Tests

This document uses the REST API. For more details, see the Authentication for API page.

Create a new test. (Early Access)

post

Create a new test.

Currently the Test API Shim supports 2 paths to starting Tests:

• Subject-based (DEPRECATED Jan 2026)
• Resource-based (Preferred)

Resource-based Tests are the foundation for the Test API moving forward. Resources represent a "thing" to be Tested by Snyk, including both what that thing is as well as where to find it. Resources should always be provided with a ScanConfiguration in the TestConfiguration. The ScanConfiguration contains scanner-specific parameter objects for the scanners offered by Snyk. The presence of a specific scanner's config informs the Test API to attempt to use that scanner to Test the Resource(s).

The design of the Resource & ScanConfig structure is that Snyk will handle determining which requested Scans can be performed on the provided list of Resources.

Currently, the Test API supports running one Scanner on the provided Resources, and each scanner only in combination with specific sets of Resources.

Resource-based Tests that are currently supported are:

• Secrets Scan (Closed Beta): Secrets ScanConfig + (1) Upload Resource containing Source code.
• SBOM SCA Scan (Early Access): SCA ScanConfig + (1) Upload Resource containing an SBOM.
• SBOM SCA Scan + Reachability Analysis (Early Access): SCA ScanConfig + (2) Upload Resources, one containing Source Code and another containing an SBOM.

As more Test flows are made available through the Test API, this listing will be updated.

---

Subject-based Tests represent the initial version of the Test API and use a "Subject" to inform Snyk of both what should be Tested as well as how to Test it - e.g. a DepGraph Subject tells the Shim to Test the provided DepGraph using the Open Source scanner.

Currently supported Subjects are:

• Dep Graph (SCA Scan)
• SBOM Bundle (SCA Scan)
• SBOM + Reachability Bundle (SCA Scan)

Each of these Subjects is available for use through the Test API and will run and yield results for users with appropriate permissions.

Other Subjects that are present in the API specification and are not officially released are:

• Git URL
• Deepcode Bundle

Either of these Subjects will be accepted through the API, but are not guaranteed to return enriched Test results.

Required permissions

• View Organization (org.read)

• Test packages (org.package.test)

Authorizations

APITokenBearerAuth

AuthorizationstringRequired

API key value must be prefixed with "Token ".

Path parameters

org_idstring · uuidRequired

Snyk Org ID under which to run or query information about a Job or Test.

Query parameters

versionstringRequired

The API version requested.

Header parameters

snyk-request-idstring · uuidOptional

A unique ID assigned to each API request, for tracing and troubleshooting.

Snyk clients can optionally provide this ID.

snyk-interaction-idstring · min: 36 · max: 128Optional

Identifies the Snyk client interaction in which this API request occurs.

The identifier is an opaque string. though at the time of writing it may either be a uuid or a urn containing a uuid and some metadata.

Body

application/vnd.api+json

TestRequestBody represents the request body used when creating an Test.

Responses

202

The request has been accepted for processing, but processing has not yet completed.

application/vnd.api+json

400

Invalid input

application/vnd.api+json

post

/orgs/{org_id}/tests

HTTPcURLJavaScriptPython

POST /rest/orgs/{org_id}/tests?version=text HTTP/1.1
Host: api.snyk.io
Authorization: YOUR_API_KEY
Content-Type: application/vnd.api+json
Accept: */*
Content-Length: 1215

{
  "data": {
    "attributes": {
      "config": {
        "local_policy": {
          "fail_on_upgradable": false,
          "ignores": [
            {
              "created_at": "2026-02-03T12:50:34.095Z",
              "expires_at": "2026-02-03T12:50:34.095Z",
              "path": [
                "[email protected]",
                "org.apache.logging.log4j:[email protected]"
              ],
              "reason": "False positive",
              "skip_if_fixable": true,
              "vuln_id": "SNYK-JAVA-ORGAPACHELOGGINGLOG4J-31456"
            }
          ],
          "reachability_filter": "reachable",
          "risk_score_threshold": 1,
          "severity_threshold": "critical",
          "suppress_pending_ignores": false
        },
        "project_business_criticality": "text",
        "project_environment": [
          "text"
        ],
        "project_lifecycle": [
          "text"
        ],
        "project_tags": [
          "text"
        ],
        "publish_report": true,
        "scan_config": {
          "secrets": {}
        },
        "target_name": "text",
        "target_reference": "text",
        "timeout": {
          "outcome": "pass",
          "seconds": 1
        }
      },
      "resources": [
        {
          "resource": {
            "content_type": "source",
            "file_patterns": [
              "*.go"
            ],
            "repository_url": "https://example.com/source/repo",
            "revision_id": "abcde12345",
            "type": "upload"
          },
          "type": "base"
        },
        {
          "resource": {
            "ref_id": "6BD4F5E2-D4E8-4C6B-BB0E-ECF0A70423F5",
            "reference_type": "target",
            "type": "snyk_ref"
          },
          "type": "base"
        }
      ],
      "subject": {
        "bundle_id": "text",
        "locator": {
          "paths": [
            "text"
          ],
          "type": "local_path"
        },
        "type": "deepcode_bundle"
      },
      "subject_locators": [
        {
          "paths": [
            "package.json"
          ],
          "type": "local_path"
        }
      ]
    },
    "type": "tests"
  }
}

