => '<string>', // REQUIRED
],
// ...
],
],
],
],
'environmentId' => '<string>', // REQUIRED
'name' => '<string>',
]);
Parameter Details
Members
- configuration
-
- Type: UpdateEnvironmentConfiguration structure
Type-specific configuration changes. Omission preserves the configuration.
- environmentId
-
- Required: Yes
- Type: string
The unique identifier of the environment to update.
- name
-
- Type: string
The new customer-visible name.
Result Syntax
[
'configuration' => [
'codeConfiguration' => [
'collectorDetails' => [
'collectorDataAccessRoleArn' => '<string>',
],
'environmentConfiguration' => [
'network' => [
'allowedDomains' => ['<string>', ...],
],
'patchCreationPolicy' => 'ENABLED|DISABLED',
'scanFrequency' => '<string>',
],
'latestScan' => [
'completedAt' => <DateTime>,
'createdAt' => <DateTime>,
'failureMessage' => '<string>',
'failureStage' => 'SUBMITTED|WAITING_FOR_BUILD|BUILDING|WAITING_FOR_SCAN|SCANNING',
'origin' => 'MANUAL|SCHEDULED',
'scanRunId' => '<string>',
'status' => 'SUBMITTED|WAITING_FOR_BUILD|BUILDING|WAITING_FOR_SCAN|SCANNING|SUCCEEDED|FAILED',
],
'sourceConfiguration' => [
'repositorySources' => [
[
'defaultBranch' => '<string>',
'integrationId' => '<string>',
'repository' => '<string>',
],
// ...
],
's3Sources' => [
[
'codePrefix' => '<string>',
'contextPrefix' => '<string>',
'integrationId' => '<string>',
],
// ...
],
],
],
],
'createdAt' => <DateTime>,
'environmentArn' => '<string>',
'environmentId' => '<string>',
'name' => '<string>',
'status' => 'ACTIVE',
'statusMessage' => '<string>',
'statusUpdatedAt' => <DateTime>,
]
Result Details
Members
- configuration
-
- Required: Yes
- Type: EnvironmentConfigurationDetails structure
Type-specific state, including Collector details and the latest scan. Read source and operating-policy settings through GetEnvironment.
- createdAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the environment was created. Uses the existing GetEnvironment/ListEnvironments ISO-8601 wire format for this field.
- environmentArn
-
- Required: Yes
- Type: string
The ARN of the updated environment.
- environmentId
-
- Required: Yes
- Type: string
The unique identifier of the updated environment.
- name
-
- Required: Yes
- Type: string
The current customer-visible name of the environment.
- status
-
- Required: Yes
- Type: string
The current operational status of the environment.
- statusMessage
-
- Type: string
Human-readable details about the current status.
- statusUpdatedAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the status last transitioned. Uses the existing GetEnvironment/ListEnvironments ISO-8601 wire format for this field.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
- ConflictException:
The request could not be completed due to a conflict with the current state of the resource.
UpdateIntegration
$result = $client->updateIntegration([/* ... */]); $promise = $client->updateIntegrationAsync([/* ... */]);
Rotates the credentials used by an Amazon S3 integration. Only S3 integrations can be updated; GitHub integrations cannot be modified. The integration's name, provider type, and bucket remain fixed.
The caller must have iam:PassRole permission for the supplied role, including when only the external ID changes. Continuum verifies that the role can be assumed with the requested external ID and can access the existing bucket before saving both credentials atomically. Omitting externalId preserves its current value. Repeating both current credentials leaves updatedAt unchanged, but still requires authorization and access validation.
Parameter Syntax
$result = $client->updateIntegration([
'integrationId' => '<string>', // REQUIRED
'providerConfiguration' => [ // REQUIRED
's3' => [
'externalId' => '<string>',
'roleArn' => '<string>', // REQUIRED
],
],
]);
Parameter Details
Members
- integrationId
-
- Required: Yes
- Type: string
The unique identifier of the S3 integration to update.
- providerConfiguration
-
- Required: Yes
- Type: UpdateProviderConfiguration structure
The provider-specific changes to apply. The member must match the integration's provider type, and only S3 integrations can be updated.
Result Syntax
[
'createdAt' => <DateTime>,
'integrationArn' => '<string>',
'integrationId' => '<string>',
'integrationType' => 'GITHUB|GITLAB|S3',
'name' => '<string>',
'providerDetails' => [
'github' => [
'organizationName' => '<string>',
],
'gitlab' => [
'expiresAt' => <DateTime>,
'instanceUrl' => '<string>',
'targetPath' => '<string>',
'targetType' => 'GROUP|PROJECT',
'tokenRotation' => 'AUTOMATIC|NONE',
],
's3' => [
'bucket' => '<string>',
'roleArn' => '<string>',
],
],
'updatedAt' => <DateTime>,
]
Result Details
Members
- createdAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
When the integration was created.
- integrationArn
-
- Required: Yes
- Type: string
The Amazon Resource Name (ARN) of an Integration resource, of the form arn:{partition}:continuum:{region}:{account}:integrations/{integrationId}.
- integrationId
-
- Required: Yes
- Type: string
The unique identifier for an Integration resource.
- integrationType
-
- Required: Yes
- Type: string
The immutable provider type for an integration.
- name
-
- Required: Yes
- Type: string
The name for an integration.
- providerDetails
-
- Required: Yes
- Type: ProviderDetails structure
Provider-specific details for an integration. Only one member will be present.
- updatedAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
When the integration was last updated.
Errors
- ValidationException:
- This error does not currently have a description.
- InternalServerException:
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
- ResourceNotFoundException:
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
- ThrottlingException:
The request was denied due to request throttling.
- AccessDeniedException:
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
- ConflictException:
The request could not be completed due to a conflict with the current state of the resource.
Shapes
AccessDeniedException
Description
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
Members
- message
-
- Required: Yes
- Type: string
Error description.
AffectedPackage
Description
A software package implicated by a finding.
Members
- fixedInVersion
-
- Type: string
The earliest version that resolves the issue, when one is known.
- name
-
- Required: Yes
- Type: string
The package name.
- packageManager
-
- Type: string
The ecosystem supplying the package.
- version
-
- Type: string
The affected version.
AssociatedCollector
Description
One Collector associated with an Environment.
