AWS Continuum finds, validates, prioritizes, and remediates code vulnerabilities across the source repositories and AWS resources in your environments.
", "operations": { "AssociateCollector": "Associates one Collector with this Environment and configures the customer role Continuum uses to authorize access to associated Collector data. The caller must have permission on the Environment and permission to pass the role. Continuum assumes the supplied role and calls GetCollectorDataAccessAuthorization on the requested Collector; only a successful authorization response permits the association. The caller does not need Collector data-access permission. The Environment retains its other Collector associations. Calling again with an existing association is safe and does not create a duplicate.
", "CreateCodeFinding": "Ingests a customer-supplied security finding into an environment. Continuum validates the document synchronously against the required overlay fields for the declared format; invalid documents are rejected with a ValidationException. The maximum accepted document size is 256 KB. The environment must have a source configured, and the finding must identify a code location so Continuum can tie it to a repository in the environment's build. Continuum assigns a findingId and stores the verbatim document. When no successful build yet contains the finding's repository, the finding stays SUBMITTED until the next successful build; if that build does not contain it either, the finding is DISCARDED with discardReason SOURCE_REPO_NOT_FOUND.
", "CreateCodeScan": "Creates an explicit scan request for one environment. CP creates durable work before any queue delivery occurs.
Retrying a request that succeeded, with the same clientToken on the same environment, returns the original scan instead of starting another one. Token handling is not yet atomic: requests with the same token that run at the same time, or a retry after a request that failed partway through, can leave an additional scan, which may end in the FAILED state with a message that it was superseded. Deleting the environment makes its tokens unusable; a later request with one of them returns ResourceNotFoundException.
Each environment can have a limited number of scans in progress at the same time. Once that limit is enforced, a request that would exceed it returns ServiceQuotaExceededException; wait for a scan to finish (ListCodeScans shows each scan's status), then retry.
", "CreateCollector": "Creates the Collector for the caller's account. Provisions an AWS Config service-linked recorder using the caller's federated access session and begins recording infrastructure changes.
", "CreateEnvironment": "Creates an environment and starts its validation and any requested provisioning. Storage provisioning and dependency checks may continue after the initial 201 response; use GetEnvironment to observe completion.
", "CreateIntegration": "Creates a new integration with an external source provider. Repeating an identical request with the same clientToken returns the original integrationId, integrationArn, and createdAt. Token records are retained for eight hours after success or terminal failure, including after the integration is deleted; replaying a deleted integration's token does not recreate it. An identical request with a retained terminal failure returns the recorded error.
Reusing a token with different parameters returns ValidationException. A fresh token starts a new create attempt; if the name is already owned by another integration, ConflictException includes that integration's identifier. An attempt still in progress may return ThrottlingException with retryAfterSeconds set to 1; retry with the same token and identical parameters.
GitHub authorization codes are single use. Retry an unresolved attempt with its original token and unchanged parameters first. If the service reports a terminal failure, an expired attempt, or a successful token exchange whose integration could not be saved, restart GitHub authorization with a fresh token and authorization code. The service does not checkpoint provider results for recovery by another request.
", "DeleteCollector": "Deletes the Collector for the caller's account. The Collector first enters PENDING_DELETION, then the service removes its schedule, AWS Config service-linked recorder, versioned S3 bucket, KMS key, and persisted record.
", "DeleteEnvironment": "Deletes an environment and its associated resources.
", "DeleteIntegration": "Deletes an integration and releases its name and account quota. Its retained CreateIntegration token receipt can still replay the original result without recreating the integration. Shared provider registrations are retained: deleting one integration does not remove provider access used by another integration. A fresh GitHub CreateIntegration attempt requires a fresh OAuth authorization code and a new clientToken.
", "DisassociateCollector": "Removes one Collector association from this Environment, preserving its other associations. The stored Collector data-access role is cleared when no Collector associations remain. The Environment owner must have permission to disassociate. A current Collector access grant is not required, and the Collector does not need to remain active or present, so stale or revoked associations can be cleaned up.
", "GetCodeFinding": "Retrieves the current state and details of a finding.
", "GetCodeIssue": "Retrieves the current state and details of an issue.
", "GetCodeIssueArtifact": "Retrieves one immutable artifact attached to an issue, including its content.
", "GetCodeScan": "Retrieves one customer-visible environment scan.
", "GetCollector": "Retrieves the current state of the Collector for the caller's account.
", "GetCollectorDataAccessAuthorization": "Authorizes an Environment's access to a Collector's data. Continuum calls this operation with the Environment's Collector data-access role before it reads the Collector's inventory, so grant continuum:GetCollectorDataAccessAuthorization to that role and, for a Collector in another account, in the Collector's resource policy. The operation evaluates the action against the exact Collector ARN and the Collector's current resource policy using IAM and the caller's authenticated request context, with environmentArn as the continuum:EnvironmentArn condition key. A successful request returns HTTP 200 with no response members. If access is not granted, the operation returns AccessDeniedException without disclosing Collector existence, ownership, or the policy layer that denied access. The service does not reinterpret the policy using only an account ID.
", "GetEnvironment": "Retrieves the current state and configuration of an environment.
", "GetIntegration": "Retrieves information about an integration.
", "GetResourcePolicy": "Retrieves the resource policy attached to a Continuum resource.
", "ListAssociatedCollectors": "Lists the Collectors currently associated with one Environment in ascending collectorId order. Each entry carries the Collector ARN, so a listed association can be passed straight to DisassociateCollector, including when the Collector belongs to another account. An association recorded before Continuum persisted the ARN is omitted from the response, because without the ARN it cannot be acted on.
", "ListAssociatedEnvironments": "Lists the Environments currently associated with one Collector in lexicographically ascending environmentArn order. The ARN identifies each Environment across accounts within the Collector's Region.
", "ListCodeFindings": "Lists the findings in an environment in descending findingId order.
", "ListCodeIssueArtifacts": "Lists the artifacts attached to an issue in descending artifactId order. Content is returned by GetCodeIssueArtifact.
", "ListCodeIssues": "Lists the issues in an environment in descending issueId order.
", "ListCodeScans": "Lists customer-visible scans for one environment in descending scanRunId order.
", "ListCollectors": "Lists the Collectors owned by the authenticated caller's account, including a Collector whose deletion is in progress. A Collector that is still being created is omitted. The account-scoped Collector quota currently permits at most one result, so no result ordering applies.
", "ListEnvironments": "Lists all environments in your account in descending environmentId order. This complete-inventory operation intentionally has no response filters; see the input documentation for the API standards justification.
", "ListIntegrations": "Lists the integrations in your account in descending integrationId order.
", "PutResourcePolicy": "Creates or replaces the resource policy attached to a Continuum resource.
", "StartIntegrationAuthorization": "Starts an OAuth authorization for a new integration and returns the values the caller sends to the provider's authorization endpoint. The authorization belongs to the calling AWS account, can be redeemed once by CreateIntegration from that same account, and expires after ten minutes.
", "UpdateCollector": "Updates the customer-controlled mutable properties of a Collector. Only the name and Kubernetes cluster IAM role can be changed.
", "UpdateEnvironment": "Updates the customer-controlled mutable properties of an environment. Only the name, the environment's S3 integration source and repository selections, its scan frequency, its network policy, and its patch creation policy can be changed.
", "UpdateIntegration": "Rotates the credentials used by an Amazon S3 integration. Only S3 integrations can be updated; GitHub integrations cannot be modified. The integration's name, provider type, and bucket remain fixed.
The caller must have iam:PassRole permission for the supplied role, including when only the external ID changes. Continuum verifies that the role can be assumed with the requested external ID and can access the existing bucket before saving both credentials atomically. Omitting externalId preserves its current value. Repeating both current credentials leaves updatedAt unchanged, but still requires authorization and access validation.
" }, "shapes": { "AccessDeniedException": { "base": "The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
", "refs": {} }, "AffectedPackage": { "base": "A software package implicated by a finding.
", "refs": { "AffectedPackageList$member": null } }, "AffectedPackageList": { "base": "Software packages implicated by a finding.
", "refs": { "FindingVulnerability$affectedPackages": null, "GetCodeFindingOutput$affectedPackages": "Packages implicated by the finding.
" } }, "ArtifactCitation": { "base": "A citation supporting a claim: file:line, an HTTP response, or a graph node id.
1024 rather than 512: validation agents cite a span of reasoning rather than a single location, reaching ~930 characters, and an over-long citation drops its entire ReasoningStep — claim included — rather than just the citation.
What this signal is about, such as a finding or issue reference.
", "PrevalidationSignal$producerVersion": "Version of that producer.
", "ReasoningStep$source": "Citation supporting the claim.
", "RemediationProposalBody$filename": "Filename the producer suggests for the patch, when it named one.
", "ValidationExploitArtifact$targetUrl": "Target the payload was sent to.
" } }, "ArtifactCitations": { "base": null, "refs": { "FlowVerdict$evidence": "Citations supporting the verdict.
", "SignalConfidenceReasoning$factors": "The individual factors behind it.
" } }, "ArtifactHeaders": { "base": "Headers recorded on an exploit artifact.
", "refs": { "ValidationExploitArtifact$headers": "Headers sent with the payload.
" } }, "ArtifactHttpMethod": { "base": "HTTP method recorded on an exploit artifact.
An enum rather than a pattern-constrained string: callers branch on the method, so the full set belongs in the generated SDKs. A producer value outside this set omits the exploit artifact rather than surfacing an unmodeled method.
", "refs": { "ValidationExploitArtifact$httpMethod": "HTTP method the payload was sent with.
" } }, "ArtifactProofBody": { "base": "The body of a proof: executed code, the output it produced, or an annotated source walk.
Its own type rather than ArtifactText because these are whole documents, not fields: observed bodies reach 12.8K of code and 16K of captured output. At most one proof is present per artifact, so a large bound here does not multiply the way ArtifactText's does.
Leading portion of the response body, bounded by the producer.
" } }, "ArtifactSha256": { "base": "A SHA-256 digest in lowercase hexadecimal.
", "refs": { "PatchBody$patchSha256": "SHA-256 of the patch's UTF-8 bytes in lowercase hex, computed by Control Plane when it stored the patch.
Lets a caller confirm the patch it applies is byte-for-byte the one that was reviewed. Computed over the patch bytes, so it is verifiable against patch without trusting this value.
SHA-256 of the patch bytes in lowercase hex, as recorded by the producer.
Lets a caller confirm the patch it applies is byte-for-byte the one that was reviewed. Computed over the patch bytes, so it is verifiable against patch without trusting this value.
A bounded free-text field in a projected artifact body.
8192 rather than 4096: a validation agent's reasoning claim runs to ~5.6K in practice, and a claim dropped on length takes its whole ReasoningStep with it. Deliberately NOT raised to the proof-body bound — this type is also the member of a 50-entry ReasoningSteps list and of ArtifactHeaders, so its bound multiplies into the worst-case response size.
The product of these bounds is NOT what actually caps a response. Every projected body is read out of one IssueArtifactContent, itself bounded at 5 MiB, so no projection can exceed the size of the content it came from whatever the member bounds permit. Keeping this one modest is about not inflating a typical response, not about the ceiling.
The producer's conclusion.
", "ReasoningStep$claim": "The claim or conclusion reached at this step.
", "SignalAccessPrecondition$reason": "The producer's explanation.
", "SignalAccessPrecondition$missingInfo": "What the producer could not determine, when anything was missing.
", "SignalAttackerGainsDimension$reason": "The producer's explanation.
", "SignalAttackerGainsDimension$missingInfo": "What the producer could not determine, when anything was missing.
", "SignalBlastRadiusDimension$reason": "The producer's explanation.
", "SignalBlastRadiusDimension$missingInfo": "What the producer could not determine, when anything was missing.
", "SignalConfidenceReasoning$summary": "One-line rationale.
", "SignalPrecondition$reason": "The producer's explanation.
", "SignalPrecondition$missingInfo": "What the producer could not determine, when anything was missing.
", "SignalTargetValueDimension$reason": "The producer's explanation.
", "SignalTargetValueDimension$missingInfo": "What the producer could not determine, when anything was missing.
", "ValidationExploitArtifact$payload": "The exact payload sent.
" } }, "AssociateCollectorInput": { "base": "Specifies the Collector ARN and data-access role to associate with this Environment.
", "refs": {} }, "AssociateCollectorOutput": { "base": "Contains the Environment and the Collector associated by this request.
", "refs": {} }, "AssociatedCollector": { "base": "One Collector associated with an Environment.
", "refs": { "AssociateCollectorOutput$associatedCollector": "The Collector identifier and ARN validated by this operation.
", "AssociatedCollectors$member": null } }, "AssociatedCollectors": { "base": "One page of the Collectors associated with an Environment. Unlike CollectorArns and CollectorIds — which describe the non-empty input of an association mutation — a page is empty when the Environment has no associations, and its maximum matches the per-Environment association ceiling.
", "refs": { "ListAssociatedCollectorsOutput$associatedCollectors": "The Collectors associated with this Environment, ordered by collectorId ascending. Empty when the Environment has no associations, and also when every association on the page predates Continuum persisting the ARN — the page is still advanced by nextToken in that case.
A summary of one Environment associated with a Collector. This shape intentionally remains distinct from EnvironmentSummary so the two list operations can evolve independently.
", "refs": { "AssociatedEnvironments$member": null } }, "AssociatedEnvironments": { "base": "One page of Environment summaries associated with a Collector.
", "refs": { "ListAssociatedEnvironmentsOutput$associatedEnvironments": "Summaries of the Environments associated with this Collector, ordered by environmentArn lexicographically ascending. Each summary has the same fields as a ListEnvironments item but uses an independent model shape. Empty when the Collector has no associations.
" } }, "AssociationClientToken": { "base": "Caller-provided idempotency token for an Environment association request.
