Uploading data via API

Upload an application, build, or deploy SBOM file (ConcertDef format)

The following example uploads an application, build, or deploy SBOM file that is called, example-SBOM.json, in ConcertDef format.

$CURL -X 'POST' \
    "https://${concert_host}:${port}/ingestion/api/v1/upload_files" \
    -H 'accept: application/json' \
    -H "InstanceID: 0000-0000-0000-0000" \
    -H "Authorization: <type> ${Concert_API_key}" \ 
    -H 'Content-Type: multipart/form-data' \
    -F "data_type=application_sbom" \
    -F "filename=@my-application-SBOM.json"

Upload a package SBOM (CycloneDX format)

The following example uploads a package SBOM file that is called, my-package-sbom.json, in CycloneDX format.

$CURL -X 'POST' \
    "https://${concert_host}:${port}/ingestion/api/v1/upload_files" \
    -H 'accept: application/json' \
    -H "InstanceID: 0000-0000-0000-0000" \
    -H "Authorization: <type> ${Concert_API_key}" \ 
    -H 'Content-Type: multipart/form-data' \
    -F "data_type=package_sbom" \
    -F "filename=@my-package-SBOM.json"

Upload a vulnerability scan (of image)

The following example uploads a vulnerability scan called, my-image-scan.csv.

$CURL -X 'POST' \
    "https://${concert_host}:${port}/ingestion/api/v1/upload_files" \
    -H 'accept: application/json' \
    -H "InstanceID: 0000-0000-0000-0000" \
    -H "Authorization: <type> ${Concert_API_key}" \ 
    -H 'Content-Type: multipart/form-data' \
    -F "data_type=image_scan" \
    -F "filename=@my-image-scan.csv" \
    -F 'metadata={"scanner_name": "<scan source>"}'

Upload a vulnerability scan (of source code)

The following example uploads a vulnerability scan called, my-code-scan.csv.

$CURL -X 'POST' \
    "https://${concert_host}:${port}/ingestion/api/v1/upload_files" \
    -H 'accept: application/json' \
    -H "InstanceID: 0000-0000-0000-0000" \
    -H "Authorization: <type> ${Concert_API_key}" \ 
    -H 'Content-Type: multipart/form-data' \
    -F "data_type=code_scan" \
    -F "filename=@my-code-scan.csv" \
    -F 'metadata={"scanner_name": "<scan source>"}'

Upload a vulnerability scan (of a runtime or virtual machine)

The following example uploads a vulnerability scan called, my-vm-scan.csv.

$CURL -X 'POST' \
    "https://${concert_host}:${port}/ingestion/api/v1/upload_files" \
    -H 'accept: application/json' \
    -H "InstanceID: 0000-0000-0000-0000" \
    -H "Authorization: <type> ${Concert_API_key}" \ 
    -H 'Content-Type: multipart/form-data' \
    -F "data_type=vm_scan" \
    -F "filename=@my-vm-scan.csv" \
    -F 'metadata={"scanner_name": "<scan source>"}'

Upload a DAST dynamic vulnerability scan

The following example uploads a Dynamic Application Security Testing (DAST) scan that is called, dast-scan.csv.

$CURL -X 'POST' \
    "https://${concert_host}:${port}/ingestion/api/v1/upload_files" \
    -H 'accept: application/json' \
    -H "InstanceID: 0000-0000-0000-0000" \
    -H "Authorization: <type> ${Concert_API_key}" \ 
    -H 'Content-Type: multipart/form-data' \
    -F "data_type=dynamic_scan" \
    -F "filename=@/Users/jsmith/Desktop/dast-scan.csv" \
    -F 'metadata={"env_name": "prod","access_point_name": "<string>","access_point_url": "<url>"}'

Upload a SAST vulnerability scan

The following example uploads a Static Application Security Testing (SAST) scan in SARIF format that is called, sast-scan.csv.

$CURL -X 'POST' \
    "https://${concert_host}:${port}/ingestion/api/v1/upload_files" \
    -H 'accept: application/json' \
    -H "InstanceID: 0000-0000-0000-0000" \
    -H "Authorization: <type> ${Concert_API_key}" \ 
    -H 'Content-Type: multipart/form-data' \
    -F "data_type=static_code_scan" \
    -F "filename=@/Users/jsmith/Desktop/sast-scan.csv" \
    -F 'metadata={"env_name": "prod","repo_url": "<url>", "repo_name":"<string>"}'

Upload certificate details

Certificate data can be uploaded as a csv file or JSON file. For detailed steps and sample files, refer uploading certificate data.

The following example is for uploading a csv file that is called, my-certificates.csv.

$CURL -X 'POST' \
    "https://${concert_host}:${port}/ingestion/api/v1/upload_files" \
    -H 'accept: application/csv' \
    -H "InstanceID: 0000-0000-0000-0000" \
    -H "Authorization: <type> ${Concert_API_key}" \ 
    -H 'Content-Type: multipart/form-data' \
    -F "data_type=certificate" \
    -F 'metadata={"env_name": "prod"}'
    -F "filename=@my-certificates.csv"

The following example uses JSON file that is called my-certificates.json for uploading certificate data.

$CURL -X 'POST' \ "https://${concert_host}:{port}/ingestion/api/v1/upload_files" \ 
-H 'accept: application/json' \ 
-H "InstanceID: 0000-0000-0000-0000" \ 
-H "Authorization: <type> ${Concert_API_key}" \ 
-H 'Content-Type: multipart/form-data" \ 
-F "data_type=certificate" \ 
-F "filename=@my-certificates.json"