> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cybedefend.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Analyze SCA vulnerabilities for autofix candidates

> Analyzes SCA vulnerabilities using DeepFix to find fix candidates. For transitive dependencies, determines which version of the direct dependency will resolve the vulnerable package to a safe version. Returns the dependency path showing the import chain and recommended fixes.



## OpenAPI

````yaml post /project/{projectId}/results/sca/autofix
openapi: 3.0.0
info:
  title: Cybedefend API
  description: >-
    CybeDefend is an advanced API for application security analysis. Key
    features include OAuth 2.0 authentication, user/organization/project
    management, and REBAC-based permissions. It excels in static, dynamic, and
    IaC security analyses (SAST, DAST, IaC, etc.).
  version: '1.0'
  contact: {}
servers:
  - url: https://api-eu.cybedefend.com
    description: EU
  - url: https://api-us.cybedefend.com
    description: US
security: []
tags: []
paths:
  /project/{projectId}/results/sca/autofix:
    post:
      tags:
        - Results & Vulnerabilities
      summary: Analyze SCA vulnerabilities for autofix candidates
      description: >-
        Analyzes SCA vulnerabilities using DeepFix to find fix candidates. For
        transitive dependencies, determines which version of the direct
        dependency will resolve the vulnerable package to a safe version.
        Returns the dependency path showing the import chain and recommended
        fixes.
      operationId: ResultController_startScaAutoFix
      parameters:
        - name: projectId
          required: true
          in: path
          description: Project identifier
          schema:
            format: uuid
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/StartScaAutoFixBodyDto'
      responses:
        '200':
          description: SCA AutoFix analysis completed successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StartScaAutoFixResponseDto'
        '400':
          description: Bad Request - Invalid vulnerability IDs or parameters
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorDto'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                example:
                  message: Unauthorized
                  statusCode: 401
                  timestamp: '2025-02-18T12:31:18.491Z'
                  path: /example/path
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                example:
                  message: Forbidden
                  statusCode: 403
                  timestamp: '2025-02-18T12:31:18.491Z'
                  path: /example/path
components:
  schemas:
    StartScaAutoFixBodyDto:
      type: object
      properties:
        vulnerabilityIds:
          description: Array of SCA vulnerability detection IDs to analyze
          example:
            - 550e8400-e29b-41d4-a716-446655440000
          type: array
          items:
            type: string
        updateLevel:
          type: string
          description: >-
            Maximum update level allowed: patch, minor, major, or auto
            (auto-escalates from patch to major)
          enum:
            - patch
            - minor
            - major
            - auto
          default: auto
          example: auto
        singleFix:
          type: boolean
          description: >-
            If true, stop at first valid fix found (faster). If false, find all
            possible fixes.
          default: false
          example: false
        createPr:
          type: boolean
          description: >-
            If true, create a Pull Request with the fixes. Requires project to
            be linked to GitHub/GitLab.
          default: false
          example: false
        targetBranch:
          type: string
          description: >-
            Target branch name for the PR. If not specified, uses the default
            branch.
          example: main
      required:
        - vulnerabilityIds
    StartScaAutoFixResponseDto:
      type: object
      properties:
        projectId:
          type: string
          description: Project ID
          example: 550e8400-e29b-41d4-a716-446655440000
        success:
          type: boolean
          description: True if at least one vulnerability has a fix
          example: true
        status:
          type: string
          description: 'Overall status: ok, partial, no_fix, or error'
          enum:
            - ok
            - partial
            - no_fix
            - error
          example: ok
        message:
          type: string
          description: Human-friendly summary
          example: Found fixes for 3 out of 5 vulnerabilities
        results:
          description: Results for each vulnerability
          type: array
          items:
            $ref: '#/components/schemas/ScaAutoFixAnalysisResultDto'
        totalVulnerabilities:
          type: number
          description: Total number of vulnerabilities analyzed
          example: 5
        fixableCount:
          type: number
          description: Number of vulnerabilities with fixes available
          example: 3
        unfixableCount:
          type: number
          description: Number of vulnerabilities without fixes
          example: 1
        errorCount:
          type: number
          description: Number of vulnerabilities that failed analysis
          example: 1
        jobId:
          type: string
          description: >-
            Job ID for polling status (only set when status is "queued" or
            "processing")
          example: sca-autofix-550e8400-e29b-41d4-a716-446655440000-0
      required:
        - projectId
        - success
        - status