", "refs": { "AssociateCollectorInput$clientToken": "Caller-provided token that makes retried association requests idempotent. The first successful request binds the token to the complete Collector ARN, supplied role, and result for at least 24 hours. During that retry window, reusing it with a different request fails with ConflictException. A matching replay still requires the supplied role to have current Collector access. Once authorized, a matching replay returns the stored result without changing association state. Revocation can deny a replay; it does not remove the stored association or its original result.
" } }, "AttackFlowId": { "base": "Identifier of an attack flow within a validation bundle.
", "refs": { "AttackFlowIds$member": null, "FlowVerdict$flowId": "Identifier of the attack flow assessed.
" } }, "AttackFlowIds": { "base": null, "refs": { "ValidationEvidenceBody$attackFlowsConfirmed": "Identifiers of attack flows upgraded to Confirmed provenance.
" } }, "AuthorizationCode": { "base": "An OAuth authorization code used during the integration authentication flow.
", "refs": { "GitHubAuthorizationConfiguration$authorizationCode": "The OAuth authorization code returned by GitHub after the user authorizes the application.
" } }, "AwsAccountId": { "base": "A 12-digit AWS account ID.
", "refs": { "GetCollectorDataAccessAuthorizationInput$accountId": "The AWS account that owns the Collector.
" } }, "Boolean": { "base": null, "refs": { "SignalExploitability$reachedCrownJewels": "Whether validation reached the high-value sink the attack path posited.
A Boolean rather than an enum: the sink was either reached or it was not, and how far the walk got when it was not is already carried, with more precision, by highestLayerReached. An unknown is the absent member.
Whether the proven exploit is automatable rather than one-off.
A Boolean for the same reason as SignalPrecondition.value: validation records a bool, and an unknown is the absent member.
The producer's determination.
A Boolean rather than an enum, against the Common Terms preference for enums on extensibility grounds. The question each precondition answers is closed — is the code reachable, is configuration required, must a user other than the attacker interact — and the only third state, "not determined", is already expressed by omitting this member, which the projection does whenever the stored value is not a bool. An enum would give two ways to say the same thing, while basis and missingInfo already qualify how firm the answer is.
Workspace-safe repository name stored in a Build source manifest.
", "refs": { "PatchBody$repositoryName": "The repository the patch applies to, as named in the source snapshot it was generated against.
" } }, "CodeConfigurationDetails": { "base": "Code-specific environment properties. GetEnvironment returns the source and operating policy; UpdateEnvironment returns Collector details and the latest scan.
", "refs": { "EnvironmentConfigurationDetails$codeConfiguration": "Configuration and scan state for a code-scanning environment.
" } }, "CodeFindingSummaries": { "base": "A list of finding summaries returned by public code finding APIs.
", "refs": { "ListCodeFindingsOutput$items": "The findings in the environment, ordered by findingId descending.
" } }, "CodeIssueArtifactItems": { "base": null, "refs": { "ListCodeIssueArtifactsOutput$items": "The artifacts attached to the issue, ordered by artifactId descending.
" } }, "CodeIssueSummaries": { "base": "A list of issue summaries.
", "refs": { "ListCodeIssuesOutput$items": "The issues in the environment, ordered by issueId descending.
" } }, "CodeScanData": { "base": "Complete customer-visible data for one environment scan.
Kept distinct from CodeScanSummary so GetCodeScan can grow independently of ListCodeScans without changing its response contract.
", "refs": { "GetCodeScanOutput$scan": "Complete customer-visible scan data.
" } }, "CodeScanSummaries": { "base": null, "refs": { "ListCodeScansOutput$scans": "Customer-visible scans ordered by scanRunId descending.
" } }, "CodeScanSummary": { "base": "Customer-visible summary of one environment scan.
", "refs": { "CodeConfigurationDetails$latestScan": "The newest scan requested for this environment, if one exists.
", "CodeScanSummaries$member": null, "CreateCodeScanOutput$scan": "The scan run this request created, or the scan run a previous request with the same clientToken already accepted.
" } }, "CollectorArn": { "base": "The Amazon Resource Name (ARN) of the Collector. Format: arn:{partition}:continuum:{region}:{account}:collectors/{collectorId} The resource-id segment is a fresh, randomly generated identifier assigned when the Collector is created — not a fixed or predictable value.
", "refs": { "AssociateCollectorInput$collectorArn": "The ARN of the Collector to associate with this Environment.
", "AssociatedCollector$collectorArn": "The ARN of the associated Collector. The account and Region encoded in this ARN identify cross-account and cross-Region associations.
", "CollectorSummary$collectorArn": "The ARN of the Collector.
", "CreateCollectorOutput$collectorArn": "The ARN of the created Collector.
", "DisassociateCollectorInput$collectorArn": "The ARN of the Collector to disassociate from this Environment.
", "GetCollectorOutput$collectorArn": "The ARN of the Collector.
", "UpdateCollectorOutput$collectorArn": "The ARN of the updated Collector.
" } }, "CollectorClientToken": { "base": "Caller-provided idempotency token for a Collector creation request.
", "refs": { "CreateCollectorInput$clientToken": "Caller-provided token that makes retried create requests return the original Collector rather than creating a duplicate.
" } }, "CollectorDetails": { "base": "Collector data access configuration returned for an environment.
", "refs": { "CodeConfigurationDetails$collectorDetails": "Collector data access configuration. Omitted when no Collector data access role is configured.
" } }, "CollectorId": { "base": "The unique identifier for a Collector resource. This is a fresh, randomly generated identifier assigned when the Collector is created — the same value embedded as the resource-id segment of the CollectorArn.
", "refs": { "AssociatedCollector$collectorId": "The unique identifier of the associated Collector.
", "CollectorSummary$collectorId": "The unique identifier of the Collector.
", "CreateCollectorOutput$collectorId": "The unique identifier assigned to the Collector.
", "DeleteCollectorInput$collectorId": "The unique identifier of the Collector to delete.
", "GetCollectorDataAccessAuthorizationInput$collectorId": "The unique identifier of the Collector.
", "GetCollectorInput$collectorId": "The unique identifier of the Collector to retrieve.
", "GetCollectorOutput$collectorId": "The unique identifier of the Collector.
", "ListAssociatedEnvironmentsInput$collectorId": "The unique identifier of the Collector whose associations to list.
", "UpdateCollectorInput$collectorId": "The unique identifier of the Collector to update.
", "UpdateCollectorOutput$collectorId": "The unique identifier of the updated Collector.
" } }, "CollectorName": { "base": "The name for a Collector.
", "refs": { "UpdateCollectorInput$name": "The new customer-visible name.
" } }, "CollectorStatus": { "base": "The lifecycle status of a Collector.
", "refs": { "CollectorSummary$status": "The current lifecycle status.
", "CreateCollectorOutput$status": "The current lifecycle status.
", "GetCollectorOutput$status": "The current lifecycle status.
", "UpdateCollectorOutput$status": "The current lifecycle status.
" } }, "CollectorSummaries": { "base": "Collector summaries returned for an authenticated account. The account-scoped Collector quota currently permits at most one result.
", "refs": { "ListCollectorsOutput$items": "The Collectors owned by the authenticated caller's account. At most one result is currently returned, so no result ordering applies.
" } }, "CollectorSummary": { "base": "A summary of a Collector returned in list responses.
", "refs": { "CollectorSummaries$member": null } }, "CollectorType": { "base": "The source collected by a Collector. Additional kinds can be added as they become supported; recorder provisioning remains a service detail.
", "refs": { "CollectorSummary$type": "The source collected by this Collector.
", "CreateCollectorInput$type": "Source to collect. Defaults to AWS_COLLECTOR when omitted.
", "CreateCollectorOutput$type": "The source collected by this Collector.
", "GetCollectorOutput$type": "The source collected by this Collector.
", "UpdateCollectorOutput$type": "The source collected by this Collector.
" } }, "ConfigRecorderArn": { "base": "ARN of the AWS Config Recorder provisioned by this Collector. Accepts both recorder shapes:
configuration-recorder resource type and carries a trailing id segment).The ARN of the provisioned AWS Config Recorder.
", "UpdateCollectorOutput$configRecorderArn": "The ARN of the provisioned AWS Config Recorder.
" } }, "ConflictException": { "base": "The request could not be completed due to a conflict with the current state of the resource.
", "refs": {} }, "CreateCodeConfiguration": { "base": "Source and operating-policy settings for a new code environment.
", "refs": { "CreateEnvironmentConfiguration$codeConfiguration": "Configuration for a code-scanning environment.
" } }, "CreateCodeFindingInput": { "base": "Specifies the environment and the finding document to ingest.
", "refs": {} }, "CreateCodeFindingOutput": { "base": "Contains the identifier, ARN, title, and initial status of the newly ingested finding.
", "refs": {} }, "CreateCodeScanInput": { "base": null, "refs": {} }, "CreateCodeScanOutput": { "base": null, "refs": {} }, "CreateCollectorInput": { "base": "Creates a Collector for the authenticated caller.
", "refs": {} }, "CreateCollectorOutput": { "base": "Contains the identifier and ARN of the newly created Collector.
", "refs": {} }, "CreateEnvironmentConfiguration": { "base": "Type-specific configuration for a new environment. Omission creates a code environment with the default operating policy and no sources.
", "refs": { "CreateEnvironmentInput$configuration": "Type-specific configuration. Omission creates a code environment with the default operating policy and no sources.
" } }, "CreateEnvironmentInput": { "base": "Specifies the name and type-specific configuration of the new environment. Source and operating-policy settings belong to configuration.codeConfiguration.
", "refs": {} }, "CreateEnvironmentOutput": { "base": "Contains the identifier and ARN of the newly created environment.
", "refs": {} }, "CreateIntegrationInput": { "base": "Specifies the provider configuration and name for the new integration.
", "refs": {} }, "CreateIntegrationOutput": { "base": "Contains the original identifier, ARN, and creation time of the new or replayed integration. A replay can refer to an integration that has since been deleted.
", "refs": {} }, "CveId": { "base": "A CVE identifier, e.g. "CVE-2020-8203".
", "refs": { "FindingVulnerability$cveId": null, "GetCodeFindingOutput$cveId": "The CVE this finding reports, for software-composition findings. Both code types can carry one: a customer document supplies it under vulnerabilities[].cve, and Continuum's scanner reports CVEs for dependency-manifest findings.
" } }, "CweId": { "base": "A CWE identifier, e.g. "CWE-532".
", "refs": { "CweIdList$member": null, "FindingVulnerability$cweId": "Primary CWE for this vulnerability, e.g. "CWE-89".
" } }, "CweIdList": { "base": "CWE identifiers classifying a finding.
", "refs": { "FindingVulnerability$additionalCweIds": "Further CWEs the producer attributed to this same vulnerability.
", "GetCodeFindingOutput$cweIds": "CWE identifiers classifying the finding.
" } }, "DeleteCollectorInput": { "base": "Specifies the Collector to delete.
", "refs": {} }, "DeleteEnvironmentInput": { "base": "Specifies the environment to delete.
", "refs": {} }, "DeleteIntegrationInput": { "base": "Specifies the integration to delete.
", "refs": {} }, "DeliveryGitCommitSha": { "base": null, "refs": { "GitHubTarget$headSha": "The head commit SHA of the pull request. Absent until the pull request is opened.
" } }, "DeliveryGitHubName": { "base": null, "refs": { "GitHubTarget$owner": "The GitHub user or organization that owns the repository.
", "GitHubTarget$repository": "The repository name.
" } }, "DeliveryObjectKey": { "base": null, "refs": { "S3Target$key": "The object key of the delivered patch.
" } }, "DeliveryPullRequestNumber": { "base": null, "refs": { "GitHubTarget$pullRequestNumber": "Repository-scoped pull request number assigned by GitHub.
" } }, "DeliveryReason": { "base": "Cause of a PATCH delivery's current state; used only by DeliveryState.reason. These are outcomes of one delivery lifecycle, not shared operation error enums. The two existing skip-code wire values are retained for compatibility.
", "refs": { "IssuePatchDeliveryFailureReasons$member": null } }, "DeliveryStatus": { "base": null, "refs": { "PatchDelivery$status": "How far delivery to the destination has progressed.
" } }, "DeliveryVersionId": { "base": null, "refs": { "S3Target$version": "The S3 version ID of the delivered object, when the bucket is versioned.
" } }, "DestinationTarget": { "base": "Identity only. Future providers may add union members without duplicating state.
", "refs": { "PatchDelivery$target": "Where the patch was or will be delivered. Absent while the destination is still being resolved, or when delivery was skipped before a destination was known.
" } }, "DisassociateCollectorInput": { "base": "Specifies the Collector to disassociate from this Environment.
", "refs": {} }, "Document": { "base": null, "refs": { "CreateCodeFindingInput$ocsfDocument": "The OCSF finding document to ingest, verbatim. Must declare a class_uid Continuum supports (2002 Vulnerability Finding, or 2007 Application Security Posture Finding) and validate against the vendored OCSF JSON Schema for that class, including the Continuum overlay requirements that finding_info.uid be present and that vulnerabilities[0].affected_code[0].file identify the code location. With several repositories in the environment, the file path must begin with the repository name. Maximum size 256 KB. Stored verbatim and normalized into the typed Finding members returned by GetCodeFinding. GetCodeFinding does not return the document itself.
", "GetCodeIssueArtifactOutput$metadata": "Producer-defined structured metadata, when the producer supplied any.
Returned only for an artifactType whose content has no defined shape, so that the artifact stays inspectable. For an artifactType with a defined shape, body carries the content and this member is omitted.
A domain name permitted for build-time dependency resolution.
", "refs": { "DomainNames$member": null } }, "DomainNames": { "base": "A list of permitted dependency domains. Maximum 50 entries.
", "refs": { "EnvironmentNetworkConfiguration$allowedDomains": "Domains that an environment's agent execution may contact.
