Mend API

Name: Mend API
Brand: Mend API
Availability: InStock

✓ Official Vendor SpecSecurityVulnerability Managementbearer125 EndpointsREST

For Agents

Automate Mend application security workflows - fetch findings, run scans, generate SBOM and compliance reports, and manage projects across the platform. JWT-authenticated per organisation.

Use for: List all open vulnerability findings for a specific application, Generate an SBOM for a container image scanned by Mend, Trigger a new scan for a project and wait for results, Get the AI dependency findings for an application

Not supported: Does not run runtime threat detection, manage WAF rules, or scan infrastructure-as-code outside Mend's scope - use for Mend platform vulnerability findings, scans, and reporting only.

The Mend API exposes Mend's application security platform - software composition analysis, AI dependency scanning, container image scanning, code findings, SBOM and attribution reports, and policy management - across 125 endpoints. Authentication uses a per-organisation JWT issued from a long-lived user key, with 10-minute token lifetime and cursor pagination on list endpoints. The API is designed to drive CI/CD enforcement, vulnerability triage workflows, and compliance reporting for organisations standardising on Mend's platform.

Jentic One on Github View OpenAPI Document

Install Jentic One Beta

Connect the Mend API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Mend API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fmend.io%2Fmend" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fmend.io%2Fmend" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Mend API.

Fetch open and resolved findings for an application across code, container images, and AI dependencies

Generate SBOM, attribution, and due-diligence reports from /applications/{applicationUuid}/images/reports

Trigger and monitor scans, then pull results into a CI gate or ticketing workflow

Manage projects, applications, and labels for portfolio organisation across teams

GET STARTED

Start building with Mend API

Explore with Jentic One

View OpenAPI Document

Use Cases

Patterns agents use Mend API for, with concrete tasks.

★ CI Pipeline Vulnerability Gating

Build pipelines call Mend after each scan to determine whether to fail the build. The /applications/{applicationUuid}/code/reports/findings endpoint returns current open findings filtered by severity, which lets a CI step block the merge when a new high-severity issue appears in a pull-request branch and produce a clear summary in the build log.

After a scan completes, call /applications/{applicationUuid}/code/reports/findings filtered by severity=critical,high, exit non-zero if the response contains any findings, and post a comment listing them on the pull request.

SBOM and Compliance Reporting

Compliance teams need recurring SBOMs and attribution reports for shipped applications. /applications/{applicationUuid}/images/reports/SBOM and /attribution generate the documents on demand, which a scheduled job can pull weekly and archive against the release ID for audit evidence without manual UI exports.

For each release tag, call /applications/{applicationUuid}/images/reports/SBOM, store the response in S3 keyed by release ID, and link it from the release ticket.

Vulnerability Triage Workflow

Security analysts triage findings into ticketing tools. The Mend API lets a triage worker enumerate new findings since the last poll, attach context - affected paths, fix versions, severity - and create a Jira ticket per finding with a deep link back to Mend, replacing manual export and reducing time to first response.

Poll /applications/{applicationUuid}/code/reports/findings every hour, diff against the last seen finding IDs, and POST a Jira issue for each new high-severity finding with the affected dependency and recommended upgrade.

AI Agent Security Posture Reviews

An AI agent can answer 'what's the security posture of application X' by chaining Mend report endpoints. Through Jentic, the agent loads the findings, SBOM, and resolved-findings operations as discoverable tools and produces a posture summary covering open critical findings, recent trend, and outstanding compliance obligations.

Search Jentic for 'list mend findings', execute /applications/{applicationUuid}/code/reports/findings and /resolved, then summarise open vs resolved critical counts in plain text for the security lead.

Key Endpoints

125 endpoints — the mend api exposes mend's application security platform - software composition analysis, ai dependency scanning, container image scanning, code findings, sbom and attribution reports, and policy management - across 125 endpoints.

