SCAIFE API Definition
This API definition facilitates auditing static analysis alerts using classifiers, optional adaptive heuristics, and alert prioritization. The API enables jump-starting labeled datasets using test suites. It is intended to enable a wide range of users (with widely varying datasets, static analysis tools, machine learning expertise, and amount of labeled data) to benefit from using classifiers and sophisticated prioritization to automatically triage static analysis alerts.
Version: 1.0.1
BasePath:
SCAIFE API Copyright 2007-2020 Carnegie Mellon University. All Rights Reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 3. Products derived from this software may not include 'Carnegie Mellon University,' 'SEI' and/or 'Software Engineering Institute' in the name of such derived product, nor shall 'Carnegie Mellon University,' 'SEI' and/or 'Software Engineering Institute' be used to endorse or promote products derived from this software without prior written permission. For written permission, please contact permission@sei.cmu.edu. ACKNOWLEDGMENTS AND DISCLAIMERS: This material is based upon work funded and supported by the Department of Defense under Contract No. FA8702-15-D-0002 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center. The view, opinions, and/or findings contained in this material are those of the author(s) and should not be construed as an official Government position, policy, or decision, unless designated by other documentation. NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN 'AS-IS' BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT. [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution. Please see Copyright notice for non-US Government use and distribution. This material includes field names used in the Software Assurance Marketplace (SWAMP), a service that provides continuous software assurance capabilities to developers and researchers at https://www.mir-swamp.org/#. Copyright © 2012-2020 The Morgridge Institute for Research, Inc. All rights reserved. This material includes field names used in the Software Assurance Tool (SwAT), a tool that is used by analysts to analyze static analysis alerts from multiple static analysis tools. https://www.cerdec.army.mil/ Combat Capabilities Development Command (CCDC) C5ISR Center. All rights reserved. DM19-0572
http://apache.org/licenses/LICENSE-2.0.html
Access
[ Jump to Models ]
Table of Contents
Up
put /packages/{package_id}/alerts
Forward new Alerts that have been uploaded to the DataHub and have a current open adaptive heuristic request for its respective package. Returns status message for the DataHub to track if the request was completed. (sendAlertUpdates)
Path parameters
package_id (required)
Path Parameter — The id of the package associated with these alerts
Consumes
This API call consumes the following media types via the request header:
Request body
Body Parameter — Updated alert data
Request headers
Return type
Example data
Content-Type: application/json
{
"package_id" : "package_id"
}
Produces
This API call produces the following media types according to the request header;
the media type will be conveyed by the response header.
Responses
200
OK
alert_updates_response
400
Unable to Upload Alerts
404
Invalid Package
default
Unexpected Error
error
Up
put /projects/{project_id}/meta_alerts/{meta_alert_id}/determinations
Forward new Determinations that have been uploaded to the DataHub and have a current open adaptive heuristic request. Returns status message for the DataHub to track if the request was completed. (sendDeterminationUpdates)
Path parameters
project_id (required)
Path Parameter — The id of the project associated with this determination
meta_alert_id (required)
Path Parameter — The id of the meta-alert associated with this determination
Consumes
This API call consumes the following media types via the request header:
Request body
Body Parameter — Updated determination data
Request headers
Return type
Example data
Content-Type: application/json
{
"project_id" : "project_id",
"meta_alert_id" : "meta_alert_id"
}
Produces
This API call produces the following media types according to the request header;
the media type will be conveyed by the response header.
Responses
200
OK
determination_update_response
400
Unable to Upload Determination
404
Invalid Project
default
Unexpected Error
error
Up
post /projects/{project_id}/classifiers/{classifier_instance_id}
Send confidence data for a specific project. When there is an active Adaptive Heuristic for projects associated with the UI Module, the Stats Module will send the confidence data for the classifier based on some interval or threshold set by the Adaptive Heuristic. (sendConfidenceData)
Path parameters
project_id (required)
Path Parameter — The id of the project to update
classifier_instance_id (required)
Path Parameter — The id of the classifier instance associated with the confidence data
Consumes
This API call consumes the following media types via the request header:
Request body
Body Parameter — Updated confidence values
Responses
200
OK
404
Invalid Project
default
Unexpected Error
error
Provides Server Status (getStatus)
Request headers
Return type
Example data
Content-Type: application/json
{
"message" : "message",
"request_id" : "request_id"
}
Produces
This API call produces the following media types according to the request header;
the media type will be conveyed by the response header.
Responses
200
Server Is Running
request_token
400
Database Connection Lost
default
Unexpected Error
error
[ Jump to Methods ]
Table of Contents
alert - alert_updates_response - determination - determination_dangerous_construct_list - determination_dead_list - determination_flag_list - determination_ignored_list - determination_inapplicable_environment_list - determination_notes_list - determination_update_response - determination_verdict_list - error - message - meta_alert - multiple_alerts - probability_data - request_token - secondary_message -
alert_id
tool_id
checker_id
primary_message
secondary_messages (optional)
flag_list (optional)
verdict_list (optional)
ignored_list (optional)
dead_list (optional)
inapplicable_environment_list (optional)
dangerous_construct_list (optional)
notes_list (optional)
dangerous_construct (optional)
timestamp (optional)
dead (optional)
timestamp (optional)
flag (optional)
timestamp (optional)
ignored (optional)
timestamp (optional)
inapplicable_environment (optional)
timestamp (optional)
notes (optional)
timestamp (optional)
project_id (optional)
meta_alert_id (optional)
verdict (optional)
timestamp (optional)
line_start
line_end (optional)
filepath
source_file_id
source_function_id (optional)
meta_alert_id
condition_id (optional)
filepath (optional)
line_number (optional)
determination (optional)
alert_ids (optional)
auto_verdict (optional)
meta_alerts (optional)
alerts (optional)
meta_alert_id (optional)
probability (optional)
request_id
String Id used to correlate messages with each other
message (optional)
line_start
line_end (optional)
filepath
source_file_id
source_function_id (optional)
message_text