" } }, "Double": { "base": null, "refs": { "FindingValidation$confidence": "The validator's confidence, from 0.0 to 1.0 inclusive. Advisory: it does not drive Continuum's own routing decisions. The range is enforced server-side, not by a @range trait -- the smithy-rs server SDK does not support range constraints on double shapes (smithy-rs#2007).
", "FindingVulnerability$cvssBaseScore": "The CVSS base score for cveId, when the producer supplies one, from 0.0 to 10.0.
The CVSS base score accompanying cveId, when the producer supplies one, from 0.0 to 10.0. Not computed by Continuum. The range is enforced server-side, not by a @range trait -- the smithy-rs server SDK does not support range constraints on double shapes (smithy-rs#2007).
The Amazon Resource Name (ARN) of an Environment resource, of the form arn:{partition}:continuum:{region}:{account}:environments/{environmentId}.
", "refs": { "AssociateCollectorOutput$environmentArn": "The ARN of the Environment making the association.
", "AssociatedEnvironment$environmentArn": "The ARN of the associated Environment. The account encoded in this ARN identifies cross-account associations; association mutations require its Region to match the Collector's Region.
", "CreateEnvironmentOutput$environmentArn": "The ARN of the created environment.
", "EnvironmentListEntry$environmentArn": "The ARN of the environment.
", "GetCollectorDataAccessAuthorizationInput$environmentArn": "The full ARN of the Environment requesting the Collector's data. The Environment must be in the caller's account. Continuum supplies this value as the continuum:EnvironmentArn condition key.
", "GetEnvironmentOutput$environmentArn": "The ARN of the environment.
", "UpdateEnvironmentOutput$environmentArn": "The ARN of the updated environment.
" } }, "EnvironmentConfiguration": { "base": "Environment-level operating policy.
", "refs": { "CodeConfigurationDetails$environmentConfiguration": "Operating policy in the shape accepted by CreateEnvironment and UpdateEnvironment.
", "CreateCodeConfiguration$environmentConfiguration": "Environment-level operating policy.
", "UpdateCodeConfiguration$environmentConfiguration": "Operating-policy changes. network replaces the environment's network policy; a network without allowedDomains allows no domains. Builds accepted before the change keep the domains they were accepted with. patchCreationPolicy replaces the patch creation policy. scanFrequency updates scan cadence. Omitted members preserve their stored values.
" } }, "EnvironmentConfigurationDetails": { "base": "Type-specific configuration and state returned by GetEnvironment and UpdateEnvironment.
", "refs": { "GetEnvironmentOutput$configuration": "Type-specific configuration and state, including code sources, operating policy, Collector details, and the latest scan.
", "UpdateEnvironmentOutput$configuration": "Type-specific state, including Collector details and the latest scan. Read source and operating-policy settings through GetEnvironment.
" } }, "EnvironmentId": { "base": "The unique identifier for an Environment resource.
", "refs": { "AssociateCollectorInput$environmentId": "The unique identifier of the Environment making the association.
", "AssociateCollectorOutput$environmentId": "The unique identifier of the Environment making the association.
", "AssociatedEnvironment$environmentId": "The unique identifier of the associated Environment.
", "CreateCodeFindingInput$environmentId": "The environment to ingest the finding into.
", "CreateCodeScanInput$environmentId": "Environment to scan.
", "CreateEnvironmentOutput$environmentId": "The unique identifier assigned to the environment.
", "DeleteEnvironmentInput$environmentId": "The unique identifier of the environment to delete.
", "DisassociateCollectorInput$environmentId": "The unique identifier of the Environment whose associations are updated.
", "EnvironmentListEntry$environmentId": "The unique identifier of the environment.
", "FindingSummary$environmentId": "The environment that owns the finding.
", "GetCodeFindingInput$environmentId": "The environment that owns the finding.
", "GetCodeFindingOutput$environmentId": "The environment that owns the finding.
", "GetCodeIssueArtifactInput$environmentId": "The environment that owns the issue.
", "GetCodeIssueInput$environmentId": "The environment that owns the issue.
", "GetCodeScanInput$environmentId": "Environment that owns the scan.
", "GetEnvironmentInput$environmentId": "The unique identifier of the environment to retrieve.
", "GetEnvironmentOutput$environmentId": "The unique identifier of the environment.
", "ListAssociatedCollectorsInput$environmentId": "The unique identifier of the Environment whose associations to list.
", "ListCodeFindingsInput$environmentId": "The environment whose findings to list.
", "ListCodeIssueArtifactsInput$environmentId": "The environment that owns the issue.
", "ListCodeIssuesInput$environmentId": "The environment whose issues to list.
", "ListCodeScansInput$environmentId": "Environment whose scans to list.
", "UpdateEnvironmentInput$environmentId": "The unique identifier of the environment to update.
", "UpdateEnvironmentOutput$environmentId": "The unique identifier of the updated environment.
" } }, "EnvironmentListEntries": { "base": "A list of external environment entries.
", "refs": { "ListEnvironmentsOutput$items": "Common metadata for the environments in the account, ordered by environmentId descending.
" } }, "EnvironmentListEntry": { "base": "Summary of an environment returned in list responses.
", "refs": { "EnvironmentListEntries$member": null } }, "EnvironmentName": { "base": "The customer-visible name for an environment.
", "refs": { "AssociatedEnvironment$name": "The customer-visible name of the associated Environment.
", "CreateEnvironmentInput$name": "The customer-visible name of the environment.
", "EnvironmentListEntry$name": "The customer-visible name of the environment.
", "GetEnvironmentOutput$name": "The customer-visible name of the environment.
", "UpdateEnvironmentInput$name": "The new customer-visible name.
", "UpdateEnvironmentOutput$name": "The current customer-visible name of the environment.
" } }, "EnvironmentNetworkConfiguration": { "base": "Network policy for agent execution.
", "refs": { "EnvironmentConfiguration$network": "Network policy for agent execution.
" } }, "EnvironmentRepositorySource": { "base": "One repository selected from a previously-created integration.
", "refs": { "EnvironmentRepositorySources$member": null } }, "EnvironmentRepositorySources": { "base": "Explicit repository selections for an environment.
The number of repositories is governed by an account-level service quota rather than this shape maximum. The quota defaults to 10 so scans maintain useful quality and coverage, and can be higher for some accounts, up to 100.
An environment that already has more selections than the account's current quota remains readable, and an UpdateEnvironment request that leaves repositorySources unchanged keeps those selections without checking them against the quota. Creating or replacing repository selections, and starting a new scan, must satisfy the account's current quota.
", "refs": { "EnvironmentSourceConfiguration$repositorySources": "Explicit repository selections from previously-created integrations.
" } }, "EnvironmentS3IntegrationSource": { "base": "An S3 source for one environment, backed by a previously-created S3 integration.
", "refs": { "EnvironmentS3Sources$member": null } }, "EnvironmentS3Sources": { "base": "A list of S3 integration sources. Only one S3 source is supported today; modeled as a list to allow more sources to be supported without a breaking change in the future.
", "refs": { "EnvironmentSourceConfiguration$s3Sources": "S3 sources backed by previously-created S3 integrations.
" } }, "EnvironmentSourceBucketName": { "base": "Customer-managed S3 bucket name.
", "refs": { "S3Target$bucket": null } }, "EnvironmentSourceConfiguration": { "base": "GA source configuration for code and customer-authored context.
", "refs": { "CodeConfigurationDetails$sourceConfiguration": "Sources in the shape accepted by CreateEnvironment and UpdateEnvironment.
", "CreateCodeConfiguration$sourceConfiguration": "Source configuration for the environment.
", "UpdateCodeConfiguration$sourceConfiguration": "Source changes. s3Sources replaces the environment's S3 source, and repositorySources replaces its repository selections.
" } }, "EnvironmentSourcePrefix": { "base": "A source prefix. The service normalizes an omitted value to its documented default.
", "refs": { "EnvironmentS3IntegrationSource$codePrefix": "Prefix containing source code. Defaults to code/ when omitted.
", "EnvironmentS3IntegrationSource$contextPrefix": "Prefix containing customer-authored context. Defaults to context/ when omitted.
" } }, "EnvironmentSourceRoleArn": { "base": "IAM role assumed by Continuum for environment-level or source-specific access.
", "refs": { "AssociateCollectorInput$collectorDataAccessRoleArn": "IAM role in the Environment account that Continuum assumes before authorizing access to associated Collector inventory. Every association, including a same-account association, requires this role. The supplied ARN replaces the Environment's previously stored role. The customer is responsible for granting the role access to every Collector that should contribute data.
", "CollectorDetails$collectorDataAccessRoleArn": "IAM role that Continuum assumes to authorize its access to associated Collector inventory. Required for nonempty Collector inventory resolution, in the same account or across accounts. This is independent from any S3 source role.
" } }, "EnvironmentStatus": { "base": "The operational status of an environment.
", "refs": { "AssociatedEnvironment$status": "The current operational status of the associated Environment.
", "CreateEnvironmentOutput$status": "The initial status of the environment. Always ACTIVE on successful creation.
", "EnvironmentListEntry$status": "The current operational status of the environment.
", "GetEnvironmentOutput$status": "The current operational status of the environment.
", "UpdateEnvironmentOutput$status": "The current operational status of the environment.
" } }, "EnvironmentStatusMessage": { "base": "A human-readable message providing additional context about the current environment status.
", "refs": { "GetEnvironmentOutput$statusMessage": "Human-readable details about the current status. Present when the status requires additional context (e.g., failure reason).
", "UpdateEnvironmentOutput$statusMessage": "Human-readable details about the current status.
" } }, "ExploitEffect": { "base": "The effect validation observed from an exploit payload.
", "refs": { "ValidationExecutedProof$observedEffect": "Effect the execution actually produced. observedEffect rather than effect: this one was witnessed, and the name has to stay distinguishable from ValidationSourceAnalysis.inferredEffect, which was not.
Effect observed from sending the payload.
", "ValidationSourceAnalysis$inferredEffect": "Effect the agent concluded WOULD occur. Deliberately not effect: nothing was executed, so this is reasoned from the source and must not be read as an observation. See ValidationExecutedProof.observedEffect.
Whether validation confirmed the vulnerability is exploitable.
", "refs": { "PerFindingResult$exploitable": "Exploitability verdict for this finding.
", "SignalExploitability$verdict": "Validation's verdict. UNCERTAIN covers a run that was inconclusive — out of budget, an ambiguous failure, or no decisive layer reached — and is never a refutation.
Exploitability verdict. Explicit UNCERTAIN replaces the producer's tri-state exploitable: true | false | null, so an absent verdict is never confused with a negative one.
The Amazon Resource Name (ARN) of a Finding resource, of the form arn:{partition}:continuum:{region}:{account}:environments/{environmentId}/code-findings/{findingId}.
", "refs": { "CreateCodeFindingOutput$findingArn": "The ARN of the ingested finding.
", "FindingSummary$findingArn": "The ARN of the finding.
", "GetCodeFindingOutput$findingArn": "The ARN of the finding.
" } }, "FindingBlockingReason": { "base": "Why a validator rejected a finding. NONE accompanies a true positive.
", "refs": { "FindingValidation$blockingReason": "Why the validator reached that verdict.
" } }, "FindingCategory": { "base": "A vulnerability-taxonomy label: the producer's category, sub-category, or OWASP category. Deliberately unconstrained beyond length -- producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.
The application the posture was assessed against.
", "FindingPosture$applicationUid": null, "FindingPosture$applicationVersion": null, "FindingPosture$control": "The control assessed, and the producer's description of it.
", "FindingPosture$status": "The producer's compliance status, and the enum value behind it.
", "FindingResource$name": null, "FindingResource$type": null, "FindingResource$region": null, "FindingSummary$category": "The producer's vulnerability category.
", "FindingVulnerability$cweCaption": "The producer's human-readable caption for cweId.
The producer's description of how completely a fix is available.
", "GetCodeFindingOutput$category": "The producer's vulnerability category. Not a stable filter key across finding types -- see FindingCategory.
", "GetCodeFindingOutput$subCategory": "A more specific classification within category.
The OWASP Top 10 category, when the producer supplies one.
", "GetCodeFindingOutput$ocsfSchemaVersion": "The OCSF schema version the producer wrote against (metadata.version).
", "GetCodeFindingOutput$productName": "The producing product and vendor (metadata.product).
", "GetCodeFindingOutput$productVendorName": null, "GetCodeFindingOutput$productVersion": null, "GetCodeFindingOutput$sourceStatus": "The producer's own status for the finding, and the enum value behind it. Distinct from status, which is Continuum's lifecycle state -- a producer may call a finding "New" while Continuum has it SUBMITTED.
A unique, case-sensitive token that you provide to make a finding-creation request idempotent.
", "refs": { "CreateCodeFindingInput$clientToken": "Caller-provided idempotency token. A retry with the same token and an identical finding document replays the original result; the same token with different content is rejected.
" } }, "FindingCodeSnippet": { "base": "A code excerpt: the vulnerable fragment, or a validation-evidence snippet.
", "refs": { "FindingEvidence$snippet": "The cited excerpt.
", "FindingVulnerability$code": "The vulnerable fragment, when the producer supplied one.
", "GetCodeFindingOutput$vulnerableCode": "The vulnerable code fragment.
" } }, "FindingComplianceCheck": { "base": "One compliance check behind a posture finding.
", "refs": { "FindingComplianceCheckList$member": null } }, "FindingComplianceCheckList": { "base": "Matches AffectedPackageList.
", "refs": { "FindingPosture$checks": "The individual checks performed.
" } }, "FindingDescription": { "base": "Free-form prose about a finding (summary, detailed analysis, rationale, remediation guidance). Capped well below the finding document's own 256 KB limit, since several of these can appear on one finding.
