Applications

Download schema

Endpoints for the web applications the sites of the team's servers serve: WordPress with its plugins and themes, Laravel, Symfony and other Composer or npm projects, and the vulnerabilities of their packages.

Search applications

GET

https://server.chief.app/api/v1

/applications

OpenID Connect

Bearer (ctp_*)

Bearer (ctt_*)

Find applications across the servers the authenticated team can see, including servers shared with it: which have a malicious package or open vulnerabilities, and which run a WordPress, Laravel or Symfony release past its end of life. Applications with a malicious package come first, then the most severe vulnerabilities. Every result includes its server.

Search applications › query Parameters

query

string | null · maxLength: 255

Only return applications whose path or site names contain this text.

kind

string | null · enum

Only return applications of this kind.

Enum values:

wordpress

laravel

symfony

composer

node

vulnerable

boolean | null

Only return applications with an open vulnerability in a package they need in production.

malicious

boolean | null

Only return applications with an open malicious package.

end_of_life

boolean | null

Only return applications whose WordPress, Laravel or Symfony release is past its end of life.

outdated

boolean | null

Only return WordPress applications older than WordPress's latest release.

package

string | null · maxLength: 214

Only return applications with this Composer or npm package, or WordPress plugin or theme slug, by its exact name, development dependencies included.

per_page

integer · min: 1 · max: 100

page

integer · min: 1

Search applications › Responses

Paginated set of Application

object[] · required

object · required

GET/applications

curl https://server.chief.app/api/v1/applications \
  --header 'Authorization: Bearer <token>'

Example Responses

{
  "data": [
    {
      "id": "application_01j8q8zk2f4m6n7p9r1s3t5v7x",
      "server": {
        "id": "server_01j8q8zk2f4m6n7p9r1s3t5v7x",
        "name": "web-01"
      },
      "path": "/home/forge/shop.example.com/current",
      "kind": "wordpress",
      "version": "11.9.2",
      "end_of_life": true,
      "end_of_life_at": "2026-03-12",
      "latest_version": "6.8.3",
      "outdated": true,
      "sites": [
        "shop.example.com",
        "www.shop.example.com"
      ],
      "owner": "forge",
      "lockfiles": [
        "composer.lock",
        "package-lock.json"
      ],
      "packages_count": 214,
      "plugins_count": 15,
      "themes_count": 2,
      "truncated": true,
      "open_vulnerabilities_count": 3,
      "malicious_packages_count": 0,
      "detected_at": "detected_at"
    }
  ],
  "links": {
    "first": "first",
    "last": "last",
    "prev": "prev",
    "next": "next"
  },
  "meta": {
    "current_page": 1,
    "from": 1,
    "last_page": 1,
    "links": [
      {
        "url": "url",
        "label": "label",
        "active": true
      }
    ],
    "path": "path",
    "per_page": 0,
    "to": 1,
    "total": 0
  }
}

json

application/json

Show an application

GET

https://server.chief.app/api/v1

/applications/{application}

OpenID Connect

Bearer (ctp_*)

Bearer (ctt_*)

Show an application of a server the authenticated team can see: its kind and version, sites, lockfiles and how many packages, plugins, themes and open vulnerabilities it has.

Show an application › path Parameters

application

string · required

Show an application › Responses

Application

object · required

GET/applications/{application}

curl https://server.chief.app/api/v1/applications/:application \
  --header 'Authorization: Bearer <token>'

Example Responses

{
  "data": {
    "id": "application_01j8q8zk2f4m6n7p9r1s3t5v7x",
    "server": {
      "id": "server_01j8q8zk2f4m6n7p9r1s3t5v7x",
      "name": "web-01"
    },
    "path": "/home/forge/shop.example.com/current",
    "kind": "wordpress",
    "version": "11.9.2",
    "end_of_life": true,
    "end_of_life_at": "2026-03-12",
    "latest_version": "6.8.3",
    "outdated": true,
    "sites": [
      "shop.example.com",
      "www.shop.example.com"
    ],
    "owner": "forge",
    "lockfiles": [
      "composer.lock",
      "package-lock.json"
    ],
    "packages_count": 214,
    "plugins_count": 15,
    "themes_count": 2,
    "truncated": true,
    "open_vulnerabilities_count": 3,
    "malicious_packages_count": 0,
    "detected_at": "detected_at"
  }
}

json

application/json

List an application's packages

GET

https://server.chief.app/api/v1

/applications/{application}/packages

OpenID Connect

Bearer (ctp_*)

Bearer (ctt_*)

List the Composer and npm packages of an application's lockfiles and the plugins and themes of a WordPress install, read from their headers, with the latest stable release on Packagist, npm or WordPress.org. Packages only development dependencies need are left out unless asked for. Whether a WordPress plugin is active is not known.

