# Export API: Specifications, columns, and filters The Export API, which Snyk Analytics supports, makes it easier to export data by allowing users to create and manage CSV files. These files are safely stored by Snyk. Designed for efficiency and security, the Export API helps users organize and scale the export of large datasets, which is useful for reporting and analytics tasks. You can use the Export API to export the Snyk **issues** and **usage** **events** datasets in the scope of `Snyk Organization` or `Snyk Group`. Navigate to the [available columns and filters](#available-columns-and-filters) section to see the full lists. {% hint style="info" %} Before running the first export, ensure that all API requests include: * The API version parameter. The latest version is `2024-10-15`. You can also include the date of the current day for the version if you want to auto-upgrade when you use the API. * The authorization header. Use a user or a service account Snyk API Token. * The `dataset` parameter. The only valid values are `issues` or `usage`. This parameter is required to specify which dataset you want to export. * At least one date filter (`introduced` for the `issues` dataset or `updated` for either) {% endhint %} ## Data consumption process The Export API includes three endpoints for each scope, where the scope can be `Snyk Organization` or `Snyk Group`. Use the following workflow to successfully run an export using this API. 1. **Initiate the export**\ Start by initiating an export process. The response to that request returns the `export_id`.\ Set the [filters and columns](#available-columns-and-filters) based on your preferences. ```javascript POST /groups/{group_id}/export ``` 2. **Validate the export status**\ Validate the status using the export status endpoint and the `export_id` returned in the previous step.\ Available statuses: * `PENDING` - the export process is preparing to start * `STARTED` - the export process has started * `FINISHED` - the export process has completed successfully. If the process finishes successfully when this request arrives, the results data will be included in the response. * `ERROR` - the export process has failed ```javascript GET /groups/{group_id}/jobs/export/{export_id} ``` 3. **Fetch results**\ After the export process returns the `FINISHED` status, fetch the exported files using the export result endpoint. Use the `export_id` returned in the first step. ```javascript GET /groups/{group_id}/export/{export_id} ``` ## Export API specifications ### Data freshness The data provided by the Export API service updates approximately every two hours. Given the data freshness, cyclic exports should not be scheduled more frequently than once every two hours. ### Rate limits The API is limited by: * The export `POST` endpoint allows up to 20 export requests per hour, while the status checks and results retrieval are unlimited. {% hint style="info" %} Given that the data is typically refreshed every two hours, Snyk anticipates that the applied rate limits will allow comfortable consumption. Snyk recommends requesting an export per relevant Group once in a few hours or on a daily basis. {% endhint %} ### Data retention The exported CSV files will remain available for a period of three days. {% hint style="danger" %} While the files are accessible for three days, the self-signed link to retrieve the export results is available only for 60 minutes after its creation by default. Users can limit the link expiration by passing a value between 0 and 3600 to the `url_expiration_seconds` attribute. {% endhint %} The storage location of your export depends on where your Snyk instance is hosted. | Snyk instance host | Storage location | | ------------------ | --------------------------------- | | AWS | AWS S3 bucket | | GCP | Google Cloud Storage (GCS) bucket | ## Available columns and filters ### Default columns If the Export API call does not define the specific columns, the returned data includes all the available columns by default. ### Available filters Although the requested filters are not case-sensitive, the values for those filters are case-sensitive. Use the exact filter value as it appears in the Snyk Web UI. To clarify this requirement, case-sensitive filters are indicated in the table of available filters. {% hint style="info" %} At least one date filter (`introduced` for the `issues` dataset or `updated` for either) must be included in your request. {% endhint %}
FilterApplicable DatasetsDescription
updated (from and to)issues, usage

The date and time of the last update that affected any attribute in the dataset.

Use this filter during cyclic exports to export only data that was updated since the last export.


Acceptable format: YYYY-MM-DDTHH:MM:SSZ
(example: 2024-11-28T09:10:00Z)

introduced (from and to)issuesDate when the issue was introduced.
