snyk-api-interaction

Snyk API & CLI Interaction

Overview

Snyk provides both CLI and REST API v1 for programmatic access to scanning results. This skill covers CLI JSON parsing and REST API interaction patterns for all 4 Snyk products.

CLI JSON Output (Universal Format)

All snyk test --json commands return a consistent structure:

{
  "vulnerabilities": [
    {
      "id": "SNYK-JS-LODASH-1234567",
      "severity": "critical",
      "title": "Prototype Pollution in lodash",
      "packageName": "lodash",
      "version": "4.17.20",
      "from": ["myapp", "lodash"],
      "to": ["[email protected]"],
      "description": "...",
      "fixedIn": ["4.17.21"],
      "remediation": {
        "unmanaged": "Upgrade lodash from 4.17.20 to 4.17.21"
      },
      "type": "vulnerability"
    }
  ],
  "ok": false,
  "dependencyCount": 42,
  "summary": "42 vulnerabilities found"
}

Parsing Key Fields

Field	Type	Usage
vulnerabilities[]	Array	All found issues
vulnerabilities[].id	String	Snyk issue ID (e.g., SNYK-JS-XXX)
vulnerabilities[].severity	String	critical, high, medium, low
vulnerabilities[].from[]	Array	Dependency chain (useful for transitive)
vulnerabilities[].fixedIn[]	Array	Versions containing the fix
ok	Boolean	true if no vulnerabilities, false otherwise
dependencyCount	Number	Total dependency count

Processing Examples

JavaScript (Node.js):

const results = JSON.parse(output);

// Filter by severity
const critical = results.vulnerabilities.filter(v => v.severity === 'critical');

// Extract issue IDs
const ids = results.vulnerabilities.map(v => v.id);

// Check if passed
if (results.ok) {
  console.log('No vulnerabilities found');
} else {
  console.log(`${results.vulnerabilities.length} issues found`);
}

Python:

import json

results = json.loads(output)

# Filter by severity
critical = [v for v in results['vulnerabilities'] if v['severity'] == 'critical']

# Extract issue IDs
ids = [v['id'] for v in results['vulnerabilities']]

# Check if passed
if results['ok']:
    print('No vulnerabilities found')
else:
    print(f"{len(results['vulnerabilities'])} issues found")

Bash:

# Extract issue IDs
jq '.vulnerabilities[].id' results.json

# Filter by severity
jq '.vulnerabilities[] | select(.severity == "critical")' results.json

# Check result
if jq -e '.ok' results.json > /dev/null; then
  echo "Passed"
else
  echo "Failed"
fi

Snyk Code CLI

Scan application code for SAST vulnerabilities:

snyk code test --json > code.json

Output fields:

{
  "runs": [
    {
      "results": [
        {
          "ruleId": "javascript/SqlInjection",
          "level": "error",
          "message": {
            "text": "SQL injection detected"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "src/api.js"
                },
                "region": {
                  "startLine": 42
                }
              }
            }
          ]
        }
      ]
    }
  ]
}

Snyk Open Source CLI

Scan dependencies for known vulnerabilities:

snyk test --json > sca.json

Key fields:

• vulnerabilities[] — Known CVEs in dependencies
• from[] — Dependency chain (helps with transitive identification)
• fixedIn[] — Versions containing fix

Snyk IaC CLI

Scan Infrastructure-as-Code for misconfigurations:

snyk iac test . --json > iac.json

Output includes:

{
  "vulnerabilities": [
    {
      "id": "SNYK-CC-TF-19",
      "severity": "high",
      "title": "S3 bucket is public",
      "resource": "aws_s3_bucket.data",
      "file": "terraform/main.tf",
      "line": 42,
      "description": "..."
    }
  ]
}

Snyk Container CLI

Scan Docker images for vulnerabilities:

snyk container test myapp:1.0.0 --json > container.json

Output includes:

{
  "vulnerabilities": [
    {
      "id": "CVE-2024-12345",
      "severity": "critical",
      "packageName": "openssl",
      "from": ["myapp", "openssl"],
      "description": "..."
    }
  ],
  "baseImageRemediation": {
    "baseImage": "node:20-alpine",
    "recommendations": {
      "medium": "node:20-bookworm-slim",
      "minor": "node:21-alpine"
    }
  }
}

REST API v1

Authentication

-H "Authorization: token $SNYK_TOKEN"
-H "Content-Type: application/vnd.api+json"

List Organization Issues

Endpoint: GET https://api.snyk.io/rest/orgs/{orgId}/issues

Query Parameters:

• version — API version (required), e.g., 2024-01-23
• severity — Comma-separated: critical, high, medium, low
• status — open, resolved, ignored
• limit — Max results (default 100, max 1000)
• offset — For pagination

Request:

curl -H "Authorization: token $SNYK_TOKEN" \
  "https://api.snyk.io/rest/orgs/{orgId}/issues?version=2024-01-23&severity=critical,high&status=open&limit=100"

