On November 20, 2025, AWS will discontinue support for Amazon CodeGuru Security. After November 20, 2025, you will no longer be able to access the /codeguru/security console, service resources, or documentation. For more information, see https://docs.aws.amazon.com/codeguru/latest/security-ug/end-of-support.html.
This section provides documentation for the Amazon CodeGuru Security API operations. CodeGuru Security is a service that uses program analysis and machine learning to detect security policy violations and vulnerabilities, and recommends ways to address these security risks.
By proactively detecting and providing recommendations for addressing security risks, CodeGuru Security improves the overall security of your application code. For more information about CodeGuru Security, see the Amazon CodeGuru Security User Guide.
", "operations": { "BatchGetFindings": "Returns a list of requested findings from standard scans.
", "CreateScan": "Use to create a scan using code uploaded to an Amazon S3 bucket.
", "CreateUploadUrl": "Generates a pre-signed URL, request headers used to upload a code resource, and code artifact identifier for the uploaded resource.
You can upload your code resource to the URL with the request headers using any HTTP client.
", "GetAccountConfiguration": "Use to get the encryption configuration for an account.
", "GetFindings": "Returns a list of all findings generated by a particular scan.
", "GetMetricsSummary": "Returns a summary of metrics for an account from a specified date, including number of open findings, the categories with most findings, the scans with most open findings, and scans with most open critical findings.
", "GetScan": "Returns details about a scan, including whether or not a scan has completed.
", "ListFindingsMetrics": "Returns metrics about all findings in an account within a specified time range.
", "ListScans": "Returns a list of all scans in an account. Does not return EXPRESS scans.
Returns a list of all tags associated with a scan.
", "TagResource": "Use to add one or more tags to an existing scan.
", "UntagResource": "Use to remove one or more tags from an existing scan.
", "UpdateAccountConfiguration": "Use to update the encryption configuration for an account.
" }, "shapes": { "AccessDeniedException": { "base": "You do not have sufficient access to perform this action.
", "refs": {} }, "AccountFindingsMetric": { "base": "A summary of findings metrics for an account on a specified date.
", "refs": { "FindingsMetricList$member": null } }, "AnalysisType": { "base": null, "refs": { "CreateScanRequest$analysisType": "The type of analysis you want CodeGuru Security to perform in the scan, either Security or All. The Security type only generates findings related to security. The All type generates both security findings and quality findings. Defaults to Security type if missing.
The type of analysis CodeGuru Security performed in the scan, either Security or All. The Security type only generates findings related to security. The All type generates both security findings and quality findings.
Contains information about the error that caused a finding to fail to be retrieved.
", "refs": { "BatchGetFindingsErrors$member": null } }, "BatchGetFindingsErrors": { "base": null, "refs": { "BatchGetFindingsResponse$failedFindings": "A list of errors for individual findings which were not fetched. Each BatchGetFindingsError contains the scanName, findingId, errorCode and error message.
A list of CategoryWithFindingNum objects for the top 5 finding categories with the most findings.
Information about a finding category with open findings.
", "refs": { "CategoriesWithMostFindings$member": null } }, "ClientToken": { "base": null, "refs": { "CreateScanRequest$clientToken": "The idempotency token for the request. Amazon CodeGuru Security uses this value to prevent the accidental creation of duplicate scans if there are failures and retries.
" } }, "CodeLine": { "base": "The line of code where a finding was detected.
", "refs": { "CodeSnippet$member": null } }, "CodeSnippet": { "base": null, "refs": { "FilePath$codeSnippet": "A list of CodeLine objects that describe where the security vulnerability appears in your code.
The requested operation would cause a conflict with the current state of a service resource associated with the request. Resolve the conflict before retrying this request.
", "refs": {} }, "CreateScanRequest": { "base": null, "refs": {} }, "CreateScanResponse": { "base": null, "refs": {} }, "CreateUploadUrlRequest": { "base": null, "refs": {} }, "CreateUploadUrlResponse": { "base": null, "refs": {} }, "DetectorTags": { "base": null, "refs": { "Finding$detectorTags": "One or more tags or categorizations that are associated with a detector. These tags are defined by type, programming language, or other classification such as maintainability or consistency.
" } }, "Double": { "base": null, "refs": { "FindingMetricsValuePerSeverity$info": "A numeric value corresponding to an informational finding.
", "FindingMetricsValuePerSeverity$low": "A numeric value corresponding to a low severity finding.
", "FindingMetricsValuePerSeverity$medium": "A numeric value corresponding to a medium severity finding.
", "FindingMetricsValuePerSeverity$high": "A numeric value corresponding to a high severity finding.
", "FindingMetricsValuePerSeverity$critical": "A numeric value corresponding to a critical finding.
" } }, "EncryptionConfig": { "base": "Information about the encryption configuration for an account. Required to call UpdateAccountConfiguration.
An EncryptionConfig object that contains the KMS key ARN that is used for encryption. By default, CodeGuru Security uses an AWS-managed key for encryption. To specify your own key, call UpdateAccountConfiguration. If you do not specify a customer-managed key, returns empty.
