Semgrep
API integration

list_all_semgrep_agent_deployments

List all Semgrep agent deployments associated with the current authentication token. Returns: id.

create_a_semgrep_agent_deployment

Create a new Semgrep agent deployment. Returns: id.

get_single_semgrep_agent_deployment_by_id

Get a single Semgrep agent deployment by id. Returns: id, name. Required: id.

update_a_semgrep_agent_deployment_by_id

Update a Semgrep agent deployment by id. Returns the updated deployment including its id, name, and slug. Required: id.

semgrep_agent_deployments_list_tags

List deployment tags for a Semgrep deployment by deployment id. Returns: tags. Required: deployment_id.

semgrep_agent_deployments_list_notification_rules

List notification rules for a Semgrep deployment. Returns a collection of notification rule objects, each including its id. Required: deployment_id.

create_a_semgrep_deployment_action

Create a notification rule for a Semgrep deployment. Returns the notification rule object with schema-defined fields. Required: deployment_id.

update_a_semgrep_deployment_action_by_id

Replace a notification rule for a Semgrep deployment. Returns the notification rule object with schema-defined fields. Required: deployment_id, id.

delete_a_semgrep_deployment_action_by_id

Delete a notification rule from a Semgrep deployment. Returns a DeleteNotificationRuleResponse confirming the deletion. Required: deployment_id, id.

create_a_semgrep_action_test

Test a notification rule in Semgrep by triggering a test action for the specified deployment and notification rule. Returns the test notification rule response from Semgrep. Required: deployment_id, notification_rule_id.

list_all_semgrep_deployment_authorized_actions

List authorized actions for a Semgrep deployment. Returns: actions (the list of action identifiers the user is authorized to take on the deployment). Required: deployment_id.

list_all_semgrep_deployment_default_user_roles

Get the default user role for a Semgrep deployment. Returns the default user role configuration assigned to new users in the deployment. Required: deployment_id.

list_all_semgrep_deployment_findings

List code, supply chain, or AI-powered scan findings for a Semgrep deployment, ordered by relevant_since descending. Returns: id, assistant, categories, click_to_fix_failures, click_to_fix_prs, confidence, created_at, external_ticket, first_seen_scan_id, line_of_code_url, location, match_based_id, ref, relevant_since, repository, review_comments, rule, rule_message, rule_name, severity,…. Required: deployment_slug.

semgrep_deployment_findings_bulk_update

Bulk triage Semgrep issues that match specified filters within a deployment, applying triage updates to matching findings in a single operation. Returns the bulk update findings response. Required: deployment_id.

list_all_semgrep_deployment_github_app_status

Check if the Semgrep GitHub app is installed for a deployment in Semgrep. Returns: installed. Required: deployment_id.

create_a_semgrep_deployment_has_deepsemgrep

Update the DeepSemgrep setting for a Semgrep deployment by deployment id. Returns a JSON response object confirming the update. Required: deployment_id.

create_a_semgrep_deployment_has_dependency_query

Update the has_dependency_query setting for a Semgrep deployment. Returns an OK response confirming the updated deployment has_dependency_query state. Required: deployment_id.

create_a_semgrep_deployment_has_triage_via_comment

Update the "has triage via comment" setting for a specific Semgrep deployment. Returns the update response confirming the deployment's triage-via-comment configuration. Required: deployment_id.

list_all_semgrep_deployment_ignores

List deployment product ignores for a Semgrep deployment. Returns the deployment product ignore configuration via the attributes field, with the exact field structure defined by the upstream protobuf schema. Required: deployment_id.

create_a_semgrep_deployment_ignore

Create deployment product ignores for a Semgrep deployment by submitting a JSON request body. Returns the created configuration via the attributes field, with the exact field structure defined by the upstream protobuf schema. Required: deployment_id.

semgrep_deployment_ignores_bulk_update

Update deployment product ignores for a Semgrep deployment by submitting a JSON request body. Returns the updated configuration via the attributes field, with the exact field structure defined by the upstream protobuf schema. Required: deployment_id.

semgrep_deployment_ignores_bulk_delete

Delete deployment product ignores for a Semgrep deployment, optionally filtered by product type. Returns the deletion result via the attributes field, with the exact field structure defined by the upstream protobuf schema. Required: deployment_id.

semgrep_deployment_issues_search

Search and group Semgrep deployment issues by rule with filtering and pagination. Returns: issue_groups. Required: deployment_id.

get_single_semgrep_deployment_issue_by_id

Get a single Semgrep deployment issue by id with full details. Returns: id, state, status, severity, confidence, rule_name, rule_message, rule, repository, location, line_of_code_url, categories, created_at, relevant_since, state_updated_at, triaged_at, triage_state, triage_reason, triage_comment, syntactic_id, match_based_id, ref, first_seen_scan_id, is_archived, sourcing_policy,…

create_a_semgrep_issues_export

Asynchronously export Semgrep issues matching filters to a file for a deployment. Accepts a ListIssuesRequest filter body and returns a 202 Accepted acknowledgment confirming the export job has been queued. Required: deployment_id. The export runs asynchronously; poll for completion separately.

list_all_semgrep_issue_code_snippets

List code snippets for a Semgrep issue within a deployment. Returns: code_snippets. Required: deployment_id, issue_id.