Acceptable format: YYYY-MM-DDTHH:MM:SSZ
(example: 2024-11-28T09:10:00Z)
orgsissues, usageSnyk Organization ID (available only for the Group endpoints).
environmentissuesThe environment of the Project (case insensitive).
lifecycleissuesThe lifecycle of the Project (case insensitive).
product_nameissuesName of the Snyk product that produced the issue (case sensitive).
project_typeissuesThe scanning method to use for a particular Project (case sensitive).
project_tagsissuesAll tags (as key:value pair) which have been assigned to this Project (case sensitive).
empty_project_tagsissues

Takes one of three values:

  • include - Includes issues with null/empty project tags when using the project_tags filter.
  • exclude - Excludes issues with null/empty project tags. (Not necessary when using the project_tags filter, which implicitly filters these out.)
  • only - Returns only issues with null/empty project tags. Request will return 0 issues if the project_tags filter is also populated.
issue_statusissuesFilter by Open, Resolved, or Ignored.
issue_typeissuesLimit results to vulnerabilities or licenses.
project_originissuesFilter by source, such as CLI, GitHub, or Jenkins.
project_target_refissuesTarget specific branches or artifacts.
cveissuesSearch for a specific vulnerability ID.
nvd_severityissuesFilter based on external severity ratings.
reachabilityissuesSeparate reachable from unreachable vulnerabilities.
project_target_display_nameissuesUse human-readable names for your reports.
### Issues dataset columns #### Available columns
A list of all columns that can be easily copied to the request body ```json "PROBLEM_ID", "GROUP_PUBLIC_ID", "GROUP_DISPLAY_NAME", "ORG_PUBLIC_ID", "ORG_SLUG", "EPSS_SCORE", "EPSS_PERCENTILE", "ISSUE_SEVERITY", "SCORE", "NVD_SCORE", "PROBLEM_TITLE", "CVE", "CWE", "VULN_DB_URL", "NVD_SEVERITY", "PROJECT_NAME", "PROJECT_URL", "PROJECT_PUBLIC_ID", "PROJECT_IS_MONITORED", "PROJECT_OWNER_USERNAME", "PROJECT_ORIGIN", "PROJECT_CRITICALITIES", "PROJECT_ENVIRONMENTS", "PROJECT_LIFECYCLES", "PROJECT_TAGS", "PROJECT_TARGET_DISPLAY_NAME", "PROJECT_TARGET_REF", "PROJECT_COLLECTIONS", "EXPLOIT_MATURITY", "COMPUTED_FIXABILITY", "EXISTS_IN_DIRECT_DEPENDENCY", "FIRST_INTRODUCED", "LAST_INTRODUCED", "LAST_IGNORED", "LAST_RESOLVED", "PRODUCT_NAME", "ISSUE_URL", "ISSUE_STATUS", "ISSUE_TYPE", "ISSUE_SUB_TYPE", "FIXED_IN_AVAILABLE", "FIXED_IN_VERSION", "SEMVER_VULNERABLE_RANGE", "INTRODUCTION_CATEGORY", "VULNERABILITY_PUBLICATION_DATE", "PACKAGE_NAME_AND_VERSION", "SNYK_CVSS_SCORE", "SNYK_CVSS_VECTOR", "REACHABILITY", "GROUP_SLUG", "ORG_DISPLAY_NAME", "PROJECT_TYPE", "PROJECT_TYPE_DISPLAY_NAME", "PROJECT_TEST_FREQUENCY", "PROJECT_TARGET_RUNTIME", "PROJECT_IS_PRIVATE_TARGET", "PROJECT_TARGET_SOURCE_TYPE", "PROJECT_TARGET_SOURCE_TYPE_DISPLAY_VALUE", "PROJECT_TARGET_UPSTREAM_URL", "PROJECT_TARGET_FILE", "PROJECT_OWNER_EMAIL", "ISSUE_DELETED_AT", "PROJECT_DELETED_AT", "GROUP_DELETED_AT", "COMMIT_ID", "FILE_PATH", "CODE_REGION", "CODE_REGION_DISPLAY_VALUE", "ASSET_FINDING_ID", "ASSET_ID", "PARENT_ASSET_ID", "ASSET_NAME", "PARENT_ASSET_NAME", "ASSET_CLASS", "ASSET_TYPE", "ASSET_TAGS", "REPOSITORY_FRESHNESS", "ASSET_APPLICATION", "ASSET_OWNER", "ASSET_CATEGORY", "ASSET_CATALOG_NAME", "ASSET_LIFECYCLE", "JIRA_ISSUES", "HAS_JIRA_ISSUE_ASSIGNED", "LATEST_JIRA_ISSUE", "UPDATED_AT" ```
#### Severity
Column nameDescription
scoreA score based on an analysis model. Priority score is released in General Availability, while Risk Score is in Early Access.