Members
- collectorArn
-
- Required: Yes
- Type: string
The ARN of the associated Collector. The account and Region encoded in this ARN identify cross-account and cross-Region associations.
- collectorId
-
- Required: Yes
- Type: string
The unique identifier of the associated Collector.
AssociatedEnvironment
Description
A summary of one Environment associated with a Collector. This shape intentionally remains distinct from EnvironmentSummary so the two list operations can evolve independently.
Members
- createdAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the associated Environment was created.
- environmentArn
-
- Required: Yes
- Type: string
The ARN of the associated Environment. The account encoded in this ARN identifies cross-account associations; association mutations require its Region to match the Collector's Region.
- environmentId
-
- Required: Yes
- Type: string
The unique identifier of the associated Environment.
- name
-
- Required: Yes
- Type: string
The customer-visible name of the associated Environment.
- status
-
- Required: Yes
- Type: string
The current operational status of the associated Environment.
CodeConfigurationDetails
Description
Code-specific environment properties. GetEnvironment returns the source and operating policy; UpdateEnvironment returns Collector details and the latest scan.
Members
- collectorDetails
-
- Type: CollectorDetails structure
Collector data access configuration. Omitted when no Collector data access role is configured.
- environmentConfiguration
-
- Type: EnvironmentConfiguration structure
Operating policy in the shape accepted by CreateEnvironment and UpdateEnvironment.
- latestScan
-
- Type: CodeScanSummary structure
The newest scan requested for this environment, if one exists.
- sourceConfiguration
-
- Type: EnvironmentSourceConfiguration structure
Sources in the shape accepted by CreateEnvironment and UpdateEnvironment.
CodeScanData
Description
Complete customer-visible data for one environment scan.
Kept distinct from CodeScanSummary so GetCodeScan can grow independently of ListCodeScans without changing its response contract.
Members
- completedAt
-
- Type: timestamp (string|DateTime or anything parsable by strtotime)
Time at which a terminal result was recorded.
- createdAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
Time at which Continuum accepted the scan request.
- failureMessage
-
- Type: string
Failure detail present for unsuccessful scans.
- failureStage
-
- Type: string
Phase this scan failed in. Present only when
statusis FAILED, and absent for a scan that failed before this field existed. - origin
-
- Required: Yes
- Type: string
Why the scan was created. Always present.
- scanRunId
-
- Required: Yes
- Type: string
The unique scan identifier.
- status
-
- Required: Yes
- Type: string
Current customer-visible status.
CodeScanSummary
Description
Customer-visible summary of one environment scan.
Members
- completedAt
-
- Type: timestamp (string|DateTime or anything parsable by strtotime)
Time at which a terminal result was recorded.
- createdAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
Time at which Continuum accepted the scan request.
- failureMessage
-
- Type: string
Failure detail present for unsuccessful scans.
- failureStage
-
- Type: string
Phase this scan failed in. Present only when
statusis FAILED, and absent for a scan that failed before this field existed. - origin
-
- Required: Yes
- Type: string
Why the scan was created. Always present.
- scanRunId
-
- Required: Yes
- Type: string
The unique scan identifier.
- status
-
- Required: Yes
- Type: string
Current customer-visible status.
CollectorDetails
Description
Collector data access configuration returned for an environment.
Members
- collectorDataAccessRoleArn
-
- Type: string
IAM role that Continuum assumes to authorize its access to associated Collector inventory. Required for nonempty Collector inventory resolution, in the same account or across accounts. This is independent from any S3 source role.
CollectorSummary
Description
A summary of a Collector returned in list responses.
Members
- collectorArn
-
- Required: Yes
- Type: string
The ARN of the Collector.
- collectorId
-
- Required: Yes
- Type: string
The unique identifier of the Collector.
- createdAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the Collector was created.
- status
-
- Required: Yes
- Type: string
The current lifecycle status.
- type
-
- Required: Yes
- Type: string
The source collected by this Collector.
ConflictException
Description
The request could not be completed due to a conflict with the current state of the resource.
Members
- message
-
- Required: Yes
- Type: string
Description of the conflict.
CreateCodeConfiguration
Description
Source and operating-policy settings for a new code environment.
Members
- environmentConfiguration
-
- Type: EnvironmentConfiguration structure
Environment-level operating policy.
- sourceConfiguration
-
- Type: EnvironmentSourceConfiguration structure
Source configuration for the environment.
CreateEnvironmentConfiguration
Description
Type-specific configuration for a new environment. Omission creates a code environment with the default operating policy and no sources.
Members
- codeConfiguration
-
- Type: CreateCodeConfiguration structure
Configuration for a code-scanning environment.
DestinationTarget
Description
Identity only. Future providers may add union members without duplicating state.
Members
- github
-
- Type: GitHubTarget structure
The GitHub repository the patch is delivered to, including the pull request once it is opened.
- s3
-
- Type: S3Target structure
The S3 object the patch is delivered to.
Document
Members
EnvironmentConfiguration
Description
Environment-level operating policy.
Members
- network
-
- Type: EnvironmentNetworkConfiguration structure
Network policy for agent execution.
- patchCreationPolicy
-
- Type: string
Whether Continuum creates a patch for a proposed remediation. Defaults to DISABLED.
- scanFrequency
-
- Type: string
Recurring scan interval: P1D (1 day), P2D (2 days), or P7D (7 days). PT0H disables recurring scans. Defaults to P1D when creating an environment.
EnvironmentConfigurationDetails
Description
Type-specific configuration and state returned by GetEnvironment and UpdateEnvironment.
Members
- codeConfiguration
-
- Type: CodeConfigurationDetails structure
Configuration and scan state for a code-scanning environment.
EnvironmentListEntry
Description
Summary of an environment returned in list responses.
Members
- createdAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the environment was created. Preserve the existing EnvironmentSummary.createdAt date-time wire format.
- environmentArn
-
- Required: Yes
- Type: string
The ARN of the environment.
- environmentId
-
- Required: Yes
- Type: string
The unique identifier of the environment.
- name
-
- Required: Yes
- Type: string
The customer-visible name of the environment.
- status
-
- Required: Yes
- Type: string
The current operational status of the environment.
EnvironmentNetworkConfiguration
Description
Network policy for agent execution.
Members
- allowedDomains
-
- Type: Array of strings
Domains that an environment's agent execution may contact.