", "refs": { "FindingComplianceCheck$description": null, "FindingPosture$description": null, "FindingPosture$remediation": null, "FindingValidation$rationale": "The validator's reasoning.
", "FindingVulnerability$description": null, "FindingVulnerability$remediation": null, "FindingVulnerability$details": "The producer's extended analysis for this vulnerability.
", "GetCodeFindingOutput$summary": "A one-paragraph description.
", "GetCodeFindingOutput$detailedDescription": "The full analysis.
", "GetCodeFindingOutput$mitigation": "How to fix the finding.
" } }, "FindingDiscardReason": { "base": "Why a finding was not escalated into an issue. Present only when status is DISCARDED.
", "refs": { "FindingSummary$discardReason": "Why the finding was not escalated. Present only when status is DISCARDED.
", "GetCodeFindingOutput$discardReason": "Why the finding was not escalated. Present only when status is DISCARDED.
" } }, "FindingEvidence": { "base": "A code citation supporting a validation verdict.
", "refs": { "FindingEvidenceList$member": null } }, "FindingEvidenceList": { "base": "Code citations supporting a validation verdict.
", "refs": { "FindingValidation$evidence": "Code citations supporting the verdict.
" } }, "FindingFilePath": { "base": "A repository-relative path to the file a finding is about.
", "refs": { "FindingEvidence$file": "The file the evidence was found in.
", "FindingLocation$filePath": "Repository-relative path.
", "FindingSummary$filePath": "The file the finding is about, when it has a code location.
", "GetCodeFindingOutput$filePath": "The file the finding is about.
" } }, "FindingId": { "base": "The unique identifier for a Finding resource.
", "refs": { "CreateCodeFindingOutput$findingId": "The unique identifier assigned to the finding.
", "FindingSummary$findingId": "The unique identifier of the finding.
", "GetCodeFindingInput$findingId": "The unique identifier of the finding to retrieve.
", "GetCodeFindingOutput$findingId": "The unique identifier of the finding.
", "IssueFindingIds$member": null, "PerFindingResult$findingId": "The finding assessed.
" } }, "FindingListEntry": { "base": "One entry in a free-form list carried verbatim from a producer (relevant inputs, reproduction steps, mitigating controls, preconditions, references).
", "refs": { "FindingStringList$member": null } }, "FindingLocation": { "base": "A code location a finding points at.
", "refs": { "FindingLocationList$member": null } }, "FindingLocationList": { "base": "One vulnerability rarely spans more than a handful of locations.
", "refs": { "FindingVulnerability$locations": "Every location this vulnerability was reported at.
" } }, "FindingOcsfClass": { "base": "The OCSF Finding class a submitted document declared. Continuum validates against, and accepts, only these classes; a document declaring any other class_uid is rejected at CreateCodeFinding, so this is a closed set rather than a pass-through of OCSF's full class registry.
", "refs": { "GetCodeFindingOutput$ocsfClass": "The OCSF class the document declared. Determines whether posture is populated.
The compliance posture a finding reports, for the Application Security Posture Finding class. Absent for a vulnerability finding.
", "refs": { "GetCodeFindingOutput$posture": "The compliance posture, for an Application Security Posture Finding. Absent for a vulnerability finding.
" } }, "FindingResource": { "base": "A cloud or application resource a finding concerns.
", "refs": { "FindingResourceList$member": null } }, "FindingResourceList": { "base": "Matches AffectedPackageList.
", "refs": { "GetCodeFindingOutput$resources": "Resources the document named (resources[]).
" } }, "FindingResourceUid": { "base": "A resource identifier -- a cloud ARN, a context-graph node id, or whatever identifier scheme the producer uses.
", "refs": { "FindingResource$uid": null } }, "FindingSeverityAdjustment": { "base": "A validator's severity conclusion. UNCHANGED means the producer's reported severity stands.
", "refs": { "FindingValidation$severityAdjustment": "The validator's severity conclusion.
" } }, "FindingSeverityId": { "base": "A finding's severity, on the canonical numeric scale OCSF defines (UNKNOWN=0, INFORMATIONAL=1, LOW=2, MEDIUM=3, HIGH=4, CRITICAL=5, FATAL=6, OTHER=99). Named rather than numeric so callers never map the scale themselves, and identical across producers.
", "refs": { "FindingSummary$severity": "The finding's severity.
", "GetCodeFindingOutput$severity": "The finding's severity.
" } }, "FindingSource": { "base": "The system that produced a finding -- Continuum's own scanner, or the product name (falling back to the vendor name) from a customer document's OCSF metadata.product. Distinguishes two customer integrations that share a type.
The system that produced the finding.
", "GetCodeFindingOutput$source": "The system that produced the finding.
" } }, "FindingStatus": { "base": "The lifecycle status of a finding as it moves through Continuum's processing pipeline. CONFIRMED and DISCARDED are terminal states -- a CONFIRMED finding is promoted into a separate Issue (not yet implemented), which owns the subsequent remediation lifecycle; the finding's own status does not change after that.
", "refs": { "CreateCodeFindingOutput$status": "The finding's current lifecycle status -- SUBMITTED for a newly ingested finding, or the finding's present status when an idempotent retry replays an already-processed finding.
", "FindingSummary$status": "The current lifecycle status of the finding.
", "GetCodeFindingOutput$status": "The current lifecycle status of the finding.
" } }, "FindingStatusMessage": { "base": "A human-readable message providing additional context about the current finding status.
", "refs": { "FindingSummary$statusMessage": "Human-readable context about the current status.
", "FindingSummary$discardReasoning": "Customer-facing explanation accompanying discardReason.
Human-readable context about the current status.
", "GetCodeFindingOutput$discardReasoning": "Customer-facing explanation accompanying discardReason.
A free-form list of strings carried verbatim from a producer.
", "refs": { "FindingPosture$standards": "Standards and requirements the control maps to.
", "FindingPosture$requirements": null, "FindingPosture$remediationReferences": null, "FindingValidation$mitigatingControls": "Controls the validator found that reduce exploitability.
", "FindingValidation$preconditions": "Conditions exploitation depends on, which bound the severity.
", "FindingVulnerability$remediationReferences": null, "GetCodeFindingOutput$relevantInputs": "User-controlled inputs that reach the vulnerability.
", "GetCodeFindingOutput$stepsToReproduce": "Steps to reproduce or exploit the finding.
", "GetCodeFindingOutput$mitreTechniques": "MITRE ATT&CK technique identifiers, from the document's finding_info.attacks[].technique.uid.
", "GetCodeFindingOutput$remediationReferences": "Remediation references, from the document's vulnerabilities[].remediation.references.
", "GetCodeFindingOutput$findingTypes": "The producer's own classification of the finding (finding_info.types).
" } }, "FindingSummary": { "base": "A summary of a finding returned in list responses. Shares FindingLifecycleFields with the read operations so the list and get projections cannot drift. Carries a lean content subset -- fetch the finding for its full contents.
", "refs": { "CodeFindingSummaries$member": null } }, "FindingTitle": { "base": "The title of a finding, from the producer's own title -- OCSF finding_info.title, or the scanner's finding title. Length matches the OCSF title constraint.
", "refs": { "CreateCodeFindingOutput$title": "The title extracted from the submitted document. Always populated at ingestion.
", "FindingSummary$title": "The producer's title for the finding.
", "FindingVulnerability$title": null, "GetCodeFindingOutput$title": "The producer's title for the finding.
" } }, "FindingType": { "base": "What kind of finding this is, and who produced it.
", "refs": { "FindingSummary$type": "What kind of finding this is.
", "GetCodeFindingOutput$type": "What kind of finding this is. Determines which of the type-specific members below are populated.
" } }, "FindingValidation": { "base": "A validator's assessment of a finding. Present only when validation actually ran -- absent for finding types that are ingested untested, rather than reporting a verdict Continuum did not reach.
", "refs": { "GetCodeFindingOutput$validation": "The validator's assessment. Absent when no validation ran.
" } }, "FindingVerdict": { "base": "A validator's conclusion about whether a finding is real.
", "refs": { "FindingValidation$verdict": "The validator's conclusion.
" } }, "FindingVulnerability": { "base": "One vulnerability reported by a finding. A customer document may report several; each carries its own identity, locations and remediation.
", "refs": { "FindingVulnerabilityList$member": null } }, "FindingVulnerabilityList": { "base": "Matches AffectedPackageList: a document reporting more than this is reporting a scan, not a finding.
", "refs": { "GetCodeFindingOutput$vulnerabilities": "Every vulnerability the document reported. A document may report several; the flat cveId/cvssBaseScore/filePath/lineNumber members above carry the first one's identity so a caller that only needs "what and where" does not have to walk this list.
Validation's verdict for one attack flow.
", "refs": { "FlowVerdicts$member": null } }, "FlowVerdictValue": { "base": "Outcome recorded for one attack flow.
", "refs": { "FlowVerdict$verdict": "Outcome for this flow.
" } }, "FlowVerdicts": { "base": null, "refs": { "PerFindingResult$flowVerdicts": "Per-flow verdicts recorded for this finding.
", "ValidationEvidenceBody$flowVerdicts": "One verdict per attack flow assessed in the bundle.
" } }, "GetCodeFindingInput": { "base": "Specifies the finding to retrieve.
", "refs": {} }, "GetCodeFindingOutput": { "base": "Contains the current state and details of the requested finding. Which type-specific members are populated depends on type.
Specifies the artifact to retrieve.
", "refs": {} }, "GetCodeIssueArtifactOutput": { "base": "Contains the requested artifact and its content.
", "refs": {} }, "GetCodeIssueInput": { "base": "Specifies the issue to retrieve.
", "refs": {} }, "GetCodeIssueOutput": { "base": "Contains the current state and details of the requested issue.
", "refs": {} }, "GetCodeScanInput": { "base": null, "refs": {} }, "GetCodeScanOutput": { "base": null, "refs": {} }, "GetCollectorDataAccessAuthorizationInput": { "base": "Identifies the Collector whose inventory is requested.
", "refs": {} }, "GetCollectorDataAccessAuthorizationOutput": { "base": "Empty response returned when the authenticated caller is authorized to access the Collector's data.
", "refs": {} }, "GetCollectorInput": { "base": "Specifies the Collector to retrieve.
", "refs": {} }, "GetCollectorOutput": { "base": "Contains the current state of the Collector.
", "refs": {} }, "GetEnvironmentInput": { "base": "Specifies the environment to retrieve.
", "refs": {} }, "GetEnvironmentOutput": { "base": "Contains the current state and configuration of the requested environment.
", "refs": {} }, "GetIntegrationInput": { "base": "Specifies the integration to retrieve.
", "refs": {} }, "GetIntegrationOutput": { "base": "Contains metadata for the requested integration.
", "refs": {} }, "GetResourcePolicyInput": { "base": "Specifies the resource.
", "refs": {} }, "GetResourcePolicyOutput": { "base": "Contains the resource policy.
", "refs": {} }, "GitHubAuthorizationConfiguration": { "base": "Write-only OAuth credentials used to authorize a GitHub.com integration. Not stored or returned after creation.
", "refs": { "GitHubConfiguration$authorization": "OAuth authorization used to establish the integration. Required on create; not returned on read operations.
" } }, "GitHubConfiguration": { "base": "Configuration for a GitHub.com integration using the OAuth authorization code flow.
", "refs": { "ProviderConfiguration$github": "Configuration for a GitHub.com integration.
" } }, "GitHubDetails": { "base": "Details for a GitHub.com integration.
", "refs": { "ProviderDetails$github": "Details for a GitHub.com integration.
" } }, "GitHubOrganizationName": { "base": "The name of a GitHub organization.
", "refs": { "GitHubConfiguration$organizationName": "The name of the GitHub organization to associate with the integration. If not specified, the integration is associated with the authenticated user's personal account.
", "GitHubDetails$organizationName": "The name of the GitHub organization associated with the integration.
" } }, "GitHubTarget": { "base": "The GitHub repository a patch is delivered to, and the pull request that carries it once opened.
", "refs": { "DestinationTarget$github": "The GitHub repository the patch is delivered to, including the pull request once it is opened.
" } }, "GitLabAccessToken": { "base": "A write-only GitLab access token (personal, group or project access token). A type-agnostic bearer token; not stored or returned after creation.
", "refs": { "GitLabConfiguration$accessToken": "The GitLab access token (personal, group or project). Write-only; not stored or returned after creation. If the token carries the self-rotate scope, rotation is opted in and Continuum manages the token thereafter.
" } }, "GitLabConfiguration": { "base": "Configuration for a GitLab integration using a pasted access token.
", "refs": { "ProviderConfiguration$gitlab": "Configuration for a GitLab integration.
" } }, "GitLabDetails": { "base": "Details for a GitLab integration.
", "refs": { "ProviderDetails$gitlab": "Details for a GitLab integration.
" } }, "GitLabInstanceUrl": { "base": "The HTTPS base URL of the GitLab instance (gitlab.com or a self-managed instance).
", "refs": { "GitLabConfiguration$instanceUrl": "The HTTPS base URL of the GitLab instance (gitlab.com or self-managed).
", "GitLabDetails$instanceUrl": "The HTTPS base URL of the GitLab instance.
" } }, "GitLabTargetPath": { "base": "The GitLab group or project path (nested, slash-separated), e.g. "my-org/platform/widgets". Each slash-delimited segment must start with an alphanumeric, so .. segments and empty, leading or trailing slashes are rejected.
The group or project path the integration targets.
", "GitLabDetails$targetPath": "The group or project path the integration targets.
" } }, "GitLabTargetType": { "base": "Whether the GitLab integration targets an entire group or a single project.
", "refs": { "GitLabConfiguration$targetType": "Whether the integration targets a group or a single project.
", "GitLabDetails$targetType": "Whether the integration targets a group or a single project.