METHOD

PATH

DESCRIPTION

POST

/api/v3.0/login

Exchange a user key for a 10-minute organisation JWT

GET

/api/v3.0/applications/{applicationUuid}/code/reports/findings

Get open code findings for an application

GET

/api/v3.0/applications/{applicationUuid}/code/reports/resolved

Get resolved code findings

GET

/api/v3.0/applications/{applicationUuid}/ai/reports/findings

Get AI dependency findings

GET

/api/v3.0/applications/{applicationUuid}/images/reports/SBOM

Generate an SBOM for scanned container images

GET

/api/v3.0/applications/{applicationUuid}/images/reports/attribution

Generate an attribution report

GET

/api/v3.0/applications/{applicationUuid}/images/reports/dueDiligence

Generate a due-diligence report

GET

/api/v3.0/applications/{applicationUuid}/code/reports/compliance

Generate a compliance report

POST

/api/v3.0/login

Exchange a user key for a 10-minute organisation JWT

GET

/api/v3.0/applications/{applicationUuid}/code/reports/findings

Get open code findings for an application

GET

/api/v3.0/applications/{applicationUuid}/code/reports/resolved

Get resolved code findings

GET

/api/v3.0/applications/{applicationUuid}/ai/reports/findings

Get AI dependency findings

GET

/api/v3.0/applications/{applicationUuid}/images/reports/SBOM

Generate an SBOM for scanned container images

GET

/api/v3.0/applications/{applicationUuid}/images/reports/attribution

Generate an attribution report

GET

/api/v3.0/applications/{applicationUuid}/images/reports/dueDiligence

Generate a due-diligence report

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Wiring Mend by hand means exchanging a user key for a short-lived organisation JWT via /login, refreshing it before it expires, and hand-coding each application report call. Through Jentic you install once, import the Mend API from the API Directory, store the user key once, and your agent calls it.

Permission scoping

Mend puts the application id in the URL path (/api/v3.0/applications/{applicationUuid}/...), so a rule can pin your agent to one application: it can read that application's findings, SBOM, and compliance reports and nothing else. You choose the operations it may call, so reports for other applications are included only if you add them.

Credential isolation

Your Mend user key is stored once, encrypted, by your own Jentic One instance, which performs the /login exchange and injects the resulting JWT at execution time. Neither secret enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'list Mend findings' or 'generate an SBOM', and Jentic returns the matching report endpoint with the application UUID parameter and filter schema so the agent calls the right endpoint without browsing the reference docs.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Alternative

Snyk

Direct competitor in software composition analysis and developer-first security

Choose Snyk when the user has Snyk credentials or needs Snyk's developer-IDE integrations; choose Mend when working in an organisation already standardised on the Mend platform.

Complementary

GitHub API

Source control system that Mend scans against

Use GitHub to read repository state and post checks/PR comments; use Mend to retrieve the findings that drive those checks.

Complementary

GitLab

Source control and CI host for pipelines that consume Mend results

Use GitLab when the CI pipeline lives there; use Mend to retrieve the scan findings that the pipeline gates on.

FAQs

Specific to using Mend API through Jentic.

What authentication does the Mend API use?

The API uses HTTP bearer authentication with JWTs issued by /api/v3.0/login. The login endpoint accepts a user key from your Mend Platform profile and returns a JWT scoped to one organisation that expires after 10 minutes. Through Jentic, the user key is held in the encrypted vault and the token-refresh round trip is handled at execution time.

Can I generate an SBOM for a scanned container image with the Mend API?

Yes. /api/v3.0/applications/{applicationUuid}/images/reports/SBOM generates an SBOM for the application's scanned container images, and adjacent endpoints produce attribution and due-diligence reports against the same scan data.

What are the rate limits for the Mend API?

The OpenAPI spec does not declare numeric rate limits but enforces a 10-minute JWT lifetime per organisation, which means long-running jobs must refresh tokens. Cursor pagination is supported on list endpoints to control page size on heavy result sets.

How do I fetch open vulnerability findings through Jentic?

Run `pip install jentic`, search for `list mend findings`, load /api/v3.0/applications/{applicationUuid}/code/reports/findings, and execute with the application UUID. Jentic handles the login round trip and JWT injection automatically.

Does the Mend API cover AI dependency scanning?

Yes. /api/v3.0/applications/{applicationUuid}/ai/reports/findings and /api/v3.0/applications/{applicationUuid}/ai/reports/inventory expose Mend's AI bill-of-materials and findings, which surface risks introduced by ML libraries and model dependencies in scanned applications.

Can I limit what my agent is allowed to do with the Mend API?

Yes. Because Jentic One is self-hosted, your own rules decide which operations and credentials the agent may use. Since Mend puts the application id in the URL path (/api/v3.0/applications/{applicationUuid}/...), you can pin the agent to a single application so it reads only that application's findings, SBOM, attribution, and compliance reports. You also choose which operations it may call, so it can trigger scans or read AI dependency findings only if you add those, and reports for other applications stay out of reach.