EnvironmentRepositorySource
Description
One repository selected from a previously-created integration.
Members
- defaultBranch
-
- Type: string
Branch used when a scan does not choose a more specific revision.
- integrationId
-
- Required: Yes
- Type: string
Integration that provides the selected repository.
- repository
-
- Required: Yes
- Type: string
Repository selected from that integration in owner/repository form.
EnvironmentS3IntegrationSource
Description
An S3 source for one environment, backed by a previously-created S3 integration.
Members
- codePrefix
-
- Type: string
Prefix containing source code. Defaults to code/ when omitted.
- contextPrefix
-
- Type: string
Prefix containing customer-authored context. Defaults to context/ when omitted.
- integrationId
-
- Required: Yes
- Type: string
Identifier of an S3 integration in the caller's account. The integration supplies the bucket, the read role, and the external ID Continuum uses to read the prefixes.
EnvironmentSourceConfiguration
Description
GA source configuration for code and customer-authored context.
Members
- repositorySources
-
- Type: Array of EnvironmentRepositorySource structures
Explicit repository selections from previously-created integrations.
- s3Sources
-
- Type: Array of EnvironmentS3IntegrationSource structures
S3 sources backed by previously-created S3 integrations.
FindingComplianceCheck
Description
One compliance check behind a posture finding.
Members
- description
-
- Type: string
Free-form prose about a finding (summary, detailed analysis, rationale, remediation guidance). Capped well below the finding document's own 256 KB limit, since several of these can appear on one finding.
- name
-
- Type: string
A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use
cweIdswhen a stable classification is needed. - uid
-
- Type: string
A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use
cweIdswhen a stable classification is needed.
FindingEvidence
Description
A code citation supporting a validation verdict.
Members
- file
-
- Type: string
The file the evidence was found in.
- line
-
- Type: int
The 1-indexed line, when known.
- snippet
-
- Type: string
The cited excerpt.
FindingLocation
Description
A code location a finding points at.
Members
- endLine
-
- Type: int
1-indexed last line, when the producer reported a range.
- filePath
-
- Type: string
Repository-relative path.
- startLine
-
- Type: int
1-indexed first line of the affected range.
FindingPosture
Description
The compliance posture a finding reports, for the Application Security Posture Finding class. Absent for a vulnerability finding.
Members
- application
-
- Type: string
The application the posture was assessed against.
- applicationUid
-
- Type: string
A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use
cweIdswhen a stable classification is needed. - applicationVersion
-
- Type: string
A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use
cweIdswhen a stable classification is needed. - checks
-
- Type: Array of FindingComplianceCheck structures
The individual checks performed.
- control
-
- Type: string
The control assessed, and the producer's description of it.
- description
-
- Type: string
Free-form prose about a finding (summary, detailed analysis, rationale, remediation guidance). Capped well below the finding document's own 256 KB limit, since several of these can appear on one finding.
- remediation
-
- Type: string
Free-form prose about a finding (summary, detailed analysis, rationale, remediation guidance). Capped well below the finding document's own 256 KB limit, since several of these can appear on one finding.
- remediationReferences
-
- Type: Array of strings
A free-form list of strings carried verbatim from a producer.
- requirements
-
- Type: Array of strings
A free-form list of strings carried verbatim from a producer.
- standards
-
- Type: Array of strings
Standards and requirements the control maps to.
- status
-
- Type: string
The producer's compliance status, and the enum value behind it.
- statusId
-
- Type: int
The producer's numeric enum value for
status.
FindingResource
Description
A cloud or application resource a finding concerns.
Members
- name
-
- Type: string
A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use
cweIdswhen a stable classification is needed. - region
-
- Type: string
A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use
cweIdswhen a stable classification is needed. - type
-
- Type: string
A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use
cweIdswhen a stable classification is needed. - uid
-
- Type: string
A resource identifier -- a cloud ARN, a context-graph node id, or whatever identifier scheme the producer uses.
FindingSummary
Description
A summary of a finding returned in list responses. Shares FindingLifecycleFields with the read operations so the list and get projections cannot drift. Carries a lean content subset -- fetch the finding for its full contents.
Members
- category
-
- Type: string
The producer's vulnerability category.
- completedAt
-
- Type: timestamp (string|DateTime or anything parsable by strtotime)
When processing finished, whether by creating an issue or discarding. Absent while the finding is still in flight.
- createdAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the finding was ingested.
- createdIssueId
-
- Type: string
The issue Continuum created from this finding.
- discardReason
-
- Type: string
Why the finding was not escalated. Present only when status is DISCARDED.
- discardReasoning
-
- Type: string
Customer-facing explanation accompanying
discardReason. - duplicateOfIssueId
-
- Type: string
The existing issue this finding duplicates. Present only for the DUPLICATE_OF_* discard reasons.
- environmentId
-
- Required: Yes
- Type: string
The environment that owns the finding.
- filePath
-
- Type: string
The file the finding is about, when it has a code location.
- findingArn
-
- Required: Yes
- Type: string
The ARN of the finding.
- findingId
-
- Required: Yes
- Type: string
The unique identifier of the finding.
- reportedAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
When the producer reported the finding -- its own clock, which is not Continuum's ingestion time.
createdAtis when Continuum accepted it; these are genuinely different instants and a reader usually wants this one.For CreateCodeFinding, this is the submitted OCSF document's own top-level
time. For findings Continuum's scanner produces, it is the finding's own creation time.Continuum does not validate it for plausibility: a producer's value is echoed as given, so a
timestamphere asserts the unit and format, not that the instant is genuine. - scanRunId
-
- Type: string
The scan that produced the finding, when it came from one. For a finding Continuum's scanner produced, this is the Continuum scan run (see GetCodeScan). For a finding submitted with CreateCodeFinding, it is the OCSF document's
metadata.correlation_uid, when that value is a valid ScanRunId. Absent when the finding did not come from a scan. - severity
-
- Required: Yes
- Type: string
The finding's severity.
- source
-
- Required: Yes
- Type: string
The system that produced the finding.
- sourceFindingId
-
- Required: Yes
- Type: string
The producer's own identifier for the finding.
- status
-
- Required: Yes
- Type: string
The current lifecycle status of the finding.
- statusMessage
-
- Type: string
Human-readable context about the current status.
- statusUpdatedAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the status last transitioned.
- title
-
- Required: Yes
- Type: string
The producer's title for the finding.