create_a_semgrep_issue_fix_job

Create an automated SAST fix job for a given issue in Semgrep, triggering an AI-powered workflow that analyzes the vulnerability, generates a fix, and opens a pull request in the repository. Returns the created fix job response. Required: deployment_id, issue_id. This feature is currently in Public Beta.

list_all_semgrep_deployment_managed_scan_settings

List managed scan settings for a Semgrep deployment. Returns the managed scan settings response object including id and attributes containing deployment-specific scan configuration fields. Required: deployment_id.

create_a_semgrep_deployment_managed_scan_setting

Create managed scan settings for a Semgrep deployment. Returns the created managed scan settings object including its managed_scan_settings_id. Required: deployment_id.

update_a_semgrep_deployment_managed_scan_setting_by_id

Update a Semgrep managed scan settings record for a specific deployment. Returns: id. Required: deployment_id, id. A JSON request body is required but its fields are defined in the upstream proto schema (UpdateManagedScanSettingsRequest) and are not enumerable from the discovered documentation.

delete_a_semgrep_deployment_managed_scan_setting_by_id

Delete a Semgrep managed scan settings record from a specific deployment. Returns: id. Required: deployment_id, id.

list_all_semgrep_deployment_packagemanagerauthconfigs

List all package manager authentication configurations for a Semgrep deployment. Returns: id. Required: deployment_id.

create_a_semgrep_deployment_packagemanagerauthconfig

Create a new package manager authentication configuration for a Semgrep deployment. Returns: id. Required: deployment_id.

update_a_semgrep_deployment_packagemanagerauthconfig_by_id

Update an existing package manager authentication configuration in Semgrep. Returns: id. Required: deployment_id, id.

delete_a_semgrep_deployment_packagemanagerauthconfig_by_id

Delete a package manager authentication configuration from a Semgrep deployment. Returns: id. Required: deployment_id, id.

list_all_semgrep_deployment_products

Get the product configuration for a Semgrep deployment. Returns the deployment product config object including id and attributes. Required: deployment_id.

semgrep_deployment_products_bulk_update

Create or update the product configuration for a Semgrep deployment. Returns the updated deployment product config object including id and attributes. Required: deployment_id.

list_all_semgrep_products_admins

Get the admin product configuration for a Semgrep deployment. Returns the admin product configuration object with schema-specific fields. Required: deployment_id.

create_a_semgrep_products_feedback

Send deployment product toggle feedback to Semgrep for a specific deployment. Returns a SendDeploymentToggleFeedbackResponse acknowledgement object. Required: deployment_id.

list_all_semgrep_project_resolution_configs

List custom SCA dependency resolution configurations for a Semgrep deployment and project. Returns the resolution configs response object with content-type-specific fields. Required: deployment_id, project_id.

update_a_semgrep_deployment_repo_by_id

Bulk edit multiple Semgrep projects (repos) within a deployment, applying changes to all specified projects at once. Returns the bulk edit response confirming the applied changes. Required: deployment_id, id.

semgrep_deployment_repos_bulk_update

Bulk edit multiple projects (repos) in a Semgrep deployment by applying changes to all specified projects at once. Returns the bulk edit response confirming the applied changes. Required: deployment_id.

create_a_semgrep_repos_provision

Provision Semgrep CI GitHub Actions across repos in a Semgrep deployment by adding a "semgrep-ci" GitHub Action to GitHub Repositories associated with Semgrep Projects matching the filters provided in the request body. Returns a BulkProvisionReposResponse object with the results of the bulk provisioning operation. Required: deployment_id.

create_a_semgrep_repos_refresh_async

Schedule an async job in Semgrep to sync all projects in a deployment to their source control manager. Returns a 202 Accepted response confirming the refresh job has been queued. Required: deployment_id.

create_a_semgrep_repos_secret

Add Semgrep CI secrets to GitHub repositories in a deployment. Generates and adds a secret for the "semgrep-ci" GitHub Action to the GitHub repositories associated with any Semgrep Projects that match the given filters in the request body. Returns a BulkAddRepoSecretResponse object with the result of the bulk secret-addition operation. Required: deployment_id.

list_all_semgrep_repos_by_tags

List all project IDs grouped by tag for a Semgrep deployment. Returns: repos_by_tag, a mapping from tag ID to related project IDs. Required: deployment_id.

semgrep_repos_filtereds_bulk_update

Bulk apply a project update to many Semgrep projects in a deployment that match the given filters. Returns the bulk apply repo update response (protos.projects.v1.BulkApplyRepoUpdateResponse). Required: deployment_id.

create_a_semgrep_repo_sync

Schedule a job to sync a Semgrep project repository with its source control manager. Returns a 202 Accepted response confirming the sync has been scheduled. Required: deployment_id, repo_id.

list_all_semgrep_deployment_ruleboards

List ruleboards for a Semgrep deployment, optionally filtered by type. Returns: type. Required: deployment_id.

create_a_semgrep_deployment_ruleboard

Create a new ruleboard for a Semgrep deployment. Returns: type. Required: deployment_id.

update_a_semgrep_deployment_ruleboard_by_id

Update a Semgrep ruleboard within a deployment. Returns the updated ruleboard object including its slug and type. Required: deployment_id, id.