{
  "data": {
    "attributes": {
      "created_at": "2026-02-03T12:50:34.095Z",
      "status": "pending"
    },
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "type": "test_jobs"
  },
  "jsonapi": {
    "version": "1.0"
  },
  "links": {
    "related": "https://example.com",
    "self": "https://example.com",
    "ANY_ADDITIONAL_PROPERTY": "https://example.com"
  },
  "meta": {
    "ANY_ADDITIONAL_PROPERTY": "anything"
  }
}

Get a test. (Early Access)

get

Get a test.

A Test returned through this endpoint is intended to be a completed Test with results. The data returned through this endpoint does not contain the Findings for the Test, but a description of the Test that was run and its status.

Tests that completed successfully are marked with an appropriate outcome according to the configured Thresholds.

Facts about the Test (e.g. how many dependencies were present in a Tested SBOM) are attached to this response as well as a summary of the Findings uncovered during the Test.

Any Errors or Warnings that occurred during the Test will be present in the response from this endpoint.

Required permissions

• View Organization (org.read)

Authorizations

APITokenBearerAuth

AuthorizationstringRequired

API key value must be prefixed with "Token ".

Path parameters

org_idstring · uuidRequired

Snyk Org ID under which to run or query information about a Job or Test.

test_idstring · uuidRequired

Test ID returned from the Test API to query.

Query parameters

versionstringRequired

The API version requested.

Header parameters

snyk-request-idstring · uuidOptional

A unique ID assigned to each API request, for tracing and troubleshooting.

Snyk clients can optionally provide this ID.

snyk-interaction-idstring · min: 36 · max: 128Optional

Identifies the Snyk client interaction in which this API request occurs.

The identifier is an opaque string. though at the time of writing it may either be a uuid or a urn containing a uuid and some metadata.

Responses

200

Successful API response with a single resource

application/vnd.api+json

400

Invalid input

application/vnd.api+json

get

/orgs/{org_id}/tests/{test_id}

HTTPcURLJavaScriptPython

GET /rest/orgs/{org_id}/tests/{test_id}?version=text HTTP/1.1
Host: api.snyk.io
Authorization: YOUR_API_KEY
Accept: */*