The customer-managed KMS key ARN you want to use for encryption. If not specified, CodeGuru Security will use an AWS-managed key for encryption. If you previously specified a customer-managed KMS key and want CodeGuru Security to use an AWS-managed key for encryption instead, pass nothing.
", "UpdateAccountConfigurationResponse$encryptionConfig": "An EncryptionConfig object that contains the KMS key ARN that is used for encryption. If you did not specify a customer-managed KMS key in the request, returns empty.
A code associated with the type of error.
" } }, "ErrorMessage": { "base": null, "refs": { "GetScanResponse$errorMessage": "Details about the error that causes a scan to fail to be retrieved.
" } }, "FilePath": { "base": "Information about the location of security vulnerabilities that Amazon CodeGuru Security detected in your code.
", "refs": { "Vulnerability$filePath": "An object that describes the location of the detected security vulnerability in your code.
" } }, "Finding": { "base": "Information about a finding that was detected in your code.
", "refs": { "Findings$member": null } }, "FindingIdentifier": { "base": "An object that contains information about a finding and the scan that generated it.
", "refs": { "FindingIdentifiers$member": null } }, "FindingIdentifiers": { "base": null, "refs": { "BatchGetFindingsRequest$findingIdentifiers": "A list of finding identifiers. Each identifier consists of a scanName and a findingId. You retrieve the findingId when you call GetFindings.
A numeric value corresponding to the severity of a finding, such as the number of open findings or the average time it takes to close findings of a given severity.
", "refs": { "AccountFindingsMetric$newFindings": "The number of new findings of each severity on the specified date.
", "AccountFindingsMetric$closedFindings": "The number of closed findings of each severity on the specified date.
", "AccountFindingsMetric$openFindings": "The number of open findings of each severity as of the specified date.
", "AccountFindingsMetric$meanTimeToClose": "The average time in days it takes to close findings of each severity as of a specified date.
", "MetricsSummary$openFindings": "The number of open findings of each severity.
" } }, "Findings": { "base": null, "refs": { "BatchGetFindingsResponse$findings": "A list of all findings which were successfully fetched.
", "GetFindingsResponse$findings": "A list of findings generated by the specified scan.
" } }, "FindingsMetricList": { "base": null, "refs": { "ListFindingsMetricsResponse$findingsMetrics": "A list of AccountFindingsMetric objects retrieved from the specified time interval.
The maximum number of results to return in the response. Use this parameter when paginating results. If additional results exist beyond the number you specify, the nextToken element is returned in the response. Use nextToken in a subsequent request to retrieve additional results. If not specified, returns 1000 results.
The number of open findings in the category.
", "CodeLine$number": "The code line number.
", "FilePath$startLine": "The first line number of the code snippet where the security vulnerability appears in your code.
", "FilePath$endLine": "The last line number of the code snippet where the security vulnerability appears in your code.
", "ScanNameWithFindingNum$findingNumber": "The number of findings generated by a scan.
", "Vulnerability$itemCount": "The number of times the vulnerability appears in your code.
" } }, "InternalServerException": { "base": "The server encountered an internal error and is unable to complete the request.
", "refs": {} }, "KmsKeyArn": { "base": null, "refs": { "EncryptionConfig$kmsKeyArn": "The KMS key ARN that is used for encryption. If an AWS-managed key is used for encryption, returns empty.
" } }, "ListFindingsMetricsRequest": { "base": null, "refs": {} }, "ListFindingsMetricsRequestMaxResultsInteger": { "base": null, "refs": { "ListFindingsMetricsRequest$maxResults": "The maximum number of results to return in the response. Use this parameter when paginating results. If additional results exist beyond the number you specify, the nextToken element is returned in the response. Use nextToken in a subsequent request to retrieve additional results. If not specified, returns 1000 results.
The maximum number of results to return in the response. Use this parameter when paginating results. If additional results exist beyond the number you specify, the nextToken element is returned in the response. Use nextToken in a subsequent request to retrieve additional results. If not specified, returns 100 results.
The number of times a scan has been re-run on a revised resource.
" } }, "MetricsSummary": { "base": "A summary of metrics for an account as of a specified date.
", "refs": { "GetMetricsSummaryResponse$metricsSummary": "The summary metrics from the specified date.
" } }, "NextToken": { "base": null, "refs": { "GetFindingsRequest$nextToken": "A token to use for paginating results that are returned in the response. Set the value of this parameter to null for the first request. For subsequent calls, use the nextToken value returned from the previous request to continue listing results after the first page.
A pagination token. You can use this in future calls to GetFindings to continue listing results after the current page.
A token to use for paginating results that are returned in the response. Set the value of this parameter to null for the first request. For subsequent calls, use the nextToken value returned from the previous request to continue listing results after the first page.
A pagination token. You can use this in future calls to ListFindingMetrics to continue listing results after the current page.
A token to use for paginating results that are returned in the response. Set the value of this parameter to null for the first request. For subsequent calls, use the nextToken value returned from the previous request to continue listing results after the first page.