Response:

{
  "data": [
    {
      "id": "issue-12345",
      "type": "issue",
      "attributes": {
        "title": "SQL Injection",
        "severity": "critical",
        "status": "open",
        "coordinates": [
          {
            "remedies": [
              {
                "description": "Upgrade package to v1.2.3",
                "type": "recommended"
              }
            ]
          }
        ]
      }
    }
  ],
  "links": {
    "next": "https://api.snyk.io/rest/orgs/{orgId}/issues?version=2024-01-23&offset=100"
  }
}

Pagination

# Get all issues with pagination
offset=0
while true; do
  curl -H "Authorization: token $SNYK_TOKEN" \
    "https://api.snyk.io/rest/orgs/{orgId}/issues?version=2024-01-23&limit=100&offset=$offset" \
    > page_$offset.json

  # Check if there are more results
  if ! jq -e '.links.next' page_$offset.json > /dev/null; then
    break
  fi

  offset=$((offset + 100))
done

Get Issue Details

Endpoint: GET https://api.snyk.io/rest/orgs/{orgId}/issues/{issueId}

curl -H "Authorization: token $SNYK_TOKEN" \
  "https://api.snyk.io/rest/orgs/{orgId}/issues/issue-12345?version=2024-01-23"

List Projects

Endpoint: GET https://api.snyk.io/rest/orgs/{orgId}/projects

Usage: Map repositories to Snyk project IDs

curl -H "Authorization: token $SNYK_TOKEN" \
  "https://api.snyk.io/rest/orgs/{orgId}/projects?version=2024-01-23&limit=100"

Response:

{
  "data": [
    {
      "id": "project-12345",
      "attributes": {
        "name": "my-app",
        "origin": "github",
        "type": "sca"
      }
    }
  ]
}

Common Workflows

Find All Critical Issues Across Organization

#!/bin/bash
SNYK_TOKEN="..."
ORG_ID="..."

curl -s -H "Authorization: token $SNYK_TOKEN" \
  "https://api.snyk.io/rest/orgs/$ORG_ID/issues?version=2024-01-23&severity=critical&status=open" \
  | jq -r '.data[] | "\(.id) | \(.attributes.title) | \(.attributes.severity)"'

Scan and Report

#!/bin/bash

# Run all scanners
snyk code test --json > code.json
snyk test --json > sca.json
snyk iac test . --json > iac.json
snyk container test myimage --json > container.json

# Parse results
echo "=== Code Vulnerabilities ==="
jq '.vulnerabilities[] | select(.severity == "critical")' code.json

echo "=== Dependency Vulnerabilities ==="
jq '.vulnerabilities[] | select(.severity == "critical")' sca.json

echo "=== IaC Misconfigurations ==="
jq '.vulnerabilities[] | select(.severity == "high")' iac.json

echo "=== Container Vulnerabilities ==="
jq '.vulnerabilities[] | select(.severity == "critical")' container.json

Automated Remediation Workflow

#!/bin/bash

# Get issues in JSON
snyk test --json > issues.json

# Extract critical issues
CRITICAL=$(jq '[.vulnerabilities[] | select(.severity == "critical")] | length' issues.json)

if [ $CRITICAL -gt 0 ]; then
  echo "Found $CRITICAL critical issues"

  # Attempt auto-fix
  snyk fix --json > fix_result.json

  # Re-test
  snyk test --json > retry.json
  REMAINING=$(jq '[.vulnerabilities[]] | length' retry.json)

  if [ $REMAINING -eq 0 ]; then
    echo "All issues fixed!"
    git add .
    git commit -m "fix: snyk security remediation"
  else
    echo "$REMAINING issues remain after auto-fix"
  fi
else
  echo "No critical issues found"
fi

Error Handling

HTTP Status	Error	Resolution
200	Success	Parse response
401	Unauthorized	Verify $SNYK_TOKEN is valid
403	Forbidden	Token lacks required scopes
404	Not Found	Organization or issue not found
429	Rate Limited	Implement backoff with Retry-After header
500	Server Error	Retry after delay (e.g., 5s, 10s, 20s)

Rate Limiting

Snyk API applies rate limiting. Handle with exponential backoff:

#!/bin/bash

function call_snyk_api() {
  local url="$1"
  local retry_count=0
  local max_retries=5

  while [ $retry_count -lt $max_retries ]; do
    response=$(curl -s -w "\n%{http_code}" -H "Authorization: token $SNYK_TOKEN" "$url")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)

    if [ "$http_code" = "200" ]; then
      echo "$body"
      return 0
    elif [ "$http_code" = "429" ]; then
      wait_time=$((2 ** retry_count))
      echo "Rate limited, waiting ${wait_time}s..." >&2
      sleep $wait_time
      retry_count=$((retry_count + 1))
    else
      echo "Error: HTTP $http_code" >&2
      return 1
    fi
  done

  echo "Max retries exceeded" >&2
  return 1
}