issue_severityIndicates the assessed level of risk, critical, high, medium, or low.
snyk_cvss_scoreThe Snyk recommended Common Vulnerability Scoring System (CVSS) score.
nvd_severityThe severity of a vulnerability as rated by NVD.
nvd_scoreThe score of a vulnerability as calculated by NVD.
#### Likelihood
Column nameDescription
exploit_maturityRepresents the legacy existence and maturity, as defined by Snyk, of public exploits validated by Snyk, for example, Mature or Proof of Concept.
exploit_maturity_cvss_v4Represents the existence and maturity of public exploits validated by Snyk, using the CVSS v4 values: Not Defined, POC, Attacked.
snyk_cvss_vectorThe vector string of the metric values used to determine the CVSS score.
epss_scoreThe probability of exploitation in the wild in the next 30 days.
epss_percentileThe proportion of all vulnerabilities with the same or lower EPSS score.
reachabilityIndicates whether the issue is related to functions that are being called by the application and thus has a greater risk of exploitability.
project_is_private_targetIndicates whether the Target's source is private or publicly reachable.
#### Impact
Column nameDescription
asset_classThe customer configured business criticality of the asset (A, most critical to D, least critical).
project_target_runtimeThe environment in which the Target is executed and run.
project_criticalitiesA Project attribute that indicates business criticality. For example, low, medium, high, critical.
project_lifecyclesA Project attribute, for example, production, development, sandbox.
asset_lifecycleThe lifecycle state of the asset.
project_environmentsA Project attribute, for example, frontend, backend, internal, external, mobile, saas, onprem, hosted, distributed.
#### SCA fixability
Column nameDescription
computed_fixabilityIndicates whether the issue can be fixed based on the vulnerability remediation paths.
fixed_in_availableIndicates whether Is the given vulnerability fixed in a different version of the responsible source.
fixed_in_versionThe first version in which a given vulnerability was fixed.
exists_in_direct_dependencyIndicates if the vulnerability exists in a direct dependency. If false, the vulnerability only exists in transitive dependencies.
#### Snyk hierarchy
Column nameDescription
group_public_idA universally unique identifier for a Group, assigned in the source database of the record.
org_public_idA universally unique identifier for an Organization, assigned in the source database of the record.
group_display_nameThe display name set for this Group.
group_slugThe name of the Group within Snyk.
org_display_nameThe display name set for this Organization.
org_slugThe name for the Organization within Snyk.
**Issue context**
Column nameDescription
problem_idSnyk Vulnerability Database ID that uniquely identifies the vulnerability.
product_nameThe Snyk product which initially identified the issue.
problem_titleName of the Snyk discovered vulnerability.
vuln_db_urlURL which directs to the Snyk Vulnerability Database.
issue_typeIndicates whether the issue is related to a vulnerability, license, or configuration.
issue_sub_typeA more granular variation of issue type.
issue_urlURL that directs to the given Project instance of this vulnerability on the Snyk website.
issue_statusIndicates whether the issue is open, resolved, or ignored.
issue_severityIndicates the assessed level of risk, critical, high, medium, or low.
commit_idthey can be uniquely identified. Snyk provides Commit ID only for Snyk Code issues.
file_pathThe path to the file where Snyk Code identified the specific issue.
code_regionThe line numbers and columns range where the issues were found within a file.
code_region_display_valueThe display representation of the line numbers and columns range where the issues was found within a file.
asset_finding_idA unique issue ID in the level of repository, only applicable for Snyk Code issue
cveThe CVE ID(s).
cweThe CWE ID(s).
introduction_categoryA classification generated by Snyk describing how an issue was introduced in the context of using Snyk products, such as Baseline Issue, Non-Preventable Issue, and Preventable Issue.