delete_a_semgrep_deployment_ruleboard_by_id

Delete a Semgrep ruleboard for a deployment by id. Returns an empty 204 response on success. Required: deployment_id, id.

get_single_semgrep_deployment_ruleboard_by_id

Get a single Semgrep ruleboard for a deployment by id. Returns: slug, type. Required: deployment_id, id.

list_all_semgrep_ruleboard_finding_counts

Get Semgrep ruleboard finding counts for a specific deployment and ruleboard. Returns finding count data for the specified ruleboard, optionally filtered by time range. Required: deployment_id, ruleboard_slug.

list_all_semgrep_ruleboard_overviews

Get the overview of a Semgrep ruleboard within a deployment. Returns the ruleboard overview object with fields defined in the upstream Semgrep API schema. Required: deployment_id, ruleboard_slug.

semgrep_ruleboard_overviews_bulk_update

Update the overview of a Semgrep ruleboard within a deployment. Returns the updated ruleboard overview object with fields defined in the upstream Semgrep API schema. Required: deployment_id, ruleboard_slug.

list_all_semgrep_slack_channel_mappings

List Slack channel mappings for a Semgrep deployment. Returns the response object with fields defined by the upstream GetSlackChannelMappingsResponse protobuf schema. Required: deployment_id.

list_all_semgrep_slack_channels

List Slack notification mappings for a Semgrep deployment. Returns notification mapping records including id and attributes with channel and notification mapping details. Required: deployment_id.

list_all_semgrep_slack_installs

Get the Slack app installation OAuth URL for a Semgrep deployment, generating the URL that initiates the Slack app installation flow. Returns: attributes (the InstallSlackAppResponse containing the installation OAuth URL). Required: deployment_id.

list_all_semgrep_slack_installations

Get Slack app installation details for a Semgrep deployment. Returns the Slack installation response object whose shape is defined by the upstream GetSlackInstallationResponse schema. Required: deployment_id.

semgrep_slack_installations_bulk_delete

Delete the Slack app installation for a Semgrep deployment and revoke its access token. Returns the deletion response object whose shape is defined by the upstream DeleteSlackInstallationResponse schema. Required: deployment_id.

create_a_semgrep_oauth_callback

Handle a Slack OAuth callback for a Semgrep agent deployment, processing the callback to exchange the authorization code for an access token and store the Slack installation data. Returns the callback processing response. Required: deployment_id.

create_a_semgrep_tags_find

Find deployment tags with their associated project counts in Semgrep. Returns the matching tags along with project count information. Required: deployment_id.

update_a_semgrep_deployment_tag_by_id

Create or update a deployment tag in Semgrep. Returns the updated deployment tag object. Required: deployment_id, id (repository tag).

delete_a_semgrep_deployment_tag_by_id

Delete a deployment tag in Semgrep by deployment id and tag identifier. Returns an empty 204 response on success. Required: deployment_id, id.

get_single_semgrep_deployment_tag_by_id

Get a single deployment tag in Semgrep by deployment and repository tag identifier. Returns the deployment tag object including its id and attributes. Required: deployment_id, id.

list_all_semgrep_deployment_users

List users for a Semgrep deployment, optionally filtering by GitHub pruning or active status. Returns: id. Required: deployment_id.

create_a_semgrep_deployment_user

Add a user to a Semgrep deployment by providing user details in the request body. Returns: id. Required: deployment_id.

delete_a_semgrep_deployment_user_by_id

Remove a user from a Semgrep deployment. Returns: id. Required: deployment_id, id.

semgrep_user_roles_bulk_update

Update the roles assigned to a specific user within a Semgrep deployment. Returns the patched deployment user response. Required: deployment_id, user_id.

list_all_semgrep_agent_features

List all available feature rollouts in Semgrep. Returns: available_feature_rollouts. No required parameters.

list_all_semgrep_agent_identities

Get the agent's bearer identity in Semgrep. Returns: identity. No request parameters required.

list_all_semgrep_agent_ips

Get the current IP address in Semgrep. Returns: ip_address.

list_all_semgrep_agent_pings

Ping the Semgrep agent server to assert liveness. Returns: pong. No required parameters.

list_all_semgrep_agent_tenants

Get the current tenant name for the Semgrep server (e.g. "default"). Returns: tenant_name.

list_all_semgrep_version_project_infos

Get Semgrep version information for recent scans for a specific deployment and product in Semgrep. Returns: data (version info object whose exact fields depend on the upstream GetProjectVersionInfoResponse proto schema). Required: deployment_id, product.

create_a_semgrep_deployment_autotriage_feedback

Post autotriage feedback for a Semgrep AI deployment. Returns a PostAutotriageFeedbackResponse object; the upstream schema fields are not documented in the available source. Required: deployment_id and a JSON request body.

create_a_semgrep_deployment_memory

Create a new AI memory in a Semgrep deployment. Returns the created memory object. Required: deployment_id.

update_a_semgrep_deployment_memory_by_id

Update an existing AI memory in a Semgrep deployment by replacement. Returns the updated memory object. Required: deployment_id, id.