" } }, "GitLabTokenRotation": { "base": "How a GitLab integration's access token is rotated.
", "refs": { "GitLabDetails$tokenRotation": "How the integration's access token is rotated. AUTOMATIC only when the pasted token had the self-rotate scope and rotation was opted in at installation time.
" } }, "Integer": { "base": null, "refs": { "FindingEvidence$line": "The 1-indexed line, when known.
", "FindingLocation$startLine": "1-indexed first line of the affected range.
", "FindingLocation$endLine": "1-indexed last line, when the producer reported a range.
", "FindingPosture$statusId": "The producer's numeric enum value for status.
The producer's enum value behind fixCoverage.
The 1-indexed line the finding is about. Bounds are enforced server-side rather than by a constraint trait: a numeric constraint generates a distinct newtype per enclosing structure, so the same concept would not share a type across the create input and the read output.
", "GetCodeFindingOutput$endLine": "The last line of the affected range, from the document's affected_code[].end_line.
", "GetCodeFindingOutput$sourceStatusId": "The producer's numeric enum value for sourceStatus.
Position of this step in the chain.
", "SignalComputation$barriers": "How many of the four exploit preconditions act as barriers (0-4).
", "SignalExploitability$highestLayerReached": "The highest impact layer validation reached, 1-5, as a measure of how far the attack path was walked.
", "ValidationExploitArtifact$responseStatus": "HTTP status observed in the response.
" } }, "IntegrationArn": { "base": "The Amazon Resource Name (ARN) of an Integration resource, of the form arn:{partition}:continuum:{region}:{account}:integrations/{integrationId}.
", "refs": { "CreateIntegrationOutput$integrationArn": "The ARN of the created integration.
", "GetIntegrationOutput$integrationArn": "The ARN of the integration.
", "IntegrationSummary$integrationArn": "The ARN of the integration.
", "UpdateIntegrationOutput$integrationArn": null } }, "IntegrationAuthorizationProviderType": { "base": "A provider whose OAuth authorization can be started with StartIntegrationAuthorization.
", "refs": { "StartIntegrationAuthorizationInput$providerType": "The provider to authorize. Only GITHUB is supported.
" } }, "IntegrationClientToken": { "base": "Caller-provided token identifying one Integration creation attempt. Accepts ASCII characters 33 through 126.
", "refs": { "CreateIntegrationInput$clientToken": "An optional token identifying one create attempt within the caller's account, Region, and operation. SDKs generate a token when omitted. If a request reaches the service without a token, the service generates one for that request. Each request without a token starts a new attempt. To replay an attempt, supply the same token and identical input. Authorized users and roles in the same account can retry an attempt this way. Token records are retained for eight hours after success or terminal failure, including after deletion of a successfully created integration. Different input with the same token returns ValidationException.
" } }, "IntegrationId": { "base": "The unique identifier for an Integration resource.
", "refs": { "CreateIntegrationOutput$integrationId": "The unique identifier of the created integration.
", "DeleteIntegrationInput$integrationId": "The unique identifier of the integration to delete.
", "EnvironmentRepositorySource$integrationId": "Integration that provides the selected repository.
", "EnvironmentS3IntegrationSource$integrationId": "Identifier of an S3 integration in the caller's account. The integration supplies the bucket, the read role, and the external ID Continuum uses to read the prefixes.
", "GetIntegrationInput$integrationId": "The unique identifier of the integration to retrieve.
", "GetIntegrationOutput$integrationId": "The unique identifier of the integration.
", "IntegrationSummary$integrationId": "The unique identifier of the integration.
", "UpdateIntegrationInput$integrationId": "The unique identifier of the S3 integration to update.
", "UpdateIntegrationOutput$integrationId": null } }, "IntegrationName": { "base": "The name for an integration.
", "refs": { "CreateIntegrationInput$name": "The name for the integration.
", "GetIntegrationOutput$name": "The name of the integration.
", "IntegrationSummary$name": "The name of the integration.
", "StartIntegrationAuthorizationInput$name": "The name the integration will be created with. When specified, the request fails with ConflictException if an integration with this name already exists in the account, before the caller leaves for the provider. The name is only checked: it is not reserved, stored, or authorized. CreateIntegration requires its own name, checks it again, and may use a different one.
", "UpdateIntegrationOutput$name": null } }, "IntegrationS3BucketName": { "base": "Customer-managed S3 bucket name.
", "refs": { "S3Configuration$bucket": "Customer-managed source bucket name.
", "S3Details$bucket": null } }, "IntegrationS3ExternalId": { "base": "Caller-provided external ID used when Continuum assumes the S3 integration role.
", "refs": { "S3Configuration$externalId": "Caller-provided external ID required by the role trust policy.
", "UpdateS3Configuration$externalId": "The replacement external ID used when assuming the supplied role. If omitted, the existing external ID is preserved. This value is sensitive and is never included in the public integration response.
" } }, "IntegrationS3RoleArn": { "base": "IAM role assumed by Continuum to read a customer-managed S3 integration.
", "refs": { "S3Configuration$roleArn": "Role Continuum will assume to read from the source bucket.
", "S3Details$roleArn": null, "UpdateS3Configuration$roleArn": "The role to use. Supply the current role when rotating only the external ID. The caller must be allowed to pass this exact role to Continuum.
" } }, "IntegrationSummaries": { "base": "A list of integration summaries.
", "refs": { "ListIntegrationsOutput$items": "The integrations in the account, ordered by integrationId descending.
" } }, "IntegrationSummary": { "base": "A summary of an integration returned in list responses.
", "refs": { "IntegrationSummaries$member": null } }, "IntegrationType": { "base": "The immutable provider type for an integration.
", "refs": { "GetIntegrationOutput$integrationType": "The immutable provider type for the integration.
", "IntegrationSummary$integrationType": "The immutable provider type for the integration.
", "UpdateIntegrationOutput$integrationType": null } }, "InternalServerException": { "base": "The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
", "refs": {} }, "IssueArn": { "base": "The Amazon Resource Name (ARN) of an Issue resource, of the form arn:{partition}:continuum:{region}:{account}:environments/{environmentId}/code-issues/{issueId}.
", "refs": { "GetCodeIssueOutput$issueArn": "The ARN of the issue.
", "IssueSummary$issueArn": "The ARN of the issue.
" } }, "IssueArtifactBody": { "base": "The projected body of an artifact. The active member is selected by the artifact's artifactType, and for a type that carries more than one payload kind by the stored content's own discriminator; raw carries content for types with no defined shape yet and for content that did not match its shape.
The artifact body, projected against the shape defined for its artifactType. A type with a defined shape is returned as that structure, and anything else through IssueArtifactBody.raw.
Inline artifact content. One shared shape keeps the existing content member and generated SDK type stable across artifact kinds instead of adding a PATCH-only member or changing the wire contract to a kind-specific union. The shared model bound accommodates PATCH; kind-specific limits are enforced by the service after deserialization: PATCH accepts up to 5,242,880 UTF-8 bytes (5 MiB), while non-PATCH kinds, including initial Issue artifacts, are limited to 1,048,576 characters (1 MiB of characters). The wider shared model bound is not the non-PATCH limit. PATCH reads return the raw content from the immutable service copy; storage receipts remain private implementation data.
", "refs": { "IssueArtifactBody$raw": "The producer's content verbatim, for an artifactType with no defined shape or content that failed to parse against its shape.
", "PatchBody$patch": "The patch exactly as stored, unmodified. Control Plane accepted it only as a text unified diff, so git apply applies it.
The patch exactly as the remediation agent produced it, unmodified.
" } }, "IssueArtifactId": { "base": "Shared identifier for any issue artifact, regardless of kind.
", "refs": { "GetCodeIssueArtifactInput$artifactId": "The unique identifier of the artifact to retrieve.
", "GetCodeIssueArtifactOutput$artifactId": "The unique identifier of the artifact.
", "IssueArtifactItem$artifactId": "The unique identifier of the artifact.
", "SignalExploitability$sourceValidationArtifactId": "The VALIDATION_EVIDENCE artifact on this same issue holding the proof this verdict summarizes. Fetch it with GetCodeIssueArtifact for the full reasoning chain and exploit artifact.
" } }, "IssueArtifactItem": { "base": "A summary of an artifact returned in list responses.
", "refs": { "CodeIssueArtifactItems$member": null } }, "IssueArtifactMediaType": { "base": "MIME type describing an artifact's inline content, for example text/markdown, application/json, or text/plain.
", "refs": { "GetCodeIssueArtifactOutput$mediaType": "MIME type the producer declared for its content.
", "IssueArtifactItem$mediaType": "MIME type of the artifact content.
" } }, "IssueArtifactProducerName": { "base": "Stable name of the agent that produced an artifact.
", "refs": { "IssueArtifactProducerSummary$agent": "Stable producer name, such as ContinuumValidation.
", "PrevalidationSignal$producerId": "Stable name of the producer that emitted this signal.
", "PrevalidationSignalsBody$producedBy": "The agent that produced this signal set.
" } }, "IssueArtifactProducerSummary": { "base": "The agent that produced an artifact.
", "refs": { "GetCodeIssueArtifactOutput$producer": "The agent that produced the artifact.
", "IssueArtifactItem$producer": "The agent that produced the artifact.
" } }, "IssueArtifactType": { "base": "The category of an artifact attached to an issue, such as evidence, validation evidence, a remediation proposal, a decision, or a patch.
", "refs": { "GetCodeIssueArtifactOutput$artifactType": "Semantic category of the artifact.
", "IssueArtifactItem$artifactType": "Semantic category of the artifact.
", "ListCodeIssueArtifactsInput$artifactType": "Optional filter for a semantic artifact category. Omit to list all artifacts attached to the issue.
" } }, "IssueConfidence": { "base": "The likelihood that this issue is a true positive, expressed as a percentage (0-100). Distinct from severity, which measures impact rather than likelihood. Continuum sets this value; callers can't set it.
", "refs": { "GetCodeIssueOutput$confidence": "The likelihood that this issue is a true positive, expressed as a percentage (0-100).
", "IssueSummary$confidence": "The likelihood that this issue is a true positive, expressed as a percentage (0-100).
" } }, "IssueEvidenceAvailability": { "base": "Whether this issue has any evidence (formerly 'artifacts') attached. NONE = no evidence; AVAILABLE = at least one evidence item exists -- call ListCodeIssueArtifacts to retrieve.
", "refs": { "GetCodeIssueOutput$evidenceAvailability": "Whether the issue has any attached evidence (formerly 'artifacts': tool output, remediation proposals, patches). NONE = no evidence; AVAILABLE = at least one evidence item exists. Computed at read time.
" } }, "IssueFindingIds": { "base": "A non-empty list of finding IDs referenced by an issue. Maximum 50 entries. The first entry is the primary finding; later entries are related findings added after it.
", "refs": { "GetCodeIssueOutput$findingIds": "The findings that motivated this issue. Bare identifiers only -- a caller authorized for GetCodeIssue is not necessarily authorized to read finding detail; call GetCodeFinding for that. Every referenced finding is included regardless of origin (both CustomerUploaded and ContinuumScanner).
" } }, "IssueId": { "base": "The unique identifier for an Issue resource.
", "refs": { "FindingSummary$duplicateOfIssueId": "The existing issue this finding duplicates. Present only for the DUPLICATE_OF_* discard reasons.
", "FindingSummary$createdIssueId": "The issue Continuum created from this finding.
", "GetCodeFindingOutput$duplicateOfIssueId": "The existing issue this finding duplicates. Present only for the DUPLICATE_OF_* discard reasons.
", "GetCodeFindingOutput$createdIssueId": "The issue Continuum created from this finding.
", "GetCodeIssueArtifactInput$issueId": "The issue the artifact is attached to.
", "GetCodeIssueInput$issueId": "The unique identifier of the issue to retrieve.
", "GetCodeIssueOutput$issueId": "The unique identifier of the issue.
", "IssueSummary$issueId": "The unique identifier of the issue.
", "ListCodeIssueArtifactsInput$issueId": "The issue whose artifacts to list.
" } }, "IssueName": { "base": "The name for an issue.
", "refs": { "GetCodeIssueOutput$name": "The name of the issue.
", "IssueSummary$name": "The name of the issue.
" } }, "IssuePatchDelivery": { "base": "Customer delivery of the patches Continuum produced for an issue, summarized across the issue's PATCH artifacts when the issue is read. Each artifact keeps its own delivery.destination with the full detail; this summary lets a caller see a failed delivery without listing artifacts.
Customer delivery of the issue's patches, summarized from its PATCH artifacts at read time. Absent when no patch has a destination delivery.
" } }, "IssuePatchDeliveryCount": { "base": null, "refs": { "IssuePatchDelivery$patchCount": "Number of the issue's patches that have a destination delivery.
", "IssuePatchDelivery$succeededCount": "Number of those patches delivered to their destination.
", "IssuePatchDelivery$failedCount": "Number of those patches whose delivery failed or exhausted its retries.
" } }, "IssuePatchDeliveryFailureReasons": { "base": null, "refs": { "IssuePatchDelivery$failureReasons": "Distinct reasons of the failed deliveries, in ascending order. Present only when failedCount is greater than zero.
" } }, "IssuePatchDeliveryStatus": { "base": "Overall customer delivery result of an issue's patches.
", "refs": { "IssuePatchDelivery$status": "The overall result, in priority order: FAILED when any patch's destination delivery failed or exhausted its retries; otherwise PENDING while any is still in progress; otherwise SUCCEEDED when at least one was delivered; otherwise SKIPPED.
" } }, "IssuePhase": { "base": "The part of Continuum's workflow an issue is in (IN_PROGRESS) or failed in (FAILED, when known).
", "refs": { "GetCodeIssueOutput$phase": "The part of the workflow the issue is in. Present when status is IN_PROGRESS, and when status is FAILED and the failing phase is known.