- type
-
- Required: Yes
- Type: string
What kind of finding this is.
FindingValidation
Description
A validator's assessment of a finding. Present only when validation actually ran -- absent for finding types that are ingested untested, rather than reporting a verdict Continuum did not reach.
Members
- blockingReason
-
- Type: string
Why the validator reached that verdict.
- confidence
-
- Type: double
The validator's confidence, from 0.0 to 1.0 inclusive. Advisory: it does not drive Continuum's own routing decisions. The range is enforced server-side, not by a @range trait -- the smithy-rs server SDK does not support range constraints on double shapes (smithy-rs#2007).
- evidence
-
- Type: Array of FindingEvidence structures
Code citations supporting the verdict.
- mitigatingControls
-
- Type: Array of strings
Controls the validator found that reduce exploitability.
- preconditions
-
- Type: Array of strings
Conditions exploitation depends on, which bound the severity.
- rationale
-
- Type: string
The validator's reasoning.
- severityAdjustment
-
- Type: string
The validator's severity conclusion.
- verdict
-
- Required: Yes
- Type: string
The validator's conclusion.
FindingVulnerability
Description
One vulnerability reported by a finding. A customer document may report several; each carries its own identity, locations and remediation.
Members
- additionalCweIds
-
- Type: Array of strings
Further CWEs the producer attributed to this same vulnerability.
- affectedPackages
-
- Type: Array of AffectedPackage structures
Software packages implicated by a finding.
- code
-
- Type: string
The vulnerable fragment, when the producer supplied one.
- cveId
-
- Type: string
A CVE identifier, e.g. "CVE-2020-8203".
- cvssBaseScore
-
- Type: double
The CVSS base score for
cveId, when the producer supplies one, from 0.0 to 10.0. - cweCaption
-
- Type: string
The producer's human-readable caption for
cweId. - cweId
-
- Type: string
Primary CWE for this vulnerability, e.g. "CWE-89".
- description
-
- Type: string
Free-form prose about a finding (summary, detailed analysis, rationale, remediation guidance). Capped well below the finding document's own 256 KB limit, since several of these can appear on one finding.
- details
-
- Type: string
The producer's extended analysis for this vulnerability.
- fixCoverage
-
- Type: string
The producer's description of how completely a fix is available.
- fixCoverageId
-
- Type: int
The producer's enum value behind
fixCoverage. - locations
-
- Type: Array of FindingLocation structures
Every location this vulnerability was reported at.
- remediation
-
- Type: string
Free-form prose about a finding (summary, detailed analysis, rationale, remediation guidance). Capped well below the finding document's own 256 KB limit, since several of these can appear on one finding.
- remediationReferences
-
- Type: Array of strings
A free-form list of strings carried verbatim from a producer.
- title
-
- Type: string
The title of a finding, from the producer's own title -- OCSF finding_info.title, or the scanner's finding title. Length matches the OCSF title constraint.
FlowVerdict
Description
Validation's verdict for one attack flow.
Members
- confidence
-
- Type: double
Confidence in this flow's verdict. Absent when out of range.
- evidence
-
- Type: Array of strings
Citations supporting the verdict.
- flowId
-
- Required: Yes
- Type: string
Identifier of the attack flow assessed.
- verdict
-
- Required: Yes
- Type: string
Outcome for this flow.
GitHubAuthorizationConfiguration
Description
Write-only OAuth credentials used to authorize a GitHub.com integration. Not stored or returned after creation.
Members
- authorizationCode
-
- Required: Yes
- Type: string
The OAuth authorization code returned by GitHub after the user authorizes the application.
- redirectUrl
-
- Type: string
The redirect URL used to obtain the authorization code. Must match one of the redirect URLs registered on the GitHub App. If omitted, the App's default redirect URL is used. Not stored or returned after creation.
- state
-
- Required: Yes
- Type: string
The
statereturned by GitHub in the OAuth callback. It must be the state that StartIntegrationAuthorization returned to the same AWS account, and the authorization request must have sent that call's codeChallenge. The state can be redeemed once. A stage that enforces authorization sessions rejects a missing, expired, already used, or other-account state with ValidationException; restart the authorization with StartIntegrationAuthorization.
GitHubConfiguration
Description
Configuration for a GitHub.com integration using the OAuth authorization code flow.
Members
- authorization
-
- Required: Yes
- Type: GitHubAuthorizationConfiguration structure
OAuth authorization used to establish the integration. Required on create; not returned on read operations.
- organizationName
-
- Type: string
The name of the GitHub organization to associate with the integration. If not specified, the integration is associated with the authenticated user's personal account.
GitHubDetails
Description
Details for a GitHub.com integration.
Members
- organizationName
-
- Type: string
The name of the GitHub organization associated with the integration.
GitHubTarget
Description
The GitHub repository a patch is delivered to, and the pull request that carries it once opened.
Members
- headSha
-
- Type: string
The head commit SHA of the pull request. Absent until the pull request is opened.
- owner
-
- Required: Yes
- Type: string
The GitHub user or organization that owns the repository.
- pullRequestNumber
-
- Type: long (int|float)
Repository-scoped pull request number assigned by GitHub.
- repository
-
- Required: Yes
- Type: string
The repository name.
GitLabConfiguration
Description
Configuration for a GitLab integration using a pasted access token.
Members
- accessToken
-
- Required: Yes
- Type: string
The GitLab access token (personal, group or project). Write-only; not stored or returned after creation. If the token carries the self-rotate scope, rotation is opted in and Continuum manages the token thereafter.
- instanceUrl
-
- Required: Yes
- Type: string
The HTTPS base URL of the GitLab instance (gitlab.com or self-managed).
- targetPath
-
- Required: Yes
- Type: string
The group or project path the integration targets.
- targetType
-
- Required: Yes
- Type: string
Whether the integration targets a group or a single project.
GitLabDetails
Description
Details for a GitLab integration.
Members
- expiresAt
-
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The expiry of the stored access token, for non-rotating tokens only. A rotated token's original expiry is stale, so this is omitted when tokenRotation is AUTOMATIC.
- instanceUrl
-
- Required: Yes
- Type: string
The HTTPS base URL of the GitLab instance.
- targetPath
-
- Required: Yes
- Type: string
The group or project path the integration targets.