delete_a_semgrep_deployment_memory_by_id

Delete a Semgrep AI deployment memory by its ID. Returns an empty 204 response on success. Required: deployment_id, id.

list_all_semgrep_memories_stats

Get statistics about a Semgrep deployment's memories performance. Returns a memory performance statistics object whose fields are defined by the upstream GetMemoriesStatsResponse schema. Required: deployment_id.

list_all_semgrep_memories_suggesteds

List all suggested memories for a Semgrep AI deployment. Returns: id, created_at, updated_at. Required: deployment_id.

create_a_semgrep_memories_triage

Create a new Semgrep AI memory from a triage event for a deployment. Returns the created memory object as a CreateMemoryFromTriageResponse. Required: deployment_id, and a JSON request body describing the triage event.

create_a_semgrep_deployment_relevant_issue

Find relevant issues for a given rule and repository in a Semgrep deployment. Returns the matching relevant issues response object defined by the upstream FindRelevantIssuesResponse schema. Required: deployment_id. A JSON request body is also required.

create_a_semgrep_ai_pattern_fix

Create an AI pattern fix task in Semgrep for a given pattern and language, used in the editor's structure mode. Returns a task token for polling completion via the Tasks Service. Required: pattern, language.

create_a_semgrep_combined_task

Create a combined task for a deployment in Semgrep. Returns the created combined task object with schema-specific fields defined in the upstream protobuf definition. Required: deployment_id.

list_all_semgrep_info

Get task info for a Semgrep deployment. Returns the task info response object for the specified deployment. Required: deployment_id.

list_all_semgrep_auth_authorized_resources

List all organizations and deployments available to the authenticated user in Semgrep. Returns authorized resource records, each with an id and an attributes object containing organization/deployment-specific fields from the upstream protobuf schema.

list_all_semgrep_deployment_providers

List all SSO providers configured for a Semgrep deployment. Returns: sso_providers (array of SSO provider objects, each with an id). Required: deployment_id.

list_all_semgrep_auth_users

Get the current Semgrep user's basic information including role, email, and auth details. Returns: id, email, role. If userId is supplied it must equal the requester's own ID.

list_all_semgrep_users_deployments

List all Semgrep organizations/deployments that the current user is a member of. Returns: id, name, slug, findings. As of June 2025, the userId query parameter must equal the requester's ID.

list_all_semgrep_deployments_joinables

List all Semgrep organizations/deployments that the current user can join. Returns: id, name, slug, findings. If provided, userId must equal the requester's ID.

list_all_semgrep_users_settings

Get basic settings and onboarding info for the current Semgrep user. Returns the user settings object with schema-specific fields including contact preferences and product tour state.

semgrep_users_settings_bulk_update

Update user settings and preferences for the current Semgrep user. Returns the updated user settings object; exact fields are defined by the upstream PatchUserSettingsResponse schema.

list_all_semgrep_deployment_scm_comment_product_contents

List all review comment product contents for a Semgrep deployment. Returns: id. Required: deployment_id.

create_a_semgrep_deployment_scm_comment_product_content

Create a new review comment product content in a Semgrep deployment. Returns: id. Required: deployment_id.

update_a_semgrep_deployment_scm_comment_product_content_by_id

Update an existing review comment product content in a Semgrep deployment. Returns: id. Required: deployment_id, id.

delete_a_semgrep_deployment_scm_comment_product_content_by_id

Delete a review comment product content by its ID in a Semgrep deployment. Returns: id. Required: deployment_id, id.

list_all_semgrep_health_checks

Check if the Semgrep container is healthy. Returns: status. No required parameters.

list_all_semgrep_infra_config_bootstrap_sms_vpcs

Get the Semgrep Managed Scans (SMS) VPC Bootstrap CloudFormation template in JSON format for cross-account infrastructure setup. Returns the CloudFormation template object with content-type-specific fields following the AWS CloudFormation template format. The template creates IAM roles and policies for SMS VPC automation, including the semgrep-sms-vpc-automation role and EC2 Image Builder…

list_all_semgrep_notification_webhooks_deployments

List all notification webhooks for a Semgrep deployment. Returns: webhooks (array of webhook objects). Required: deployment_id.

create_a_semgrep_webhook_test

Send a test payload to a Semgrep notification webhook endpoint to verify it is configured and delivering correctly. Returns the test webhook delivery result. Required: deployment_id, webhook_id.

list_all_semgrep_deployment_automations

List all automations for a Semgrep deployment. Returns: id. Required: deployment_id.

create_a_semgrep_deployment_automation

Create a new automation for a Semgrep deployment. Returns: id. Required: deployment_id.

update_a_semgrep_deployment_automation_by_id

Update an existing automation in a Semgrep deployment. Returns: id. Required: deployment_id, id.

delete_a_semgrep_deployment_automation_by_id

Delete an automation from a Semgrep deployment by id. Returns: id. Required: deployment_id, id.

semgrep_deployment_automations_list_v_1

List all automations for a Semgrep deployment via the v1 notifications endpoint. Returns: id, attributes. Required: deployment_id.

list_all_semgrep_deployment_ticketings

List external ticketing instances (e.g. Jira) linked to a Semgrep deployment. Returns ticketing instance records with their id. Required: deployment_id.