", "IssueSummary$phase": "The part of the workflow the issue is in. Present when status is IN_PROGRESS, and when status is FAILED and the failing phase is known.
" } }, "IssueRemediationSummary": { "base": "A bounded (<=2048) free-form remediation summary distinct from the shorter per-status IssueStatusMessage; carries the green stage's completion synopsis.
", "refs": { "GetCodeIssueOutput$summary": "The remediation completion summary, when the green stage has run.
" } }, "IssueSeverity": { "base": "Scanner-derived severity assigned to an issue.
", "refs": { "GetCodeIssueOutput$severity": "Current severity: the FindingSeverity seed at create, overwritten by the authoritative severity that prioritization assigns after validation.
", "IssueSummary$severity": "Scanner-derived severity assigned to the issue.
" } }, "IssueSeverityReasoning": { "base": "The human-readable justification for the severity prioritization assigned.
", "refs": { "GetCodeIssueOutput$severityReasoning": "The justification for the current severity. Always leads with a customer-facing basis clause synthesized from how the severity was determined (e.g. "Severity from finding.", "Severity from Continuum system."); when prioritization has run, its own reasoning follows. Issues created before the basis clause was introduced return their original reasoning without it.
" } }, "IssueStatus": { "base": "The customer-facing lifecycle status of an issue. Coarse by design: phase says which part of Continuum's workflow an IN_PROGRESS (or FAILED) issue is in, and statusReason says why a FAILED issue failed. Distinct from FindingStatus.
Continuum sets this value; callers can't set it.
", "refs": { "GetCodeIssueOutput$status": "The current lifecycle status of the issue.
", "IssueSummary$status": "The current lifecycle status of the issue.
" } }, "IssueStatusMessage": { "base": "A human-readable message providing additional context about the current issue status.
", "refs": { "GetCodeIssueOutput$statusMessage": "Customer-facing explanation of statusReason. Present only when status is FAILED.
", "IssueSummary$statusMessage": "Customer-facing explanation of statusReason. Present only when status is FAILED.
" } }, "IssueStatusReason": { "base": "Why an issue is FAILED. Present only when status is FAILED.
Why the issue failed. Present only when status is FAILED.
", "IssueSummary$statusReason": "Why the issue failed. Present only when status is FAILED.
" } }, "IssueSummary": { "base": "A summary of an issue returned in list responses.
", "refs": { "CodeIssueSummaries$member": null } }, "IssueSynopsis": { "base": "A free-form synopsis of the issue: reasoning, evidence references, and completion criteria. Supplementary evidence and provenance belong in issue artifacts (added via a separate operation) rather than duplicated here.
", "refs": { "GetCodeIssueOutput$synopsis": "A free-form synopsis of the issue.
" } }, "KubernetesClusterExternalId": { "base": "Optional external ID supplied when Continuum assumes the Kubernetes cluster role. This is STS trust-policy context, not a substitute for iam:PassRole.
", "refs": { "KubernetesClusterRoleConfiguration$externalId": "Optional external ID Continuum supplies when assuming roleArn. This must match the role trust policy when configured and does not replace the caller's iam:PassRole permission.
" } }, "KubernetesClusterRoleArn": { "base": "ARN of the IAM role used for Kubernetes cluster collection. The role must be in the authenticated caller's account and cannot be a service-linked role.
", "refs": { "GetCollectorOutput$kubernetesClusterRoleArn": "IAM role used to collect Kubernetes cluster metadata.
", "KubernetesClusterRoleConfiguration$roleArn": "IAM role the authenticated caller passes to Continuum.
", "UpdateCollectorOutput$kubernetesClusterRoleArn": "IAM role used to collect Kubernetes cluster metadata.
" } }, "KubernetesClusterRoleConfiguration": { "base": "Complete configuration for the IAM role Continuum assumes to collect Kubernetes cluster metadata.
", "refs": { "CreateCollectorInput$kubernetesClusterRole": "IAM role configuration used to collect Kubernetes cluster metadata. The authenticated caller must be allowed to pass its exact roleArn to Continuum.
", "KubernetesClusterRoleUpdate$set": "Replace the complete role configuration.
" } }, "KubernetesClusterRoleUpdate": { "base": "One complete mutation of the Collector's Kubernetes IAM role configuration.
", "refs": { "UpdateCollectorInput$kubernetesClusterRole": "Atomic update to the IAM role configuration used to collect Kubernetes cluster metadata. The set variant requires a complete configuration; the authenticated caller must be allowed to pass its exact roleArn to Continuum. The remove variant clears both the role and external ID.
" } }, "ListAssociatedCollectorsInput": { "base": "Specifies the Environment whose Collector associations to list.
", "refs": {} }, "ListAssociatedCollectorsOutput": { "base": "Contains one page of the Collectors associated with the requested Environment.
", "refs": {} }, "ListAssociatedEnvironmentsInput": { "base": "Specifies the Collector whose Environment associations to list.
", "refs": {} }, "ListAssociatedEnvironmentsOutput": { "base": "Contains one page of Environment summaries associated with the requested Collector.
", "refs": {} }, "ListCodeFindingsInput": { "base": "Specifies the environment and pagination parameters for listing findings.
", "refs": {} }, "ListCodeFindingsOutput": { "base": "Contains the list of finding summaries and an optional pagination token.
", "refs": {} }, "ListCodeIssueArtifactsInput": { "base": "Specifies the issue, optional filter, and pagination parameters for listing artifacts.
", "refs": {} }, "ListCodeIssueArtifactsOutput": { "base": "Contains the list of artifact summaries and an optional pagination token.
", "refs": {} }, "ListCodeIssuesInput": { "base": "Specifies the environment and pagination parameters for listing issues.
", "refs": {} }, "ListCodeIssuesOutput": { "base": "Contains the list of issue summaries and an optional pagination token.
", "refs": {} }, "ListCodeScansInput": { "base": null, "refs": {} }, "ListCodeScansOutput": { "base": null, "refs": {} }, "ListCollectorsInput": { "base": "Specifies no request parameters. The target account is derived exclusively from the authenticated calling context.
", "refs": {} }, "ListCollectorsOutput": { "base": "Contains summaries of the caller account's Collectors.
", "refs": {} }, "ListEnvironmentsInput": { "base": "Specifies pagination parameters for listing environments.
Response-filtering justification: filtering is intentionally omitted because every current consumer needs the canonical complete, account-scoped environment inventory, and no useful selective server-side query use case is defined. Environment ID already has the GetEnvironment lookup operation, and status, name, or timestamp filtering is not needed by any current workflow. Adding speculative filters would require unsupported access patterns and ambiguous semantics without reducing data returned for existing consumers. If a concrete indexed query use case is introduced later, its filter values must be bound to pagination tokens so a token cannot be replayed against a different query. The formal API standards decision is recorded in the package-root BR_EXCEPTIONS.md file.
", "refs": {} }, "ListEnvironmentsOutput": { "base": "Contains environment metadata and an optional pagination token.
", "refs": {} }, "ListIntegrationsInput": { "base": "Specifies pagination parameters for listing integrations.
", "refs": {} }, "ListIntegrationsOutput": { "base": "Contains the list of integration summaries and an optional pagination token.
", "refs": {} }, "Long": { "base": null, "refs": { "IssueArtifactItem$contentSizeBytes": "Size of the artifact content in bytes. The content itself is returned by GetCodeIssueArtifact.
", "PatchBody$sizeBytes": "Size of the patch in UTF-8 bytes, the unit the digest is computed over.
" } }, "MaxResults": { "base": "The maximum number of results to return in a single call. Must be between 1 and 100.
", "refs": { "ListAssociatedCollectorsInput$maxResults": "Maximum number of associated Collectors to return.
", "ListAssociatedEnvironmentsInput$maxResults": "Maximum number of Environment associations to return.
", "ListCodeFindingsInput$maxResults": "The maximum number of results to return in a single call.
", "ListCodeIssueArtifactsInput$maxResults": "The maximum number of results to return in a single call.
", "ListCodeIssuesInput$maxResults": "The maximum number of results to return in a single call.
", "ListCodeScansInput$maxResults": "Maximum number of scans to return.
", "ListEnvironmentsInput$maxResults": "The maximum number of results to return in a single call.
", "ListIntegrationsInput$maxResults": "The maximum number of results to return in a single call.
" } }, "NextToken": { "base": "A pagination token returned by a previous call, used to retrieve the next page of results.
", "refs": { "ListAssociatedCollectorsInput$nextToken": "Pagination token returned by a prior request.
", "ListAssociatedCollectorsOutput$nextToken": "Pagination token for the next page, if present.
", "ListAssociatedEnvironmentsInput$nextToken": "Pagination token returned by a prior request.
", "ListAssociatedEnvironmentsOutput$nextToken": "Pagination token for the next page, if present.
", "ListCodeFindingsInput$nextToken": "A pagination token returned by a previous call. Set to null for the first request; use the returned token for subsequent calls.
", "ListCodeFindingsOutput$nextToken": "A pagination token to retrieve the next page of results. Absent when there are no more results.
", "ListCodeIssueArtifactsInput$nextToken": "A pagination token returned by a previous call. Set to null for the first request; use the returned token for subsequent calls.
", "ListCodeIssueArtifactsOutput$nextToken": "A pagination token to retrieve the next page of results. Absent when there are no more results.
", "ListCodeIssuesInput$nextToken": "A pagination token returned by a previous call. Set to null for the first request; use the returned token for subsequent calls.
", "ListCodeIssuesOutput$nextToken": "A pagination token to retrieve the next page of results. Absent when there are no more results.
", "ListCodeScansInput$nextToken": "Pagination token returned by a prior request.
", "ListCodeScansOutput$nextToken": "Pagination token for the next page, if present.
", "ListEnvironmentsInput$nextToken": "A pagination token returned by a previous call. Set to null for the first request; use the returned token for subsequent calls.
", "ListEnvironmentsOutput$nextToken": "A pagination token to retrieve the next page of results. Absent when there are no more results.
", "ListIntegrationsInput$nextToken": "A pagination token returned by a previous call. Set to null for the first request; use the returned token for subsequent calls.
", "ListIntegrationsOutput$nextToken": "A pagination token to retrieve the next page of results. Absent when there are no more results.
" } }, "OAuthCodeChallenge": { "base": "A PKCE code challenge (RFC 7636): the base64url encoding, without padding, of the SHA-256 digest of the code verifier the service keeps.
", "refs": { "StartIntegrationAuthorizationOutput$codeChallenge": "The PKCE code challenge to send as the OAuth code_challenge parameter.
The PKCE code challenge method (RFC 7636).
", "refs": { "StartIntegrationAuthorizationOutput$codeChallengeMethod": "The PKCE challenge method to send as the OAuth code_challenge_method parameter.
An opaque OAuth state value. StartIntegrationAuthorization returns one, and CreateIntegration redeems it, together with the authorization code, for the same AWS account. Sensitive so clients and the service never log it.
The state returned by GitHub in the OAuth callback. It must be the state that StartIntegrationAuthorization returned to the same AWS account, and the authorization request must have sent that call's codeChallenge. The state can be redeemed once. A stage that enforces authorization sessions rejects a missing, expired, already used, or other-account state with ValidationException; restart the authorization with StartIntegrationAuthorization.
An opaque value to send as the OAuth state parameter. Pass the value the provider returns in its callback to CreateIntegration as authorization.state.
The ecosystem that supplies a package, e.g. "npm", "pip", "maven".
", "refs": { "AffectedPackage$packageManager": "The ecosystem supplying the package.
" } }, "PackageName": { "base": "The name of a software package implicated by a finding.
", "refs": { "AffectedPackage$name": "The package name.
" } }, "PackageVersion": { "base": "A package version string. Not parsed or compared by Continuum -- version syntax is ecosystem-specific.
", "refs": { "AffectedPackage$version": "The affected version.
", "AffectedPackage$fixedInVersion": "The earliest version that resolves the issue, when one is known.
" } }, "PatchBody": { "base": "Projected content for a PATCH artifact: the remediation patch for one repository, with the descriptors needed to verify and apply it and the state of its delivery to the customer's own bucket or repository.
", "refs": { "IssueArtifactBody$patch": "Projected PATCH content: the remediation patch for one repository, with the descriptors needed to verify and apply it and the state of its delivery to the customer's own bucket or repository.
Every PATCH projects here. The descriptors come from members Control Plane computes or owns when it stores the patch, not from producer metadata, so this member is the whole PATCH contract and metadata is omitted for it.
Policy governing whether Continuum creates a patch for a proposed remediation.
", "refs": { "EnvironmentConfiguration$patchCreationPolicy": "Whether Continuum creates a patch for a proposed remediation. Defaults to DISABLED.
" } }, "PatchDelivery": { "base": "Delivery of a patch to a destination the customer owns: an object in the environment's source bucket or a pull request in the source repository.
", "refs": { "PatchBody$delivery": "Delivery of the patch to the customer's bucket or repository. Absent when the artifact has no delivery destination.
" } }, "PatchFormat": { "base": "How a patch is encoded, which determines the command that applies it.
", "refs": { "PatchBody$format": "The patch's wire format, read from the patch itself, which determines how to apply it. Absent when the patch starts with neither a git mailbox header nor a diff --git header.
The patch's wire format, which determines how to apply it. Absent when the producer recorded a format with no mapping yet.
" } }, "PerFindingResult": { "base": "Validation's result for one finding within a multi-finding bundle.
", "refs": { "PerFindingResults$member": null } }, "PerFindingResults": { "base": null, "refs": { "ValidationEvidenceBody$perFindingResults": "Per-finding breakdown for a multi-finding bundle. Absent for a single-finding bundle.
" } }, "PrevalidationSignal": { "base": "One producer's conclusion about one subject on one scoring dimension.