List an application's packages › path Parameters

application

string · required

List an application's packages › query Parameters

query

string | null · maxLength: 255

Only return packages, plugins and themes whose name contains this text.

ecosystem

string | null · enum

Only return packages of this ecosystem, or WordPress plugins or themes.

Enum values:

composer

npm

wordpress-plugin

wordpress-theme

wordpress-core

include_dev

boolean | null

Also return packages only development dependencies need.

outdated

boolean | null

Only return packages, plugins and themes older than their latest stable release.

per_page

integer · min: 1 · max: 100

page

integer · min: 1

List an application's packages › Responses

Paginated set of ApplicationPackage

ApplicationPackage[] · required

object · required

GET/applications/{application}/packages

curl https://server.chief.app/api/v1/applications/:application/packages \
  --header 'Authorization: Bearer <token>'

Example Responses

{
  "data": [
    {
      "ecosystem": "composer",
      "name": "guzzlehttp/guzzle",
      "version": "7.9.2",
      "title": "Akismet Anti-spam",
      "direct": true,
      "dev": true,
      "must_use": true,
      "parent": "twentytwentyfour",
      "latest_version": "7.9.2",
      "latest_released_at": "latest_released_at",
      "outdated": true
    }
  ],
  "links": {
    "first": "first",
    "last": "last",
    "prev": "prev",
    "next": "next"
  },
  "meta": {
    "current_page": 1,
    "from": 1,
    "last_page": 1,
    "links": [
      {
        "url": "url",
        "label": "label",
        "active": true
      }
    ],
    "path": "path",
    "per_page": 0,
    "to": 1,
    "total": 0
  }
}

json

application/json

List an application's vulnerabilities

GET

https://server.chief.app/api/v1

/applications/{application}/vulnerabilities

OpenID Connect

Bearer (ctp_*)

Bearer (ctt_*)

List the open vulnerabilities of an application's Composer and npm packages, matched against GitHub, Drupal and malicious package advisories: malicious packages first, then the most severe, known exploited, with a public exploit and most likely exploited. Packages only development dependencies need and resolved vulnerabilities are left out unless asked for.

List an application's vulnerabilities › path Parameters

application

string · required

List an application's vulnerabilities › query Parameters

severity

string | null · enum

Only return vulnerabilities of this severity or worse. Malicious packages are critical.

Enum values:

critical

high

medium

low

negligible

unknown

include_dev

boolean | null

Also return vulnerabilities of packages only development dependencies need.

include_resolved

boolean | null

Also return resolved vulnerabilities.

per_page

integer · min: 1 · max: 100

page

integer · min: 1

List an application's vulnerabilities › Responses

Paginated set of ApplicationVulnerability

ApplicationVulnerability[] · required

object · required

GET/applications/{application}/vulnerabilities

curl https://server.chief.app/api/v1/applications/:application/vulnerabilities \
  --header 'Authorization: Bearer <token>'

Example Responses

{
  "data": [
    {
      "vulnerability_id": "CVE-2022-31090",
      "advisory_id": "GHSA-25mq-v84q-4j7r",
      "advisory_ids": [
        "GHSA-25mq-v84q-4j7r"
      ],
      "advisory_url": "https://github.com/advisories/GHSA-25mq-v84q-4j7r",
      "summary": "CURLOPT_HTTPAUTH option not cleared on change of origin",
      "ecosystem": "composer",
      "package": "guzzlehttp/guzzle",
      "installed_version": "7.4.0",
      "fixed_version": "7.4.5",
      "fix_status": "available",
      "severity": "critical",
      "cvss_score": 7.7,
      "malicious": true,
      "dev": true,
      "known_exploited": true,
      "known_exploited_at": "2026-10-27",
      "epss_score": 0.01947,
      "epss_percentile": 0.83121,
      "public_exploit": true,
      "metasploit_module": "exploit/linux/http/magento_xxe_to_glibc_buf_overflow",
      "nuclei_template": "http/cves/2021/CVE-2021-44228.yaml",
      "exploit_db_id": 50973,
      "first_seen_at": "first_seen_at",
      "resolved_at": "resolved_at",
      "resolved_version": "7.4.5"
    }
  ],
  "links": {
    "first": "first",
    "last": "last",
    "prev": "prev",
    "next": "next"
  },
  "meta": {
    "current_page": 1,
    "from": 1,
    "last_page": 1,
    "links": [
      {
        "url": "url",
        "label": "label",
        "active": true
      }
    ],
    "path": "path",
    "per_page": 0,
    "to": 1,
    "total": 0
  }
}

json

application/json

Certificates Vulnerabilities