create_a_semgrep_tickets_link

Link an existing external ticket to Semgrep findings by providing the ticket URL and finding IDs. If a finding is already linked, the existing link is replaced. Returns: id, url. Required: deployment_id, ticketing_instance_id, ticket_url, finding_ids.

semgrep_tickets_links_create_v_1

Link an existing external ticket (e.g. Jira) to one or more Semgrep findings. Does not create a ticket — it only records the association in Semgrep, replacing any prior link on a finding. Returns the linked ticket object including id, url, and linked_issue_ids. Required: deployment_id, issue_ids, ticket_url.

create_a_semgrep_tickets_unlink

Unlink a ticket from one or more Semgrep findings within a deployment and ticketing instance by providing a list of finding IDs. This only removes the association in Semgrep, not the ticket in your issue tracker. Returns: attributes. Required: deployment_id, ticketing_instance_id, finding_ids.

semgrep_tickets_unlinks_create_v_1

Unlink a ticket from one or more Semgrep findings within a deployment by providing a list of finding IDs (v1 API). This only removes the association in Semgrep, not the ticket in your issue tracker. Returns: unlinked_issue_ids. Required: deployment_id, issue_ids.

delete_a_semgrep_ticket_by_id

Delete an external ticket in Semgrep and unlink it from associated Semgrep findings. Returns: id. Required: deployment_id, ticketing_instance_id, id.

list_all_semgrep_deployment_wizes

List Wiz notification credentials configured for a Semgrep deployment. Returns: id. Required: deployment_id.

create_a_semgrep_deployment_wize

Create a Wiz notification credential for a Semgrep deployment. Returns: id. Required: deployment_id.

get_single_semgrep_deployment_wize_by_id

Get a single Wiz notification credential in Semgrep by id. Returns: id. Required: deployment_id, id.

update_a_semgrep_deployment_wize_by_id

Update a Wiz notification credential in Semgrep by id. Returns: id. Required: deployment_id, id.

delete_a_semgrep_deployment_wize_by_id

Delete a Wiz notification credential in Semgrep by id. Returns: id. Required: deployment_id, id.

create_a_semgrep_wiz_validate

Validate a Wiz integration credential for a Semgrep deployment. Returns a ValidateWizCredentialResponse object with schema-specific fields defined in the upstream protobuf. Required: deployment_id.

get_single_semgrep_in_app_deployment_by_id

List unread in-app notifications for a Semgrep deployment by id. Returns a paginated list of notification objects, each including its id. Required: id (deploymentId).

semgrep_deployment_mark_as_seens_bulk_update

Mark a list of in-app notifications as seen for a Semgrep deployment in Semgrep. Accepts a MarkNotificationsAsSeenRequest JSON body identifying the notifications to mark, and returns a MarkNotificationsAsSeenResponse confirmation object. Required: deployment_id.

list_all_semgrep_deployment_checklists

Get the onboarding checklist status for a Semgrep deployment. Returns the checklist status response object whose fields are defined in the upstream Semgrep onboarding protobuf schema. Required: deployment_id.

semgrep_deployment_checklists_bulk_update

Update the onboarding checklist for a Semgrep deployment by submitting a patch request body. Returns the updated checklist response object whose fields are defined in the upstream Semgrep onboarding protobuf schema. Required: deployment_id.

create_a_semgrep_deployment_invite_member

Invite members to a Semgrep deployment during onboarding by sending an InviteMembersRequest body. Returns an InviteMembersResponse object confirming the invitations. Required: deployment_id.

list_all_semgrep_deployment_status

Check whether a Semgrep deployment has Role-Based Access Control (RBAC) enabled. Returns: rbac_enabled. Required: deployment_id.

create_a_semgrep_deployment_team

Create a new Role-Based Access Control team for a Semgrep deployment. Returns the created team including its id and name. Required: deployment_id, name.

update_a_semgrep_deployment_team_by_id

Update a Semgrep deployment RBAC team's name, users, and repositories. Returns the updated team including its id and name. Required: deployment_id, id.

delete_a_semgrep_deployment_team_by_id

Delete a Semgrep deployment's Role-Based Access Control team. Returns the deleted team including its id and name. Required: deployment_id, id.

semgrep_deployment_teams_list_members

List the users assigned to a Semgrep Role-Based Access Control team. Returns each user record with id and additional attributes defined by the upstream schema. Required: deployment_id, team_id.

get_single_semgrep_deployment_team_by_id

Get a single Semgrep deployment RBAC team by id. Returns the team record with id and additional attributes defined by the upstream schema. Required: deployment_id, id.

list_all_semgrep_team_repos

List the repositories assigned to a Semgrep Role-Based Access Control team. Returns: repos. Required: deployment_id, team_id.

list_all_semgrep_teams

List the child teams assigned to a Role-Based Access Control team in Semgrep. Returns: id, name. Required: deployment_id, team_id.

get_single_semgrep_policies_deployment_by_id

List all policies for a given Semgrep deployment. Returns: a policies array where each policy includes id, name, and slug. Required: id (the numerical deployment identifier).

list_all_semgrep_rules

List the rules for a given Semgrep policy. Returns: rule_path, attributes. Required: deployment_id, policy_id. Default page size is 500; maximum is 2000.