package_name_and_versionThe associated package name and version of the vulnerability.
semver_vulnerable_rangeThe vulnerable range of package versions (based on semantic versioning).
vulnerability_publication_dateThe date a given vulnerability was first published by Snyk.
has_jira_issue_assignedDisplays true when at least one Jira issue is assigned, otherwise displays false.
latest_jira_issueThe most recently created Jira Issue for this issue.
jira_issuesAll Jira Issues ever created for this issue.
first_introducedThe timestamp of the first scan that identified the issue.
last_introducedThe most recent instance of an issue having been introduced (or reintroduced).
last_ignoredThe most recent instance of an issue has been ignored within the Snyk product.
last_resolvedThe most recent instance of an issue having been resolved.
issue_deleted_atWhen the issue record was deleted from Snyk.
updated_atWhen the issue or any related context was last updated.
**Project and Target context**
Column nameDescription
project_public_idA universally unique identifier for a Project, assigned in the source database or the record.
project_nameThe name given to this Project, when added to Snyk.
project_urlThe project URL in Snyk platform.
project_is_monitoredThe Project is set to be actively monitored. By default, the API returns only monitored issues of the Project. To fetch issues of deactivated Projects, check the API parameters.
project_typeThe scanning method to use for a particular Project, such as Static Application Security Testing (SAST) for scanning using Snyk Code, or Maven for a Maven Project using Snyk Open Source. This is part of the configuration for scanning.
project_type_display_nameA display name Snyk assigned to internal Project type values.
project_test_frequencyThe frequency of testing for a given Project, for example, Daily, Weekly, and so on.
project_originThe Origin defines the Target ecosystem, such as CLI, GitHub, or Kubernetes. Origins are a property of Targets.
project_target_refA reference that differentiates this Project, for example, a branch name or version. Projects having the same reference can be grouped based on that reference.
project_target_runtimeThe environment in which the Target is executed and run.
project_target_display_nameA display name for the Project's Target.
project_is_private_targetIndicates whether the Target's source is private or publicly reachable
project_target_source_typeThe hosting provider of a givenTarget, for example, docker-hub, github, and so on.
project_target_source_type_display_valueA display value that represents the grouping forTarget sources, for example, Source Control, Container Registry, and so on.
project_target_upstream_urlThe URL that points to a Target's upstream source, such as a URL for a GitHub repository.
project_target_fileThe full file path within a project that Snyk is targeting for security scanning, such as /var/www/composer.lock, /app/package.json, or other dependency manifest files.
project_criticalitiesA Project attribute that indicates business criticality. For example, low, medium, high, critical.
project_lifecyclesA Project attribute, for example, production, development, sandbox.
project_environmentsA Poject attribute, for example, frontend, backend, internal, external, mobile, saas, onprem, hosted, distributed.
project_collectionsAll Project collections to which this Project has been added.
project_tagsAll tags which have been assigned to this Project.
project_owner_emailThe email of the user assigned as the owner of this Project.
project_owner_usernameThe username of the user assigned as the owner of this Project.
**Assets and application context**
Column nameDescription
asset_idAsset ID.
parent_asset_idParent Asset ID.
asset_nameThe display name of the asset.
parent_asset_nameThe display name of the parent asset.
asset_classThe customer configured business criticality of the asset (A, most critical to D, least critical).
asset_typeSpecific type of the asset (Repository, Package, Container Image, Image Package, or Scanned Artifact).
asset_tagsArray of the tags that were assigned to the asset based on imported data or user input.
repository_freshnessThe repository activity status based on the last commit date.
asset_applicationThe application or service that the asset is associated with.
asset_ownerThe code owner of the asset, usually a development team.
asset_categoryCategory from integrated development platforms, such as Backstage and Roadie.
asset_catalog_nameThe catalog name as mentioned in the application context (ServiceNow, DataDog, and so on).
asset_lifecycleThe lifecycle state of the asset.