- targetType
-
- Required: Yes
- Type: string
Whether the integration targets a group or a single project.
- tokenRotation
-
- Required: Yes
- Type: string
How the integration's access token is rotated. AUTOMATIC only when the pasted token had the self-rotate scope and rotation was opted in at installation time.
IntegrationSummary
Description
A summary of an integration returned in list responses.
Members
- createdAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the integration was created.
- integrationArn
-
- Required: Yes
- Type: string
The ARN of the integration.
- integrationId
-
- Required: Yes
- Type: string
The unique identifier of the integration.
- integrationType
-
- Required: Yes
- Type: string
The immutable provider type for the integration.
- name
-
- Required: Yes
- Type: string
The name of the integration.
- providerDetails
-
- Required: Yes
- Type: ProviderDetails structure
Provider-specific details for the integration.
- updatedAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the integration was last updated.
InternalServerException
Description
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
Members
- message
-
- Required: Yes
- Type: string
Error description.
IssueArtifactBody
Description
The projected body of an artifact. The active member is selected by the artifact's artifactType, and for a type that carries more than one payload kind by the stored content's own discriminator; raw carries content for types with no defined shape yet and for content that did not match its shape.
Members
- patch
-
- Type: PatchBody structure
Projected PATCH content: the remediation patch for one repository, with the descriptors needed to verify and apply it and the state of its delivery to the customer's own bucket or repository.
Every PATCH projects here. The descriptors come from members Control Plane computes or owns when it stores the patch, not from producer metadata, so this member is the whole PATCH contract and
metadatais omitted for it. - prevalidationSignals
-
- Type: PrevalidationSignalsBody structure
Projected EVIDENCE content whose stored envelope declares
artifact_kind: prevalidation_signals— the severity signals prioritization uses.One artifactType can select different members here: EVIDENCE also carries the prioritization markdown narrative, which is not JSON and so returns through
raw. The member is therefore chosen by artifactType AND, for a type that carries more than one payload kind, the content's own discriminator. - raw
-
- Type: string
The producer's content verbatim, for an artifactType with no defined shape or content that failed to parse against its shape.
- remediationProposal
-
- Type: RemediationProposalBody structure
Projected REMEDIATION_PROPOSAL content: a patch the remediation agent produced, with the descriptors needed to apply and verify it.
REMEDIATION_PROPOSAL content that does not match this shape is returned through
raw. - validationEvidence
-
- Type: ValidationEvidenceBody structure
Projected VALIDATION_EVIDENCE content.
IssueArtifactItem
Description
A summary of an artifact returned in list responses.
Members
- artifactId
-
- Required: Yes
- Type: string
The unique identifier of the artifact.
- artifactType
-
- Required: Yes
- Type: string
Semantic category of the artifact.
- contentSizeBytes
-
- Required: Yes
- Type: long (int|float)
Size of the artifact content in bytes. The content itself is returned by GetCodeIssueArtifact.
- createdAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the artifact was created.
- mediaType
-
- Required: Yes
- Type: string
MIME type of the artifact content.
- producer
-
- Required: Yes
- Type: IssueArtifactProducerSummary structure
The agent that produced the artifact.
IssueArtifactProducerSummary
Description
The agent that produced an artifact.
Members
- agent
-
- Required: Yes
- Type: string
Stable producer name, such as ContinuumValidation.
IssuePatchDelivery
Description
Customer delivery of the patches Continuum produced for an issue, summarized across the issue's PATCH artifacts when the issue is read. Each artifact keeps its own delivery.destination with the full detail; this summary lets a caller see a failed delivery without listing artifacts.
Members
- failedCount
-
- Required: Yes
- Type: int
Number of those patches whose delivery failed or exhausted its retries.
- failureReasons
-
- Type: Array of strings
Distinct reasons of the failed deliveries, in ascending order. Present only when failedCount is greater than zero.
- patchCount
-
- Required: Yes
- Type: int
Number of the issue's patches that have a destination delivery.
- status
-
- Required: Yes
- Type: string
The overall result, in priority order: FAILED when any patch's destination delivery failed or exhausted its retries; otherwise PENDING while any is still in progress; otherwise SUCCEEDED when at least one was delivered; otherwise SKIPPED.
- succeededCount
-
- Required: Yes
- Type: int
Number of those patches delivered to their destination.
IssueSummary
Description
A summary of an issue returned in list responses.
Members
- confidence
-
- Type: int
The likelihood that this issue is a true positive, expressed as a percentage (0-100).
- createdAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the issue was created.
- issueArn
-
- Required: Yes
- Type: string
The ARN of the issue.
- issueId
-
- Required: Yes
- Type: string
The unique identifier of the issue.
- name
-
- Required: Yes
- Type: string
The name of the issue.
- phase
-
- Type: string
The part of the workflow the issue is in. Present when status is IN_PROGRESS, and when status is FAILED and the failing phase is known.
- severity
-
- Type: string
Scanner-derived severity assigned to the issue.
- status
-
- Required: Yes
- Type: string
The current lifecycle status of the issue.
- statusMessage
-
- Type: string
Customer-facing explanation of statusReason. Present only when status is FAILED.
- statusReason
-
- Type: string
Why the issue failed. Present only when status is FAILED.
- statusUpdatedAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when the status or phase last changed.
- updatedAt
-
- Type: timestamp (string|DateTime or anything parsable by strtotime)
The timestamp when any field of the issue last changed. Advances on every mutation (including score-only updates that do not transition status), so it is greater than or equal to statusUpdatedAt.
KubernetesClusterRoleConfiguration
Description
Complete configuration for the IAM role Continuum assumes to collect Kubernetes cluster metadata.
Members
- externalId
-
- Type: string
Optional external ID Continuum supplies when assuming roleArn. This must match the role trust policy when configured and does not replace the caller's iam:PassRole permission.
- roleArn
-
- Required: Yes
- Type: string
IAM role the authenticated caller passes to Continuum.
KubernetesClusterRoleUpdate
Description
One complete mutation of the Collector's Kubernetes IAM role configuration.
Members
- remove
-
- Type: RemoveKubernetesClusterRole structure
Remove the configured role and external ID.
- set
-
- Type: KubernetesClusterRoleConfiguration structure
Replace the complete role configuration.
PatchBody
Description
Projected content for a PATCH artifact: the remediation patch for one repository, with the descriptors needed to verify and apply it and the state of its delivery to the customer's own bucket or repository.