update_a_semgrep_rule_by_id

Update a specific rule within a Semgrep policy. Returns: rule_path, attributes. Required: deployment_id, policy_id, id.

list_all_semgrep_deployment_detection_policies

Get the detection policy summary for a Semgrep deployment. Returns: state_version, bundle. Required: deployment_id.

get_single_semgrep_deployment_detection_policy_by_id

Get a Semgrep detection policy for one product in a deployment. Returns the detection policy bundle including its exceptions, plus the state_version required to apply changes. Required: deployment_id, product.

semgrep_deployment_detection_policies_dry_run

Preview a Semgrep detection policy apply by validating a candidate bundle and returning the diff a strict apply would produce, without changing anything. Returns: state_version, diff. Required: deployment_id, product, bundle.

semgrep_deployment_detection_policies_bulk_update

Apply a detection policy bundle for one product in a Semgrep deployment. The submitted bundle replaces the current state and exceptions absent from it are deleted. Returns: state_version, bundle. Required: deployment_id, product. Requires the current state_version via the If-Match header; returns 428 if missing or 409 if stale.

list_all_semgrep_deployment_remediation_policies

Get remediation policies for a Semgrep deployment. Returns the remediation policies bundle and the state_version required to apply changes; system-managed policies are excluded. Required: deployment_id.

semgrep_deployment_remediation_policies_dry_run

Preview a remediation policies apply for a Semgrep deployment without changing anything. Validates a candidate bundle and returns the diff a strict apply would produce, plus the state_version to send as If-Match on the follow-up PUT. Returns: state_version, diff. Required: deployment_id.

semgrep_deployment_remediation_policies_bulk_update

Apply remediation policies for a Semgrep deployment. The submitted list strictly replaces the current state; policies absent from it are deleted. Requires the current state_version via the If-Match header. Returns: remediation_policies, state_version. Required: deployment_id.

list_all_semgrep_deployment_vocabs

Get the Semgrep policy vocabulary for a deployment, returning condition_types, action_types, value_enums, and detection_bundle_constraints for client-side policy bundle validation. Required: deployment_id.

list_all_semgrep_readiness_checks

Check whether the Semgrep container started up correctly using the readiness probe endpoint. Returns: attributes.

create_a_semgrep_run

Execute a Semgrep pattern against target code and return the match results in Semgrep. Returns the pattern match results as defined by the RunPatternResponse schema. Requires a JSON request body conforming to the RunPatternRequest schema with the pattern and target code to scan.

list_all_semgrep_deployment_dependencies

List all SCA dependencies for a Semgrep deployment with optional filtering by name, version, ecosystem, transitivity, license, lockfile path, and repository. Returns paginated dependency records including name, version, ecosystem, and transitivity. Required: deployment_id.

create_a_semgrep_deployment_dependency

List all or filtered dependencies for a Semgrep SCA deployment using a POST request body with pagination. Returns a paginated list of dependencies for the deployment. Required: deployment_id.

create_a_semgrep_deployment_sbom_async

Start an asynchronous job to generate a Software Bill of Materials (SBOM) for a Semgrep deployment. Returns: task_token_jwt. Required: deployment_id. The endpoint does not return the SBOM itself; use the task JWT with the Tasks Service to poll for job status and results.

create_a_semgrep_scm_ado_app

Create an Azure DevOps SCM App in Semgrep using Entra ID Service Principal credentials. Returns the created app response with proto-schema-specific fields including a generated public certificate for upload to the customer's Entra app registration. CompleteAdoScmAppInstall must be called separately to finish the install. A request body with Service Principal credentials is required.

semgrep_scm_ado_app_installs_bulk_update

Complete an Azure DevOps SCM App install in Semgrep. After the certificate is uploaded, verifies the Service Principal can authenticate to ADO, creates webhook subscriptions required for the integration, and marks the install as ready. Returns the completion response object.

create_a_semgrep_scm_app_request

Create a new SCM app request in Semgrep. Returns the created SCM app request response object. A JSON request body is required; the upstream schema is defined by protos.scm.v1.CreateScmAppRequestRequest.

semgrep_scm_app_request_completes_bulk_update

Complete an SCM app request in Semgrep by submitting the completion details. Returns a completion response object. Requires a JSON request body. The request and response schemas are referenced in the Semgrep v2 OpenAPI spec as protos.scm.v1.CompleteScmAppRequestRequest and protos.scm.v1.CompleteScmAppRequestResponse but their field-level structure is not documented in the available source.

list_all_semgrep_deployment_configs

List all SCM configs for a Semgrep deployment. Returns: id, name. Required: deployment_id.

create_a_semgrep_deployment_config

Create a new SCM config in a Semgrep deployment. Returns: id, name. Required: deployment_id.

semgrep_deployment_configs_search

Search for SCM configs in a Semgrep deployment. Returns: id, name. Required: deployment_id.

update_a_semgrep_deployment_config_by_id

Update an existing SCM config in a Semgrep deployment. Returns: id, name. Required: deployment_id, id.

delete_a_semgrep_deployment_config_by_id

Delete an SCM config by its ID in a Semgrep deployment. Returns an empty 204 response on success. Required: deployment_id, id.