", "refs": { "PrevalidationSignals$member": null } }, "PrevalidationSignals": { "base": null, "refs": { "PrevalidationSignalsBody$signals": "The signals backing the Issue's proposed severity.
" } }, "PrevalidationSignalsBody": { "base": "Projected content for an EVIDENCE artifact carrying prioritization's prevalidation signals.
", "refs": { "IssueArtifactBody$prevalidationSignals": "Projected EVIDENCE content whose stored envelope declares artifact_kind: prevalidation_signals — the severity signals prioritization uses.
One artifactType can select different members here: EVIDENCE also carries the prioritization markdown narrative, which is not JSON and so returns through raw. The member is therefore chosen by artifactType AND, for a type that carries more than one payload kind, the content's own discriminator.
Provider-specific configuration for creating an integration. Only one member may be specified.
", "refs": { "CreateIntegrationInput$providerConfiguration": "The provider-specific configuration required to create the integration. Only one member may be specified.
" } }, "ProviderDetails": { "base": "Provider-specific details for an integration. Only one member will be present.
", "refs": { "GetIntegrationOutput$providerDetails": "Provider-specific details for the integration.
", "IntegrationSummary$providerDetails": "Provider-specific details for the integration.
", "UpdateIntegrationOutput$providerDetails": null } }, "PutResourcePolicyInput": { "base": "Specifies the resource and its new policy.
", "refs": {} }, "PutResourcePolicyOutput": { "base": "Contains the stored resource policy.
", "refs": {} }, "ReasoningStep": { "base": "One step in the validation agent's reasoning chain.
", "refs": { "ReasoningSteps$member": null } }, "ReasoningSteps": { "base": null, "refs": { "PerFindingResult$reasoningChain": "Reasoning chain recorded for this finding.
" } }, "RedirectUrl": { "base": "An HTTPS redirect/callback URL used during the OAuth authorization flow. Must be one of the redirect URLs registered on the underlying GitHub App.
", "refs": { "GitHubAuthorizationConfiguration$redirectUrl": "The redirect URL used to obtain the authorization code. Must match one of the redirect URLs registered on the GitHub App. If omitted, the App's default redirect URL is used. Not stored or returned after creation.
" } }, "RemediationProposalBody": { "base": "Projected content for a REMEDIATION_PROPOSAL artifact: the patch the remediation agent produced, with the descriptors needed to apply and verify it.
", "refs": { "IssueArtifactBody$remediationProposal": "Projected REMEDIATION_PROPOSAL content: a patch the remediation agent produced, with the descriptors needed to apply and verify it.
REMEDIATION_PROPOSAL content that does not match this shape is returned through raw.
Empty marker selecting removal in KubernetesClusterRoleUpdate.
", "refs": { "KubernetesClusterRoleUpdate$remove": "Remove the configured role and external ID.
" } }, "RepositoryBranch": { "base": "A repository branch name.
", "refs": { "EnvironmentRepositorySource$defaultBranch": "Branch used when a scan does not choose a more specific revision.
" } }, "RepositoryName": { "base": "The name of a repository in owner/repository format (e.g. acme/payments-api). For an organization-scoped integration, the owner segment must match the integration's GitHub organization (validated at environment creation time). For a personal-account integration, the owner segment is the personal GitHub username and is not validated.
", "refs": { "EnvironmentRepositorySource$repository": "Repository selected from that integration in owner/repository form.
" } }, "ResourceNotFoundException": { "base": "The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
", "refs": {} }, "ResourcePolicyDocument": { "base": "A resource policy in displayable JSON form.
", "refs": { "GetResourcePolicyOutput$policy": null, "PutResourcePolicyOutput$policy": null } }, "ResourcePolicyInputDocument": { "base": "A non-empty resource policy document supplied on writes.
", "refs": { "PutResourcePolicyInput$policy": "Omit or supply an empty Statement array to clear resource-policy grants and store the canonical empty-statement policy. Cross-account access is denied; same-account access remains subject to identity policies. Use an explicit Deny statement to deny same-account principals too.
" } }, "ResourcePolicyRevisionId": { "base": "Opaque optimistic-concurrency token for a resource policy.
", "refs": { "GetResourcePolicyOutput$revisionId": null, "PutResourcePolicyInput$expectedRevisionId": "Optional optimistic-concurrency token for the currently observed policy.
", "PutResourcePolicyOutput$revisionId": null } }, "ResourcePolicyTargetArn": { "base": "The ARN of a Continuum resource that supports a resource policy. Collectors are the only supported resource type; other well-formed Continuum ARNs are rejected with ValidationException.
", "refs": { "GetResourcePolicyInput$arn": "The ARN of a resource in the caller's account.
", "GetResourcePolicyOutput$arn": null, "PutResourcePolicyInput$arn": "The ARN of a resource in the caller's account.
", "PutResourcePolicyOutput$arn": null } }, "S3Configuration": { "base": "Configuration for a customer-managed S3 integration.
", "refs": { "ProviderConfiguration$s3": "Configuration for a customer-managed S3 integration.
" } }, "S3Details": { "base": "Public details for a customer-managed S3 integration. The sensitive external ID is intentionally omitted.
", "refs": { "ProviderDetails$s3": "Public details for a customer-managed S3 integration.
" } }, "S3Target": { "base": "The S3 object a patch is delivered to.
", "refs": { "DestinationTarget$s3": "The S3 object the patch is delivered to.
" } }, "ScanClientToken": { "base": "Caller-provided idempotency token for an environment scan request.
", "refs": { "CreateCodeScanInput$clientToken": "An optional token identifying one scan request for this environment. SDKs generate a token when omitted. If a request reaches the service without a token, the service generates one for that request, so each request without a token starts a new scan. To retry a request after a lost response, supply the same token on the same environment; once a request with that token has succeeded, a retry returns the original scan. Concurrent requests with the same token, or a retry after a request that failed partway through, can leave an additional scan, which may end FAILED as superseded. A token is bound to its scan for as long as the service retains the scan's build record, with no shorter expiry. Deleting the environment makes the binding inaccessible: a later request with the token returns ResourceNotFoundException.
" } }, "ScanFailureStage": { "base": "The phase a failed scan was in when it failed.
Present only on a FAILED scan, and absent on one that failed before this field existed. Shares its vocabulary with the non-terminal ScanStatus values so a failure reads directly against the phase sequence, with no mapping.
", "refs": { "CodeScanData$failureStage": "Phase this scan failed in. Present only when status is FAILED, and absent for a scan that failed before this field existed.
Phase this scan failed in. Present only when status is FAILED, and absent for a scan that failed before this field existed.
ISO-8601 duration requested for recurring scans. Supported values are P1D (1 day), P2D (2 days), P7D (7 days), and PT0H (manual scans only). Existing environments with no cadence or a legacy PT6H, PT12H, or PT24H cadence use P1D. Legacy PT48H uses P2D. New requests must use a supported value.
", "refs": { "EnvironmentConfiguration$scanFrequency": "Recurring scan interval: P1D (1 day), P2D (2 days), or P7D (7 days). PT0H disables recurring scans. Defaults to P1D when creating an environment.
" } }, "ScanOrigin": { "base": "Identifies why a scan run was created.
", "refs": { "CodeScanData$origin": "Why the scan was created. Always present.
", "CodeScanSummary$origin": "Why the scan was created. Always present.
" } }, "ScanRunFailureMessage": { "base": "Customer-safe failure detail for a scan run.
", "refs": { "CodeScanData$failureMessage": "Failure detail present for unsuccessful scans.
", "CodeScanSummary$failureMessage": "Failure detail present for unsuccessful scans.
" } }, "ScanRunId": { "base": "Opaque identifier for a Continuum scan run.
", "refs": { "CodeScanData$scanRunId": "The unique scan identifier.
", "CodeScanSummary$scanRunId": "The unique scan identifier.
", "FindingSummary$scanRunId": "The scan that produced the finding, when it came from one. For a finding Continuum's scanner produced, this is the Continuum scan run (see GetCodeScan). For a finding submitted with CreateCodeFinding, it is the OCSF document's metadata.correlation_uid, when that value is a valid ScanRunId. Absent when the finding did not come from a scan.
The scan that produced the finding, when it came from one. For a finding Continuum's scanner produced, this is the Continuum scan run (see GetCodeScan). For a finding submitted with CreateCodeFinding, it is the OCSF document's metadata.correlation_uid, when that value is a valid ScanRunId. Absent when the finding did not come from a scan.
Scan to retrieve.
" } }, "ScanStatus": { "base": "The phase of a scan.
A scan always builds the selected source first and then analyzes the verified result, so the phases below span both halves of the work.
These values are labels, not an ordered sequence for clients to compare. A scan does not necessarily observe every phase — phases are short-lived and a poll can miss one entirely.
", "refs": { "CodeScanData$status": "Current customer-visible status.
", "CodeScanSummary$status": "Current customer-visible status.
" } }, "ServiceQuotaExceededException": { "base": "The request would exceed a service quota. Review your quota and request an increase if needed.
", "refs": {} }, "SignalAccessLevel": { "base": "The level of access exploitation requires.
", "refs": { "SignalAccessPrecondition$value": "The level of access exploitation requires. Absent when the producer reported a level with no mapping yet.
" } }, "SignalAccessPrecondition": { "base": "The assessed access-level precondition with the basis behind it.
", "refs": { "SignalPreconditions$accessLevel": "What level of access exploitation requires.
" } }, "SignalAttackerGains": { "base": "What an attacker gains from exploitation, strongest capability first.
", "refs": { "SignalAttackerGainsDimension$value": "The capability exploitation grants. Absent when the producer reported a value with no mapping yet.
" } }, "SignalAttackerGainsDimension": { "base": "The assessed attacker-gains dimension with the basis behind it.
", "refs": { "SignalImpactDimensions$attackerGains": "What the attacker gains from exploitation.
" } }, "SignalBand": { "base": "A likelihood or impact band on prioritization's shared four-value scale.
", "refs": { "SignalComputation$likelihoodBand": "Computed likelihood band, on a likelihood signal.
", "SignalComputation$impactBand": "Computed impact band, on an impact signal.
" } }, "SignalBasis": { "base": "Where an assessed value came from, strongest evidence first. A customer weighing an assessment reads this to tell a fact read out of their own code from the producer's inference.
The first three values name a source that states the value directly. The last two do not: INFERRED means the producer reasoned its way to the value, and NO_EVIDENCE_DEFAULT means it had nothing to reason from and used a default.
", "refs": { "SignalAccessPrecondition$basis": "Where the producer's determination came from.
", "SignalAttackerGainsDimension$basis": "Where the producer's determination came from.
", "SignalBlastRadiusDimension$basis": "Where the producer's determination came from.
", "SignalPrecondition$basis": "Where the producer's determination came from.
", "SignalTargetValueDimension$basis": "Where the producer's determination came from.
" } }, "SignalBlastRadius": { "base": "How far the consequences of exploitation reach, widest first.
", "refs": { "SignalBlastRadiusDimension$value": "How far the consequences reach. Absent when the producer reported a value with no mapping yet.
" } }, "SignalBlastRadiusDimension": { "base": "The assessed blast-radius dimension with the basis behind it.
", "refs": { "SignalImpactDimensions$blastRadius": "How far the consequences reach.
" } }, "SignalComputation": { "base": "Deterministic values the producer computed from its assessment, as distinct from the assessment itself.
", "refs": { "PrevalidationSignal$computed": "The deterministic values the producer computed from its assessment.
" } }, "SignalConfidenceReasoning": { "base": "A producer's structured rationale for a signal's confidence.
", "refs": { "PrevalidationSignal$confidenceReasoning": "Why the producer is or is not sure, kept structured rather than prose.
" } }, "SignalDimension": { "base": "The scoring axis a signal speaks to.
", "refs": { "PrevalidationSignal$dimension": "The axis this signal speaks to. Absent when the producer reported a dimension with no mapping yet.
" } }, "SignalExploitability": { "base": "What validation established about exploitability, as summarized onto the scoring signal derived from it.
", "refs": { "PrevalidationSignal$exploitability": "What validation established about exploitability, on an exploitability signal. This summarizes the verdict the signal was derived from; the proof itself is the VALIDATION_EVIDENCE artifact it cites.
" } }, "SignalImpactDimensions": { "base": "The three impact dimensions an impact signal assessed. The computed impact band is derived from attackerGains and blastRadius, then shifted by targetValue.
", "refs": { "PrevalidationSignal$impactDimensions": "The three impact dimensions an impact signal assessed, each with the basis the producer had for it. These are what the computed impact band is derived from.
" } }, "SignalPrecondition": { "base": "One assessed precondition with the basis behind it.
", "refs": { "SignalPreconditions$reachableFromAttacker": "Whether the vulnerable code path is reachable by an attacker.
", "SignalPreconditions$configurationNeeded": "Whether exploitation depends on a non-default configuration.
", "SignalPreconditions$userInteractionRequired": "Whether exploitation requires a user other than the attacker to take part, for example by opening a link or a file (CVSS User Interaction).
" } }, "SignalPreconditions": { "base": "The four preconditions a likelihood signal assessed.
", "refs": { "PrevalidationSignal$preconditions": "The four exploit preconditions a likelihood signal assessed, each with the basis the producer had for it.
" } }, "SignalStrength": { "base": "A signal's own rating, an input to scoring rather than a finding severity.
", "refs": { "PrevalidationSignal$signalStrength": "The signal's own rating. This is an input to scoring and is NOT the finding's severity.
" } }, "SignalTargetValue": { "base": "How valuable the exploited target is.
", "refs": { "SignalTargetValueDimension$value": "How valuable the target is. Absent when the producer reported a value with no mapping yet.
" } }, "SignalTargetValueDimension": { "base": "The assessed target-value dimension with the basis behind it.
", "refs": { "SignalImpactDimensions$targetValue": "How valuable the target is, which can shift the band off its base value.