### Usage events dataset columns #### Available columns
A list of all columns that can be easily copied to the request body ```yaml "ID", "ORG_PUBLIC_ID", "GROUP_PUBLIC_ID", "PRODUCT_DISPLAY_NAME", "INTERACTION_TYPE", "INTERACTION_CATEGORIES", "INTERACTION_TIMESTAMP", "INTERACTION_STATUS", "INTERACTION_STAGE", "INTERACTION_EXIT_CODE", "INTERACTION_TARGET_ID", "RUNTIME_APPLICATION_NAME", "RUNTIME_APPLICATION_VERSION", "RUNTIME_APPLICATION_DATA_SCHEMA_VERSION", "RUNTIME_PLATFORM_OS", "RUNTIME_PLATFORM_ARCH", "RUNTIME_ENVIRONMENT_NAME", "ENVIRONMENT_DISPLAY_NAME", "RUNTIME_ENVIRONMENT_VERSION", "RUNTIME_INTEGRATION_NAME", "RUNTIME_INTEGRATION_VERSION", "RUNTIME_PERFORMANCE_DURATION_MS", "USER_EMAIL", "USER_NAME", "ORG_DISPLAY_NAME", "ORG_SLUG", "GROUP_DISPLAY_NAME", "GROUP_SLUG", "ORG_DELETED_AT", "GROUP_DELETED_AT", "UPDATED_AT" ```
#### Interaction context
Column nameDescription
idA unique identifier for an interaction event
product_display_nameThe Snyk product used during this interaction, for example, Snyk Open Source, Snyk IaC, Snyk Code, Snyk Container.
interaction_typeThe type of interaction, could be "Scan done". Scan Done indicates that a test was run no matter if the CLI or IDE ran it, other types can be freely chosen types.
interaction_categoriesThe category vector used to describe the interaction in detail, "oss", "test".
interaction_timestampWhen the interaction was started in UTC.
interaction_statusStatus would be "success" or "failure", where success means the action was executed, while failure means it didn't run.
interaction_stageThe stage of the SDLC where the Interaction occurred, such as "dev"|"cicd"|"prchecks"|"unknown".
interaction_exit_codeThe interaction's exit code as returned by the running process. More info about the exit codes and their meaning is available in Snyk Docs per a given interaction (test, monitor, and so on).
interaction_target_idA purl is a URL composed of seven components. scheme:type/namespace/name@version?qualifiers#subpath The purl specification is available here: https://github.com/package-url/purl-spec Some purl examples pkg:github/package-url/purl-spec@244fd47e07d1004f0aed9c pkg:npm/%40angular/animation@12.3.1 pkg:pypi/django@1.11.1
updated_atWhen the interaction event or any related context was last updated.
#### Runtime context
Column nameDescription
runtime_application_nameThe application used to execute a snyk interaction, for example, PyCharm, Visual Studio, snyk-ls, snyk-cli.
runtime_application_versionThe version of the integration.
runtime_application_data_schema_versionThe data schema version of Snyk's runtime interactions. The current version (v2) was released in Q2 2024. Prior versions' data may behave differently.
runtime_platform_osThe operating system for the integration (darwin, windows, linux, etc).
runtime_platform_archThe architecture for the integration (AMD64, ARM64, 386, ALPINE).
runtime_environment_nameThe environment for the integration (e.g., IntelliJ Ultimate, Pycharm).
environment_display_nameThe Environment used during this interaction, for example: CLI, Eclipse, Jetbrains IDE, Visual Studio, Visual Studio Code, or Other
runtime_environment_versionThe version of the integration environment (e.g. 2023.3)
runtime_integration_nameThe name of the integration, could be a plugin or extension.
runtime_integration_versionThe version of the integration, for example: 2.3.4.
runtime_performance_duration_msThe duration in milliseconds of the interaction
#### Snyk hierarchy
Column nameDescription
group_public_idA universally unique identifier for a Group, assigned in the source database of the record.
org_public_idA universally unique identifier for an Organization, assigned in the source database of the record.
group_display_nameThe display name set for this Group.
group_slugThe name of the Group within Snyk.
org_display_nameThe display name set for this Organization.
org_slugThe name for the Organization within Snyk.
user_emailThe email of the user who was authenticated during the interaction.
user_nameThe name of the user who was authenticated during the interaction.