{
  "data": {
    "attributes": {
      "config": {
        "local_policy": {
          "fail_on_upgradable": false,
          "ignores": [
            {
              "created_at": "2026-02-03T12:50:34.095Z",
              "expires_at": "2026-02-03T12:50:34.095Z",
              "path": [
                "[email protected]",
                "org.apache.logging.log4j:[email protected]"
              ],
              "reason": "False positive",
              "skip_if_fixable": true,
              "vuln_id": "SNYK-JAVA-ORGAPACHELOGGINGLOG4J-31456"
            }
          ],
          "reachability_filter": "reachable",
          "risk_score_threshold": 1,
          "severity_threshold": "critical",
          "suppress_pending_ignores": false
        },
        "project_business_criticality": "text",
        "project_environment": [
          "text"
        ],
        "project_lifecycle": [
          "text"
        ],
        "project_tags": [
          "text"
        ],
        "publish_report": true,
        "scan_config": {
          "secrets": {}
        },
        "target_name": "text",
        "target_reference": "text",
        "timeout": {
          "outcome": "pass",
          "seconds": 1
        }
      },
      "created_at": "2026-02-03T12:50:34.095Z",
      "effective_summary": {
        "count": 30,
        "count_by": {
          "result_type": {
            "sast": 12,
            "sca": 18
          },
          "severity": {
            "critical": 2,
            "high": 3,
            "low": 15,
            "medium": 10
          }
        }
      },
      "outcome": {
        "breached_policies": {
          "ids": [
            "123e4567-e89b-12d3-a456-426614174000"
          ],
          "local_policy": true
        },
        "reason": "policy_breach",
        "result": "pass"
      },
      "raw_summary": {
        "count": 30,
        "count_by": {
          "result_type": {
            "sast": 12,
            "sca": 18
          },
          "severity": {
            "critical": 2,
            "high": 3,
            "low": 15,
            "medium": 10
          }
        }
      },
      "resources": [
        {
          "resource": {
            "content_type": "source",
            "file_patterns": [
              "*.go"
            ],
            "repository_url": "https://example.com/source/repo",
            "revision_id": "abcde12345",
            "type": "upload"
          },
          "type": "base"
        },
        {
          "resource": {
            "ref_id": "6BD4F5E2-D4E8-4C6B-BB0E-ECF0A70423F5",
            "reference_type": "target",
            "type": "snyk_ref"
          },
          "type": "base"
        }
      ],
      "state": {
        "errors": [
          {
            "code": "text",
            "detail": "text",
            "id": "123e4567-e89b-12d3-a456-426614174000",
            "links": {
              "about": "https://example.com",
              "ANY_ADDITIONAL_PROPERTY": "https://example.com"
            },
            "meta": {},
            "source": {
              "parameter": "text",
              "pointer": "text"
            },
            "status": "text",
            "title": "text"
          }
        ],
        "execution": "pending",
        "warnings": [
          {
            "code": "text",
            "detail": "text",
            "id": "123e4567-e89b-12d3-a456-426614174000",
            "links": {
              "about": "https://example.com",
              "ANY_ADDITIONAL_PROPERTY": "https://example.com"
            },
            "meta": {},
            "source": {
              "parameter": "text",
              "pointer": "text"
            },
            "status": "text",
            "title": "text"
          }
        ]
      },
      "subject": {
        "bundle_id": "text",
        "locator": {
          "paths": [
            "text"
          ],
          "type": "local_path"
        },
        "type": "deepcode_bundle"
      },
      "subject_locators": [
        {
          "paths": [
            "package.json"
          ],
          "type": "local_path"
        }
      ],
      "test_facts": [
        {
          "total_dependency_count": 1,
          "type": "dependency_count_fact"
        }
      ]
    },
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "links": {
      "findings": "https://example.com"
    },
    "type": "tests"
  },
  "jsonapi": {
    "version": "1.0"
  },
  "links": {
    "related": "https://example.com",
    "self": "https://example.com",
    "ANY_ADDITIONAL_PROPERTY": "https://example.com"
  },
  "meta": {
    "ANY_ADDITIONAL_PROPERTY": "anything"
  }
}

Get a test job. (Early Access)

get

Get a test job.

The Test API is Asynchronous, and Tests begun through the API are assigned a Job ID which references the in-progress Test. The Job ID is provided in a successful response from the CreateTest endpoint.

This endpoint is used to poll for the status of a Test using its associated Job ID.

When the Job is Finished and the Test is ready for consumption, the Related link will be populated in the response with a link to the finished Test entity.

Required permissions

• View Organization (org.read)

Authorizations

APITokenBearerAuth

AuthorizationstringRequired

API key value must be prefixed with "Token ".

Path parameters

org_idstring · uuidRequired

Snyk Org ID under which to run or query information about a Job or Test.

job_idstring · uuidRequired

Job ID returned from the Test API to query.

Query parameters

versionstringRequired

The API version requested.

Header parameters

snyk-request-idstring · uuidOptional

A unique ID assigned to each API request, for tracing and troubleshooting.

Snyk clients can optionally provide this ID.

snyk-interaction-idstring · min: 36 · max: 128Optional

Identifies the Snyk client interaction in which this API request occurs.

The identifier is an opaque string. though at the time of writing it may either be a uuid or a urn containing a uuid and some metadata.

Responses

200

Successful API response with a single resource

application/vnd.api+json

303

Redirect to another resource after async processing.

application/vnd.api+json

400

Invalid input

application/vnd.api+json

get

/orgs/{org_id}/test_jobs/{job_id}

HTTPcURLJavaScriptPython

GET /rest/orgs/{org_id}/test_jobs/{job_id}?version=text HTTP/1.1
Host: api.snyk.io
Authorization: YOUR_API_KEY
Accept: */*

{
  "data": {
    "attributes": {
      "created_at": "2026-02-03T12:50:34.095Z",
      "status": "pending"
    },
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "relationships": {
      "test": {
        "data": {
          "id": "123e4567-e89b-12d3-a456-426614174000",
          "type": "tests"
        }
      }
    },
    "type": "test_jobs"
  },
  "jsonapi": {
    "version": "1.0"
  },
  "links": {
    "related": "https://example.com",
    "self": "https://example.com",
    "ANY_ADDITIONAL_PROPERTY": "https://example.com"
  },
  "meta": {
    "ANY_ADDITIONAL_PROPERTY": "anything"
  }
}