Members
- delivery
-
- Type: PatchDelivery structure
Delivery of the patch to the customer's bucket or repository. Absent when the artifact has no delivery destination.
- format
-
- Type: string
The patch's wire format, read from the patch itself, which determines how to apply it. Absent when the patch starts with neither a git mailbox header nor a
diff --githeader. - patch
-
- Required: Yes
- Type: string
The patch exactly as stored, unmodified. Control Plane accepted it only as a text unified diff, so
git applyapplies it. - patchSha256
-
- Required: Yes
- Type: string
SHA-256 of the patch's UTF-8 bytes in lowercase hex, computed by Control Plane when it stored the patch.
Lets a caller confirm the patch it applies is byte-for-byte the one that was reviewed. Computed over the patch bytes, so it is verifiable against
patchwithout trusting this value. - repositoryName
-
- Type: string
The repository the patch applies to, as named in the source snapshot it was generated against.
- sizeBytes
-
- Required: Yes
- Type: long (int|float)
Size of the patch in UTF-8 bytes, the unit the digest is computed over.
PatchDelivery
Description
Delivery of a patch to a destination the customer owns: an object in the environment's source bucket or a pull request in the source repository.
Members
- status
-
- Required: Yes
- Type: string
How far delivery to the destination has progressed.
- target
-
- Type: DestinationTarget structure
Where the patch was or will be delivered. Absent while the destination is still being resolved, or when delivery was skipped before a destination was known.
- updatedAt
-
- Required: Yes
- Type: timestamp (string|DateTime or anything parsable by strtotime)
When the delivery status last changed.
PerFindingResult
Description
Validation's result for one finding within a multi-finding bundle.
Members
- confidence
-
- Type: double
Confidence in this finding's verdict. Absent when out of range.
- exploitArtifact
-
- Type: ValidationExploitArtifact structure
Exploit artifact produced for this finding, when there was one.
- exploitable
-
- Required: Yes
- Type: string
Exploitability verdict for this finding.
- findingId
-
- Required: Yes
- Type: string
The finding assessed.
- flowVerdicts
-
- Type: Array of FlowVerdict structures
Per-flow verdicts recorded for this finding.
- reasoningChain
-
- Type: Array of ReasoningStep structures
Reasoning chain recorded for this finding.
PrevalidationSignal
Description
One producer's conclusion about one subject on one scoring dimension.
Members
- computed
-
- Type: SignalComputation structure
The deterministic values the producer computed from its assessment.
- conclusion
-
- Type: string
The producer's conclusion.
- confidence
-
- Type: double
The producer's confidence in this conclusion, on its native 0-1 scale. Absent when the stored value falls outside 0-1.
- confidenceReasoning
-
- Type: SignalConfidenceReasoning structure
Why the producer is or is not sure, kept structured rather than prose.
- dimension
-
- Type: string
The axis this signal speaks to. Absent when the producer reported a dimension with no mapping yet.
- exploitability
-
- Type: SignalExploitability structure
What validation established about exploitability, on an exploitability signal. This summarizes the verdict the signal was derived from; the proof itself is the VALIDATION_EVIDENCE artifact it cites.
- impactDimensions
-
- Type: SignalImpactDimensions structure
The three impact dimensions an impact signal assessed, each with the basis the producer had for it. These are what the computed impact band is derived from.
- preconditions
-
- Type: SignalPreconditions structure
The four exploit preconditions a likelihood signal assessed, each with the basis the producer had for it.
- producerId
-
- Type: string
Stable name of the producer that emitted this signal.
- producerVersion
-
- Type: string
Version of that producer.
- signalStrength
-
- Type: string
The signal's own rating. This is an input to scoring and is NOT the finding's severity.
- subjectRef
-
- Type: string
What this signal is about, such as a finding or issue reference.
PrevalidationSignalsBody
Description
Projected content for an EVIDENCE artifact carrying prioritization's prevalidation signals.
Members
- producedBy
-
- Type: string
The agent that produced this signal set.
- signals
-
- Type: Array of PrevalidationSignal structures
The signals backing the Issue's proposed severity.
ProviderConfiguration
Description
Provider-specific configuration for creating an integration. Only one member may be specified.
Members
- github
-
- Type: GitHubConfiguration structure
Configuration for a GitHub.com integration.
- gitlab
-
- Type: GitLabConfiguration structure
Configuration for a GitLab integration.
- s3
-
- Type: S3Configuration structure
Configuration for a customer-managed S3 integration.
ProviderDetails
Description
Provider-specific details for an integration. Only one member will be present.
Members
- github
-
- Type: GitHubDetails structure
Details for a GitHub.com integration.
- gitlab
-
- Type: GitLabDetails structure
Details for a GitLab integration.
- s3
-
- Type: S3Details structure
Public details for a customer-managed S3 integration.
ReasoningStep
Description
One step in the validation agent's reasoning chain.
Members
- claim
-
- Required: Yes
- Type: string
The claim or conclusion reached at this step.
- confidence
-
- Type: double
Confidence in this individual claim, on the producer's native 0-1 scale.
- source
-
- Required: Yes
- Type: string
Citation supporting the claim.
- step
-
- Required: Yes
- Type: int
Position of this step in the chain.
RemediationProposalBody
Description
Projected content for a REMEDIATION_PROPOSAL artifact: the patch the remediation agent produced, with the descriptors needed to apply and verify it.
Members
- filename
-
- Type: string
Filename the producer suggests for the patch, when it named one.
- format
-
- Type: string
The patch's wire format, which determines how to apply it. Absent when the producer recorded a format with no mapping yet.
- patch
-
- Required: Yes
- Type: string
The patch exactly as the remediation agent produced it, unmodified.
- patchSha256
-
- Type: string
SHA-256 of the patch bytes in lowercase hex, as recorded by the producer.
Lets a caller confirm the patch it applies is byte-for-byte the one that was reviewed. Computed over the patch bytes, so it is verifiable against
patchwithout trusting this value.
RemoveKubernetesClusterRole
Description
Empty marker selecting removal in KubernetesClusterRoleUpdate.
Members
ResourceNotFoundException
Description
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
Members
- message
-
- Required: Yes
- Type: string
Description of the resource that was not found.