create_a_semgrep_config_sync

Sync an SCM config in Semgrep by deployment and config id. Returns the SyncScmConfigResponse object with schema-specific fields defined in the Semgrep protobuf API. Required: deployment_id, config_id.

list_all_semgrep_config_checks

Check the status of an SCM config in Semgrep. Returns the check status response with fields defined by the protobuf schema protos.scm.v1.CheckScmConfigResponse. Required: deployment_id, config_id.

list_all_semgrep_deployment_scm_apps

List all SCM apps for a Semgrep deployment. Returns SCM app records with id and provider-specific attributes. Required: deployment_id.

delete_a_semgrep_deployment_scm_app_by_id

Delete an SCM app by its ID in Semgrep. Returns a 200 OK confirmation response. Required: deployment_id, id.

get_single_semgrep_deployment_scm_app_by_id

Get a single SCM app in Semgrep by id. Returns: id, attributes.scm.v1.ScmApp definition in the upstream OpenAPI specification). Required: deployment_id, id.

list_all_semgrep_scm_apps_public_ghas

Get the status of a public GitHub App for a Semgrep deployment. Returns the GitHub App status response object. Required: deployment_id.

create_a_semgrep_scm_app_add_ado_project

Add a new Azure DevOps project to an existing Entra App install in Semgrep. The service principal must already have permissions on the ADO project. Returns an AddAdoScmProjectResponse object confirming the addition. Required: deployment_id, scm_app_id.

create_a_semgrep_scm_app_rotate_webhook_secret

Rotate the webhook secret for an SCM app in Semgrep — generates a new secret, updates it on the SCM provider, and persists it. Returns the response object with proto-schema-specific fields. Required: deployment_id, scm_app_id.

list_all_semgrep_deployment_subscriptions

List all SCM webhook subscriptions for a Semgrep deployment. Returns: subscriptions (array of webhook subscription objects). Required: deployment_id, config_id.

update_a_semgrep_deployment_subscription_by_id

Subscribe to SCM webhook events in Semgrep for a specific deployment and SCM configuration. Returns the subscription confirmation response. Required: deployment_id, id.

delete_a_semgrep_deployment_subscription_by_id

Delete an SCM webhook subscription for a Semgrep deployment, unsubscribing it from webhook events. Returns an opaque 200 OK response whose fields are not enumerated in the available source. Required: deployment_id, id.

create_a_semgrep_subscription_rotate_secret

Rotate the webhook secret for an SCM webhook subscription in Semgrep. Generates a new secret, updates it on the SCM provider, and persists it. Returns: webhook_secret. Required: deployment_id, config_id.

list_all_semgrep_project_settings

Get a project's managed scan settings in Semgrep. Returns the settings object including id and attributes, or an empty result if the project does not have managed scanning set up. Required: deployment_id, project_id.

create_a_semgrep_support_case

Create a new support case in Semgrep by submitting a support case request. Returns the created support case response object. Requires a JSON request body with support case details.

list_all_semgrep_support_cases

List support cases for a Semgrep organization. Returns the support cases response object for the specified organization. Required: orgid.

list_all_semgrep_survey_names

Get a company survey response in Semgrep by survey name. Returns the survey response object with content-type-specific fields defined upstream in the GetSurveyResponseResponse proto schema. Required: survey_name.

create_a_semgrep_survey_submit

Submit a company survey response in Semgrep by providing a JSON request body with the survey answers. Returns a confirmation object from the survey service whose fields are defined by the upstream CreateSurveyResponseResponse proto schema. Required: a JSON request body.

list_all_semgrep_tasks

Get the status and result of a Semgrep async task or task group by its task token JWT. Returns: status, result (present when the task is completed). Required: task_token_jwt.

semgrep_deployment_tokens_bulk_delete

Delete all tokens matching the given filters in a Semgrep deployment. Only CLI and API tokens can be bulk-deleted. Returns an empty 204 response on success. Required: deployment_id, purpose. role_filter is required when purpose is TOKEN_PURPOSE_API and must not be set for TOKEN_PURPOSE_CLI.

create_a_semgrep_issue_autofix

Trigger an Autofix workflow for a Semgrep issue. The workflow runs asynchronously — it analyzes the issue, generates a fix, and opens a pull request in the underlying repository. Supports SAST, AI SAST, and SCA issue types resolved server-side. Returns: success. Required: deployment_id, issue_id. This feature is currently in Public Beta.

list_all_semgrep_deployments

List Semgrep deployments your auth token can access. Returns: id, name, slug, findings. Auth scope currently covers only the single deployment your token can access.

list_all_semgrep_deployment_projects

List all projects scanned or onboarded to Managed Scans in a Semgrep deployment. Does not return archived repositories. Returns: created_at, default_branch, id, latest_scan_at, name, primary_branch, tags, url. Returns 100 projects per page by default. Required: deployment_slug.

delete_a_semgrep_deployment_project_by_id

Delete a Semgrep project by id. Permanently deletes the project and all of its findings; this action cannot be reversed. Returns: id, name. Required: deployment_id, id.

semgrep_deployment_projects_update_tags

Add tags to a Semgrep project within a deployment. Tags that do not already exist for the deployment are created automatically and associated with the project. Returns the API response object. Required: deployment_slug, project_name.