        - message
        - results
        - totalVulnerabilities
        - fixableCount
        - unfixableCount
        - errorCount
    ErrorDto:
      type: object
      properties:
        timestamp:
          type: string
          example: '2025-02-18T12:31:18.491Z'
          description: Timestamp of the error
        service:
          type: string
          example: AiService
          description: Name of the service where the error occurred
        method:
          type: string
          example: startConversation
          description: Method name where the error occurred
        message:
          type: string
          example: Invalid parameters provided
          description: Error message
        code:
          type: number
          example: 400
          description: HTTP status code
          minimum: 100
          maximum: 599
      required:
        - timestamp
        - service
        - method
        - message
        - code
    ScaAutoFixAnalysisResultDto:
      type: object
      properties:
        vulnerabilityId:
          type: string
          description: Database ID of the SCA vulnerability detection
          example: 550e8400-e29b-41d4-a716-446655440000
        cveId:
          type: string
          description: CVE/GHSA ID
          example: CVE-2020-7598
        severity:
          type: string
          description: Severity level
          enum:
            - CRITICAL
            - HIGH
            - MEDIUM
            - LOW
            - INFO
          example: HIGH
        summary:
          type: string
          description: Vulnerability summary from OSV
          example: Prototype Pollution in minimist
        vulnerablePackage:
          type: string
          description: Package name that is vulnerable
          example: minimist
        vulnerableVersion:
          type: string
          description: Current vulnerable version
          example: 0.0.8
        dependencyPath:
          description: >-
            Path from root to vulnerable package (e.g., ["mkdirp@0.5.1",
            "minimist@0.0.8"])
          example:
            - mkdirp@0.5.1
            - minimist@0.0.8
          type: array
          items:
            type: string
        ecosystem:
          type: string
          description: 'Package ecosystem: npm, maven, pip, etc.'
          example: npm
        isTransitive:
          type: boolean
          description: Whether this is a transitive dependency
          example: true
        fileName:
          type: string
          description: Lockfile path (for monorepo support)
          example: package-lock.json
          nullable: true
        fixCandidates:
          description: All possible fixes found
          type: array
          items:
            $ref: '#/components/schemas/ScaFixCandidateDto'
        recommendedFix:
          description: 'Best fix (most conservative: patch > minor > major)'
          nullable: true
          allOf:
            - $ref: '#/components/schemas/ScaFixCandidateDto'
        hasFixAvailable:
          type: boolean
          description: Whether a fix was found
          example: true
        testedVersionsCount:
          type: number
          description: Number of versions tested
          example: 5
        status:
          type: string
          description: 'Analysis status: ok, no_fix, error, or direct_update'
          enum:
            - ok
            - no_fix
            - error
            - direct_update
          example: ok
        errorMessage:
          type: string
          description: Error message if status is "error"
          nullable: true
        installCommand:
          type: string
          description: Command to apply the fix (e.g., "npm install mkdirp@0.5.5")
          example: npm install mkdirp@0.5.5
          nullable: true
      required:
        - vulnerabilityId
        - cveId
        - severity
        - vulnerablePackage
        - vulnerableVersion
        - dependencyPath
        - ecosystem
        - isTransitive
        - fixCandidates
        - hasFixAvailable
        - testedVersionsCount
        - status
    ScaFixCandidateDto:
      type: object
      properties:
        parentPackage:
          type: string
          description: Parent package to update (the direct dependency)
          example: mkdirp
        currentVersion:
          type: string
          description: Current version of parent
          example: 0.5.1
        proposedVersion:
          type: string
          description: Recommended version to upgrade to
          example: 0.5.5
        vulnerableChild:
          type: string
          description: The transitive vulnerable package
          example: minimist
        vulnerableChildVersion:
          type: string
          description: Current vulnerable version
          example: 0.0.8
        fixedChildVersion:
          type: string
          description: Version of child after parent upgrade (null if removed from tree)
          example: 1.2.6
          nullable: true
        requiredChildVersion:
          type: string
          description: Minimum version required to fix
          example: 1.2.2
        updateType:
          type: string
          description: 'Type of update: patch, minor, or major'
          enum:
            - patch
            - minor
            - major
          example: patch
        isValid:
          type: boolean
          description: Whether this fix actually resolves the vulnerability
          example: true
      required:
        - parentPackage
        - currentVersion
        - proposedVersion
        - vulnerableChild
        - vulnerableChildVersion
        - requiredChildVersion
        - updateType
        - isValid

````