S3Configuration
Description
Configuration for a customer-managed S3 integration.
Members
- bucket
-
- Required: Yes
- Type: string
Customer-managed source bucket name.
- externalId
-
- Required: Yes
- Type: string
Caller-provided external ID required by the role trust policy.
- roleArn
-
- Required: Yes
- Type: string
Role Continuum will assume to read from the source bucket.
S3Details
Description
Public details for a customer-managed S3 integration. The sensitive external ID is intentionally omitted.
Members
- bucket
-
- Required: Yes
- Type: string
Customer-managed S3 bucket name.
- roleArn
-
- Required: Yes
- Type: string
IAM role assumed by Continuum to read a customer-managed S3 integration.
S3Target
Description
The S3 object a patch is delivered to.
Members
- bucket
-
- Required: Yes
- Type: string
Customer-managed S3 bucket name.
- key
-
- Required: Yes
- Type: string
The object key of the delivered patch.
- version
-
- Type: string
The S3 version ID of the delivered object, when the bucket is versioned.
ServiceQuotaExceededException
Description
The request would exceed a service quota. Review your quota and request an increase if needed.
Members
- message
-
- Required: Yes
- Type: string
Description of the quota that was exceeded.
- quotaCode
-
- Type: string
The quota code for the exceeded limit.
- serviceCode
-
- Type: string
The service code for the exceeded limit.
SignalAccessPrecondition
Description
The assessed access-level precondition with the basis behind it.
Members
- basis
-
- Type: string
Where the producer's determination came from.
- missingInfo
-
- Type: string
What the producer could not determine, when anything was missing.
- reason
-
- Type: string
The producer's explanation.
- value
-
- Type: string
The level of access exploitation requires. Absent when the producer reported a level with no mapping yet.
SignalAttackerGainsDimension
Description
The assessed attacker-gains dimension with the basis behind it.
Members
- basis
-
- Type: string
Where the producer's determination came from.
- missingInfo
-
- Type: string
What the producer could not determine, when anything was missing.
- reason
-
- Type: string
The producer's explanation.
- value
-
- Type: string
The capability exploitation grants. Absent when the producer reported a value with no mapping yet.
SignalBlastRadiusDimension
Description
The assessed blast-radius dimension with the basis behind it.
Members
- basis
-
- Type: string
Where the producer's determination came from.
- missingInfo
-
- Type: string
What the producer could not determine, when anything was missing.
- reason
-
- Type: string
The producer's explanation.
- value
-
- Type: string
How far the consequences reach. Absent when the producer reported a value with no mapping yet.
SignalComputation
Description
Deterministic values the producer computed from its assessment, as distinct from the assessment itself.
Members
- barriers
-
- Type: int
How many of the four exploit preconditions act as barriers (0-4).
- impactBand
-
- Type: string
Computed impact band, on an impact signal.
- likelihoodBand
-
- Type: string
Computed likelihood band, on a likelihood signal.
SignalConfidenceReasoning
Description
A producer's structured rationale for a signal's confidence.
Members
- factors
-
- Type: Array of strings
The individual factors behind it.
- summary
-
- Required: Yes
- Type: string
One-line rationale.
SignalExploitability
Description
What validation established about exploitability, as summarized onto the scoring signal derived from it.
Members
- confidenceTier
-
- Type: string
How strong the evidence behind the verdict is.
- highestLayerReached
-
- Type: int
The highest impact layer validation reached, 1-5, as a measure of how far the attack path was walked.
- reachedCrownJewels
-
- Type: boolean
Whether validation reached the high-value sink the attack path posited.
A Boolean rather than an enum: the sink was either reached or it was not, and how far the walk got when it was not is already carried, with more precision, by
highestLayerReached. An unknown is the absent member. - scriptable
-
- Type: boolean
Whether the proven exploit is automatable rather than one-off.
A Boolean for the same reason as
SignalPrecondition.value: validation records a bool, and an unknown is the absent member. - sourceValidationArtifactId
-
- Type: string
The VALIDATION_EVIDENCE artifact on this same issue holding the proof this verdict summarizes. Fetch it with GetCodeIssueArtifact for the full reasoning chain and exploit artifact.
- verdict
-
- Type: string
Validation's verdict.
UNCERTAINcovers a run that was inconclusive — out of budget, an ambiguous failure, or no decisive layer reached — and is never a refutation.
SignalImpactDimensions
Description
The three impact dimensions an impact signal assessed. The computed impact band is derived from attackerGains and blastRadius, then shifted by targetValue.
Members
- attackerGains
-
- Type: SignalAttackerGainsDimension structure
What the attacker gains from exploitation.
- blastRadius
-
- Type: SignalBlastRadiusDimension structure
How far the consequences reach.
- targetValue
-
- Type: SignalTargetValueDimension structure
How valuable the target is, which can shift the band off its base value.
SignalPrecondition
Description
One assessed precondition with the basis behind it.
Members
- basis
-
- Type: string
Where the producer's determination came from.
- missingInfo
-
- Type: string
What the producer could not determine, when anything was missing.
- reason
-
- Type: string
The producer's explanation.
- value
-
- Type: boolean
The producer's determination.
A Boolean rather than an enum, against the Common Terms preference for enums on extensibility grounds. The question each precondition answers is closed — is the code reachable, is configuration required, must a user other than the attacker interact — and the only third state, "not determined", is already expressed by omitting this member, which the projection does whenever the stored value is not a bool. An enum would give two ways to say the same thing, while
basisandmissingInfoalready qualify how firm the answer is.
SignalPreconditions
Description
The four preconditions a likelihood signal assessed.
Members
- accessLevel
-
- Type: SignalAccessPrecondition structure
What level of access exploitation requires.
- configurationNeeded
-
- Type: SignalPrecondition structure
Whether exploitation depends on a non-default configuration.
- reachableFromAttacker
-
- Type: SignalPrecondition structure
Whether the vulnerable code path is reachable by an attacker.
- userInteractionRequired
-
- Type: SignalPrecondition structure
Whether exploitation requires a user other than the attacker to take part, for example by opening a link or a file (CVSS User Interaction).
SignalTargetValueDimension
Description
The assessed target-value dimension with the basis behind it.
Members
- basis
-
- Type: string
Where the producer's determination came from.
- missingInfo
-
- Type: string
What the producer could not determine, when anything was missing.