semgrep_deployment_projects_delete_tags

Remove tags from a Semgrep project within a deployment. Tags are only removed from the specified project; other projects associated with the same tag remain unaffected. Returns the API response object. Required: deployment_slug, project_name.

get_single_semgrep_deployment_project_by_id

Get a specific Semgrep deployment project by its ID. Returns the project object including its id. Required: deployment_id, id.

semgrep_deployment_projects_get_by_name

Get project details. Returns: project. Required: deployment_slug, project_name.

semgrep_deployment_projects_delete_by_name

Delete a Semgrep deployment project by deployment slug and project name. This also deletes all associated findings. Returns an empty 204 response on success. Required: deployment_slug, project_name.

semgrep_deployment_projects_bulk_update

Update attributes for a Semgrep project using the request body. Returns the API response object. Required: deployment_slug, project_name.

get_single_semgrep_project_branch_by_id

Get a single project branch in Semgrep by its ID. Returns the branch object including its id and branch-specific attributes. Required: deployment_id, project_id, id. The v2 API is under active development; expect potential breaking changes.

create_a_semgrep_scans_retry

Retry one or more failed Semgrep Managed Scans (SMS) in a deployment. Only scans that are SMS and have failed or never finished can be retried. Returns: tasks (one per successful retry) and errors (one per failed retry). Required: deployment_id.

list_all_semgrep_deployment_scans

Get details of a specific Semgrep scan by ID. Returns the scan details including associated deployment, repository, and commit information. Required: deployment_id, scan_id.

semgrep_deployment_scans_search

List scans (beta). Returns: cursor, scans. Required: deployment_id.

get_single_semgrep_deployment_scan_by_id

Get a Semgrep scan by its ID within a deployment. Returns: id, attributes. Required: deployment_id, id.

list_all_semgrep_bootstrap_sms_vpcs

Get the Semgrep Managed Scans (SMS) VPC Bootstrap CloudFormation template. Returns the cross-account infrastructure template in JSON format with AWSTemplateFormatVersion, Description, and Resources including IAM roles, policies, and EC2 Image Builder distribution roles for SMS VPC automation. This is a beta feature.

list_all_semgrep_deployment_policies

List policies for a Semgrep deployment. Returns each policy with id, name, and slug. Required: deployment_id.

update_a_semgrep_deployment_policy_by_id

Update a specific policy in a Semgrep deployment. Returns the updated policy with id, name, and slug. Required: id, deployment_id.

get_single_semgrep_deployment_policy_by_id

Get the rules of a specific Semgrep deployment policy by policy id. Returns: cursor, policy, rules. Required: id, deployment_id.

create_a_semgrep_sbom_export

Create a new SBOM export job in Semgrep for a deployment. Returns a JSON response from the SBOM export service that can be used to track the export job status via the sibling status endpoint. Required: deployment_id.

get_single_semgrep_sbom_export_by_id

Get the status of a Semgrep SBOM export job by deployment and task token. Returns the SBOM export job status response. Required: id, deployment_id.

list_all_semgrep_deployment_secrets

List secret findings for a Semgrep deployment, filterable by severity, status, validation state, repository, and detection time. Returns: cursor, findings, previous. Required: deployment_id.

delete_a_semgrep_ticketing_ticket_by_id

Unlink a Jira ticket from a Semgrep deployment by its external ticket ID. Returns an empty 204 response on success. Required: id, deployment_id.

semgrep_project_managed_scans_bulk_update

Toggle Managed Scans for a project. Returns: project. Required: deployment_slug, project_name.

create_a_semgrep_deployment_ticket

Create Jira tickets for Semgrep findings by passing issue_ids or filter parameters to dynamically select findings. Returns the response with a failed array listing issues that were not ticketed. Synchronous; defaults to 20 tickets per request; groups findings by repo and rule into a single ticket (up to 50 issues per ticket). Required: deployment_slug, issue_type.

create_a_semgrep_deployment_triage

Bulk triage findings in a Semgrep deployment, selecting targets by finding IDs (issue_ids) or filter query parameters. Returns a BulkTriageResponse with the results of the triage operation. If specifying new_triage_reason, new_triage_state must be set to ignored. Required: deployment_slug, issue_type.

list_all_semgrep_pings

Ping the Semgrep server to assert liveness. Returns a PingResponse confirming the server is reachable. No required parameters.

create_a_semgrep_notification_webhook

Create a new notification webhook endpoint for a Semgrep deployment. Returns the created webhook object including its id. Required: deployment_id. A JSON request body is required but its field definitions are defined by the upstream CreateNotificationWebhookRequest schema.

get_single_semgrep_notification_webhook_by_id

Get a specific notification webhook by id within a Semgrep deployment. Returns the webhook object including its id. Required: deployment_id, id.

update_a_semgrep_notification_webhook_by_id

Update a notification webhook in Semgrep by replacement. Returns the updated webhook object including its id. Required: deployment_id, id.

delete_a_semgrep_notification_webhook_by_id

Delete a notification webhook in Semgrep by its id. Returns an empty 204 response on success. Required: deployment_id, id.

list_all_semgrep_users_lists

Retrieves a paginated list of users associated with a specific deployment, accepting pagination details in the request body. Experimental endpoint requiring deployment_id.