" } }, "SourceFindingId": { "base": "The producer's stable identifier for the finding, extracted from the submitted document. Useful for cross-referencing with the originating system.
", "refs": { "FindingSummary$sourceFindingId": "The producer's own identifier for the finding.
", "GetCodeFindingOutput$sourceFindingId": "The producer's own identifier for the finding.
" } }, "StartIntegrationAuthorizationInput": { "base": "Specifies the provider to authorize and, optionally, the name the new integration will use.
", "refs": {} }, "StartIntegrationAuthorizationOutput": { "base": "Contains the values to send to the provider's authorization endpoint.
", "refs": {} }, "String": { "base": null, "refs": { "AccessDeniedException$message": "Error description.
", "ConflictException$message": "Description of the conflict.
", "InternalServerException$message": "Error description.
", "ResourceNotFoundException$message": "Description of the resource that was not found.
", "ServiceQuotaExceededException$message": "Description of the quota that was exceeded.
", "ServiceQuotaExceededException$quotaCode": "The quota code for the exceeded limit.
", "ServiceQuotaExceededException$serviceCode": "The service code for the exceeded limit.
", "ThrottlingException$message": "Description of the throttling error.
", "ValidationException$message": null, "ValidationExceptionField$path": null, "ValidationExceptionField$message": null } }, "SyntheticTimestamp_date_time": { "base": null, "refs": { "AssociatedEnvironment$createdAt": "The timestamp when the associated Environment was created.
", "CodeScanData$createdAt": "Time at which Continuum accepted the scan request.
", "CodeScanData$completedAt": "Time at which a terminal result was recorded.
", "CodeScanSummary$createdAt": "Time at which Continuum accepted the scan request.
", "CodeScanSummary$completedAt": "Time at which a terminal result was recorded.
", "CollectorSummary$createdAt": "The timestamp when the Collector was created.
", "CreateCodeFindingOutput$createdAt": "The timestamp when the finding was ingested.
", "CreateCollectorOutput$createdAt": "The timestamp when the Collector was created.
", "CreateEnvironmentOutput$createdAt": "The timestamp when the environment was created.
", "CreateIntegrationOutput$createdAt": "The timestamp when the integration was created.
", "EnvironmentListEntry$createdAt": "The timestamp when the environment was created. Preserve the existing EnvironmentSummary.createdAt date-time wire format.
", "FindingSummary$reportedAt": "When the producer reported the finding -- its own clock, which is not Continuum's ingestion time. createdAt is when Continuum accepted it; these are genuinely different instants and a reader usually wants this one.
For CreateCodeFinding, this is the submitted OCSF document's own top-level time. For findings Continuum's scanner produces, it is the finding's own creation time.
Continuum does not validate it for plausibility: a producer's value is echoed as given, so a timestamp here asserts the unit and format, not that the instant is genuine.
The timestamp when the status last transitioned.
", "FindingSummary$createdAt": "The timestamp when the finding was ingested.
", "FindingSummary$completedAt": "When processing finished, whether by creating an issue or discarding. Absent while the finding is still in flight.
", "GetCodeFindingOutput$firstSeenAt": "When the producer first observed the finding (finding_info.first_seen_time). The producer's own clock, not Continuum's.
", "GetCodeFindingOutput$reportedAt": "When the producer reported the finding -- its own clock, which is not Continuum's ingestion time. createdAt is when Continuum accepted it; these are genuinely different instants and a reader usually wants this one.
For CreateCodeFinding, this is the submitted OCSF document's own top-level time. For findings Continuum's scanner produces, it is the finding's own creation time.
Continuum does not validate it for plausibility: a producer's value is echoed as given, so a timestamp here asserts the unit and format, not that the instant is genuine.
The timestamp when the status last transitioned.
", "GetCodeFindingOutput$createdAt": "The timestamp when the finding was ingested.
", "GetCodeFindingOutput$completedAt": "When processing finished, whether by creating an issue or discarding. Absent while the finding is still in flight.
", "GetCodeIssueArtifactOutput$createdAt": "The timestamp when the artifact was created.
", "GetCodeIssueOutput$statusUpdatedAt": "The timestamp when the status or phase last changed.
", "GetCodeIssueOutput$createdAt": "The timestamp when the issue was created.
", "GetCodeIssueOutput$updatedAt": "The timestamp when any field of the issue last changed. Advances on every mutation (including score-only updates that do not transition status), so it is greater than or equal to statusUpdatedAt.
", "GetCollectorOutput$createdAt": "The timestamp when the Collector was created.
", "GetCollectorOutput$updatedAt": "The time of the last successful UpdateCollector call, returned at whole-second precision in the same date-time format as createdAt.
", "GetEnvironmentOutput$statusUpdatedAt": "The timestamp when the status last transitioned.
", "GetEnvironmentOutput$createdAt": "The timestamp when the environment was created.
", "GetEnvironmentOutput$updatedAt": "The timestamp when the environment's properties were last updated.
", "GetIntegrationOutput$createdAt": "The timestamp when the integration was created.
", "GetIntegrationOutput$updatedAt": "The timestamp when the integration was last updated.
", "GitLabDetails$expiresAt": "The expiry of the stored access token, for non-rotating tokens only. A rotated token's original expiry is stale, so this is omitted when tokenRotation is AUTOMATIC.
", "IntegrationSummary$createdAt": "The timestamp when the integration was created.
", "IntegrationSummary$updatedAt": "The timestamp when the integration was last updated.
", "IssueArtifactItem$createdAt": "The timestamp when the artifact was created.
", "IssueSummary$statusUpdatedAt": "The timestamp when the status or phase last changed.
", "IssueSummary$createdAt": "The timestamp when the issue was created.
", "IssueSummary$updatedAt": "The timestamp when any field of the issue last changed. Advances on every mutation (including score-only updates that do not transition status), so it is greater than or equal to statusUpdatedAt.
", "PatchDelivery$updatedAt": "When the delivery status last changed.
", "StartIntegrationAuthorizationOutput$expiresAt": "The time after which CreateIntegration no longer accepts this authorization.
", "UpdateCollectorOutput$createdAt": "The timestamp when the Collector was created.
", "UpdateCollectorOutput$updatedAt": "The time of the last successful UpdateCollector call, returned at whole-second precision in the same date-time format as createdAt.
", "UpdateEnvironmentOutput$statusUpdatedAt": "The timestamp when the status last transitioned. Uses the existing GetEnvironment/ListEnvironments ISO-8601 wire format for this field.
", "UpdateEnvironmentOutput$createdAt": "The timestamp when the environment was created. Uses the existing GetEnvironment/ListEnvironments ISO-8601 wire format for this field.
", "UpdateIntegrationOutput$createdAt": "When the integration was created.
", "UpdateIntegrationOutput$updatedAt": "When the integration was last updated.
" } }, "ThrottlingException": { "base": "The request was denied due to request throttling.
", "refs": {} }, "UpdateCodeConfiguration": { "base": "Mutable source and operating-policy settings for a code environment.
", "refs": { "UpdateEnvironmentConfiguration$codeConfiguration": "Changes to a code-scanning environment.
" } }, "UpdateCollectorInput": { "base": "Specifies the mutable Collector properties. At least one property must be supplied. k8ClusterRole models an atomic set-or-remove mutation, so roleArn and externalId are replaced or removed together.
", "refs": {} }, "UpdateCollectorOutput": { "base": "Contains the current state of the updated Collector.
", "refs": {} }, "UpdateEnvironmentConfiguration": { "base": "Type-specific changes to an environment. Omitted members preserve stored values.
", "refs": { "UpdateEnvironmentInput$configuration": "Type-specific configuration changes. Omission preserves the configuration.
" } }, "UpdateEnvironmentInput": { "base": "Specifies the mutable environment properties. Supply a name or a change under configuration.codeConfiguration. Its sourceConfiguration.s3Sources and sourceConfiguration.repositorySources replace the S3 source and repository selections. Its environmentConfiguration has patch semantics: omitted members preserve stored values, scanFrequency updates scan cadence, and network and patchCreationPolicy replace the corresponding policies.
", "refs": {} }, "UpdateEnvironmentOutput": { "base": "Contains the current state of the updated environment. Use GetEnvironment to read its source and environment configuration.
", "refs": {} }, "UpdateIntegrationInput": { "base": "Specifies the S3 integration and the credentials to validate and save.
", "refs": {} }, "UpdateIntegrationOutput": { "base": "Contains the current state of the updated S3 integration. The sensitive external ID is omitted.
", "refs": {} }, "UpdateProviderConfiguration": { "base": "Provider-specific changes for updating an integration. Only S3 integrations can be updated, so S3 is the only member.
", "refs": { "UpdateIntegrationInput$providerConfiguration": "The provider-specific changes to apply. The member must match the integration's provider type, and only S3 integrations can be updated.
" } }, "UpdateS3Configuration": { "base": "Replacement credentials for a customer-managed S3 integration. The bucket cannot be changed.
", "refs": { "UpdateProviderConfiguration$s3": "Replacement credentials for a customer-managed S3 integration.
" } }, "ValidationConfidence": { "base": "Confidence in a validation verdict, on the producer's native 0-1 scale.
Deliberately unconstrained in the model: the smithy-rs server SDK rejects @range on a double (smithy-rs#2007). The bound is enforced where the value is produced instead — Control Plane projects this from stored content and omits the member when the stored value falls outside 0-1, so an out-of-range producer value never surfaces here as a valid confidence. The rest of the body still projects; only the confidence is dropped.
Confidence in this flow's verdict. Absent when out of range.
", "PerFindingResult$confidence": "Confidence in this finding's verdict. Absent when out of range.
", "PrevalidationSignal$confidence": "The producer's confidence in this conclusion, on its native 0-1 scale. Absent when the stored value falls outside 0-1.
", "ReasoningStep$confidence": "Confidence in this individual claim, on the producer's native 0-1 scale.
" } }, "ValidationConfidenceTier": { "base": "How strong the evidence behind an exploitability verdict is, weakest first.
Modeled as named tiers rather than the producer's 1-4 ordinal: the number alone carries no meaning outside Continuum's own table, and a customer branching on "was this actually run" needs the distinction by name. The declaration order is the ordering.
", "refs": { "SignalExploitability$confidenceTier": "How strong the evidence behind the verdict is.
" } }, "ValidationEvidenceBody": { "base": "Projected content for a VALIDATION_EVIDENCE artifact: the validation agent's durable proof of exploitability.
", "refs": { "IssueArtifactBody$validationEvidence": "Projected VALIDATION_EVIDENCE content.
" } }, "ValidationException": { "base": null, "refs": {} }, "ValidationExceptionField": { "base": null, "refs": { "ValidationExceptionFieldList$member": null } }, "ValidationExceptionFieldList": { "base": null, "refs": { "ValidationException$fieldList": null } }, "ValidationExecutedProof": { "base": "Proof of exploitability the validation agent produced by executing code against the repository under test, with the output that execution produced.
", "refs": { "ValidationEvidenceBody$executedProof": "Proof the agent produced by executing code against the repository under test, with the output that execution produced.
" } }, "ValidationExploitArtifact": { "base": "A concrete exploit payload and the effect validation observed from it.
", "refs": { "PerFindingResult$exploitArtifact": "Exploit artifact produced for this finding, when there was one.
", "ValidationEvidenceBody$exploitArtifact": "Concrete payload and its observed effect, when validation produced one by sending an HTTP request.
Only an HTTP proof projects here. A validation agent that proves exploitability by RUNNING code against the repository projects executedProof, and one that proves it by reading the source projects sourceAnalysis. All three are mutually exclusive: at most one is present.
The executed proof's program. Further members, such as command, workingDirectory and supportingInputs, can be added later as optional details.
", "refs": { "ValidationExecutedProof$code": "The code that was run. Not a request payload: it imports the repository's own modules and drives the vulnerable code path directly.
" } }, "ValidationProofConsoleOutput": { "base": "The retained merged console output; its structure allows optional additions.
", "refs": { "ValidationProofOutput$consoleOutput": "What the run printed: standard output and standard error merged, as retained. The text may be empty.
" } }, "ValidationProofMaterial": { "base": "One proof program file. Further members, such as path and purpose, can be added later as optional details.
", "refs": { "ValidationProofMaterials$member": null } }, "ValidationProofMaterialText": { "base": "The retained proof file text; its structure allows optional additions.
", "refs": { "ValidationProofMaterial$content": "The file's non-blank text, exactly as retained.
" } }, "ValidationProofMaterials": { "base": "The proof program's files, bounded so later optional details can be added.
", "refs": { "ValidationProofCode$proofCode": "Proof program files, main file first, in their retained order.
" } }, "ValidationProofOutput": { "base": "Retained run output. Further members, such as completion and outputCompleteness, can be added later as optional details.
", "refs": { "ValidationExecutedProof$output": "What the execution printed, including the agent's own PASS/FAIL assertions. Absent when the run printed nothing retained.
" } }, "ValidationProofSummary": { "base": "The Markdown analysis summary; its structure allows optional additions.
", "refs": { "ValidationSourceAnalysis$summary": "The non-blank analysis as Markdown: the annotated entry-to-sink walk, its citations, and why the checked guards are absent or bypassed.
" } }, "ValidationSourceAnalysis": { "base": "Proof of exploitability the validation agent produced by reading the repository's source, with nothing built or run. Further members, such as diagram and references, can be added later as optional details.
", "refs": { "ValidationEvidenceBody$sourceAnalysis": "Proof the agent produced by reading the repository's source, with nothing built or run.
" } }, "ValidationTerminalStatus": { "base": "How a validation run ended. Producer statuses map onto these; an unmapped status omits terminalStatus while the rest of the body still projects.
How the validation run ended. Absent when the producer reported a status with no mapping yet: the rest of the body still projects, so one unmapped enum never costs a customer the whole artifact.
" } } } }