- reason
-
- Type: string
The producer's explanation.
- value
-
- Type: string
How valuable the target is. Absent when the producer reported a value with no mapping yet.
ThrottlingException
Description
The request was denied due to request throttling.
Members
- message
-
- Required: Yes
- Type: string
Description of the throttling error.
UpdateCodeConfiguration
Description
Mutable source and operating-policy settings for a code environment.
Members
- environmentConfiguration
-
- Type: EnvironmentConfiguration structure
Operating-policy changes. network replaces the environment's network policy; a network without allowedDomains allows no domains. Builds accepted before the change keep the domains they were accepted with. patchCreationPolicy replaces the patch creation policy. scanFrequency updates scan cadence. Omitted members preserve their stored values.
- sourceConfiguration
-
- Type: EnvironmentSourceConfiguration structure
Source changes. s3Sources replaces the environment's S3 source, and repositorySources replaces its repository selections.
UpdateEnvironmentConfiguration
Description
Type-specific changes to an environment. Omitted members preserve stored values.
Members
- codeConfiguration
-
- Type: UpdateCodeConfiguration structure
Changes to a code-scanning environment.
UpdateProviderConfiguration
Description
Provider-specific changes for updating an integration. Only S3 integrations can be updated, so S3 is the only member.
Members
- s3
-
- Type: UpdateS3Configuration structure
Replacement credentials for a customer-managed S3 integration.
UpdateS3Configuration
Description
Replacement credentials for a customer-managed S3 integration. The bucket cannot be changed.
Members
- externalId
-
- Type: string
The replacement external ID used when assuming the supplied role. If omitted, the existing external ID is preserved. This value is sensitive and is never included in the public integration response.
- roleArn
-
- Required: Yes
- Type: string
The role to use. Supply the current role when rotating only the external ID. The caller must be allowed to pass this exact role to Continuum.
ValidationEvidenceBody
Description
Projected content for a VALIDATION_EVIDENCE artifact: the validation agent's durable proof of exploitability.
Members
- attackFlowsConfirmed
-
- Type: Array of strings
Identifiers of attack flows upgraded to Confirmed provenance.
- executedProof
-
- Type: ValidationExecutedProof structure
Proof the agent produced by executing code against the repository under test, with the output that execution produced.
- exploitArtifact
-
- Type: ValidationExploitArtifact structure
Concrete payload and its observed effect, when validation produced one by sending an HTTP request.
Only an HTTP proof projects here. A validation agent that proves exploitability by RUNNING code against the repository projects
executedProof, and one that proves it by reading the source projectssourceAnalysis. All three are mutually exclusive: at most one is present. - exploitable
-
- Required: Yes
- Type: string
Exploitability verdict. Explicit UNCERTAIN replaces the producer's tri-state
exploitable: true | false | null, so an absent verdict is never confused with a negative one. - flowVerdicts
-
- Type: Array of FlowVerdict structures
One verdict per attack flow assessed in the bundle.
- perFindingResults
-
- Type: Array of PerFindingResult structures
Per-finding breakdown for a multi-finding bundle. Absent for a single-finding bundle.
- sourceAnalysis
-
- Type: ValidationSourceAnalysis structure
Proof the agent produced by reading the repository's source, with nothing built or run.
- terminalStatus
-
- Type: string
How the validation run ended. Absent when the producer reported a status with no mapping yet: the rest of the body still projects, so one unmapped enum never costs a customer the whole artifact.
ValidationException
Members
- fieldList
-
- Type: Array of ValidationExceptionField structures
- message
-
- Required: Yes
- Type: string
ValidationExceptionField
Members
- message
-
- Required: Yes
- Type: string
- path
-
- Required: Yes
- Type: string
ValidationExecutedProof
Description
Proof of exploitability the validation agent produced by executing code against the repository under test, with the output that execution produced.
Members
- code
-
- Required: Yes
- Type: ValidationProofCode structure
The code that was run. Not a request payload: it imports the repository's own modules and drives the vulnerable code path directly.
- observedEffect
-
- Type: string
Effect the execution actually produced.
observedEffectrather thaneffect: this one was witnessed, and the name has to stay distinguishable fromValidationSourceAnalysis.inferredEffect, which was not. - output
-
- Type: ValidationProofOutput structure
What the execution printed, including the agent's own PASS/FAIL assertions. Absent when the run printed nothing retained.
ValidationExploitArtifact
Description
A concrete exploit payload and the effect validation observed from it.
Members
- effect
-
- Required: Yes
- Type: string
Effect observed from sending the payload.
- headers
-
- Type: Associative array of custom strings keys (ArtifactCitation) to strings
Headers sent with the payload.
- httpMethod
-
- Required: Yes
- Type: string
HTTP method the payload was sent with.
- payload
-
- Required: Yes
- Type: string
The exact payload sent.
- responseSnippet
-
- Type: string
Leading portion of the response body, bounded by the producer.
- responseStatus
-
- Type: int
HTTP status observed in the response.
- targetUrl
-
- Required: Yes
- Type: string
Target the payload was sent to.
ValidationProofCode
Description
The executed proof's program. Further members, such as command, workingDirectory and supportingInputs, can be added later as optional details.
Members
- proofCode
-
- Required: Yes
- Type: Array of ValidationProofMaterial structures
Proof program files, main file first, in their retained order.
ValidationProofMaterial
Description
One proof program file. Further members, such as path and purpose, can be added later as optional details.
Members
- content
-
- Required: Yes
- Type: string
The file's non-blank text, exactly as retained.
ValidationProofOutput
Description
Retained run output. Further members, such as completion and outputCompleteness, can be added later as optional details.
Members
- consoleOutput
-
- Required: Yes
- Type: string
What the run printed: standard output and standard error merged, as retained. The text may be empty.
ValidationSourceAnalysis
Description
Proof of exploitability the validation agent produced by reading the repository's source, with nothing built or run. Further members, such as diagram and references, can be added later as optional details.
Members
- inferredEffect
-
- Type: string
Effect the agent concluded WOULD occur. Deliberately not
effect: nothing was executed, so this is reasoned from the source and must not be read as an observation. SeeValidationExecutedProof.observedEffect. - summary
-
- Required: Yes
- Type: string
The non-blank analysis as Markdown: the annotated entry-to-sink walk, its citations, and why the checked guards are absent or bypassed.