A pagination token. You can use this in future calls to ListScans to continue listing results after the current page.
Information about the recommended course of action to remediate a finding.
", "refs": { "Remediation$recommendation": "An object that contains information about the recommended course of action to remediate a finding.
" } }, "ReferenceUrls": { "base": null, "refs": { "Vulnerability$referenceUrls": "One or more URL addresses that contain details about a vulnerability.
" } }, "RelatedVulnerabilities": { "base": null, "refs": { "Vulnerability$relatedVulnerabilities": "One or more vulnerabilities that are related to the vulnerability being described.
" } }, "Remediation": { "base": "Information about how to remediate a finding.
", "refs": { "Finding$remediation": "An object that contains the details about how to remediate a finding.
" } }, "RequestHeaderMap": { "base": null, "refs": { "CreateUploadUrlResponse$requestHeaders": "A set of key-value pairs that contain the required headers when uploading your resource.
" } }, "Resource": { "base": "Information about a resource that contains a finding.
", "refs": { "Finding$resource": "The resource where Amazon CodeGuru Security detected a finding.
" } }, "ResourceId": { "base": "The identifier for a resource object that contains resources to scan. Specifying a codeArtifactId is required to create a scan.
", "refs": { "CreateScanRequest$resourceId": "The identifier for the resource object to be scanned.
", "CreateScanResponse$resourceId": "The identifier for the resource object that contains resources that were scanned.
" } }, "ResourceNotFoundException": { "base": "The resource specified in the request was not found.
", "refs": {} }, "S3Url": { "base": null, "refs": { "CreateUploadUrlResponse$s3Url": "A pre-signed S3 URL. You can upload the code file you want to scan with the required requestHeaders using any HTTP client.
The name of the scan that generated the finding.
", "CreateScanRequest$scanName": "The unique name that CodeGuru Security uses to track revisions across multiple scans of the same resource. Only allowed for a STANDARD scan type.
The name of the scan.
", "CreateUploadUrlRequest$scanName": "The name of the scan that will use the uploaded resource. CodeGuru Security uses the unique scan name to track revisions across multiple scans of the same resource. Use this scanName when you call CreateScan on the code resource you upload to this URL.
The name of the scan you want to retrieve findings from.
", "GetScanRequest$scanName": "The name of the scan you want to view details about.
", "GetScanResponse$scanName": "The name of the scan.
", "ScanSummary$scanName": "The name of the scan.
" } }, "ScanNameArn": { "base": null, "refs": { "CreateScanResponse$scanNameArn": "The ARN for the scan name.
", "GetScanResponse$scanNameArn": "The ARN for the scan name.
", "ListTagsForResourceRequest$resourceArn": "The ARN of the ScanName object. You can retrieve this ARN by calling CreateScan, ListScans, or GetScan.
The ARN for the scan name.
", "TagResourceRequest$resourceArn": "The ARN of the ScanName object. You can retrieve this ARN by calling CreateScan, ListScans, or GetScan.
The ARN of the ScanName object. You can retrieve this ARN by calling CreateScan, ListScans, or GetScan.
Information about the number of findings generated by a scan.
", "refs": { "ScansWithMostOpenCriticalFindings$member": null, "ScansWithMostOpenFindings$member": null } }, "ScanState": { "base": null, "refs": { "CreateScanResponse$scanState": "The current state of the scan. Returns either InProgress, Successful, or Failed.
The current state of the scan. Returns either InProgress, Successful, or Failed.
The state of the scan. A scan can be In Progress, Complete, or Failed.
A list of ScanSummary objects with information about all scans in an account.
Information about a scan.
", "refs": { "ScanSummaries$member": null } }, "ScanType": { "base": null, "refs": { "CreateScanRequest$scanType": "The type of scan, either Standard or Express. Defaults to Standard type if missing.
Express scans run on limited resources and use a limited set of detectors to analyze your code in near-real time. Standard scans have standard resource limits and use the full set of detectors to analyze your code.
A list of ScanNameWithFindingNum objects for the top 3 scans with the most number of open critical findings.
A list of ScanNameWithFindingNum objects for the top 3 scans with the most number of open findings.
The severity of the finding. Severity can be critical, high, medium, low, or informational. For information on severity levels, see Finding severity in the Amazon CodeGuru Security User Guide.
" } }, "Status": { "base": null, "refs": { "Finding$status": "The status of the finding. A finding status can be open or closed.
", "GetFindingsRequest$status": "The status of the findings you want to get. Pass either Open, Closed, or All.
The identifier for the error.
", "AccessDeniedException$message": "Description of the error.
", "AccessDeniedException$resourceId": "The identifier for the resource you don't have access to.
", "AccessDeniedException$resourceType": "The type of resource you don't have access to.
", "BatchGetFindingsError$findingId": "The finding ID of the finding that was not fetched.
", "BatchGetFindingsError$message": "Describes the error.
", "CategoryWithFindingNum$categoryName": "The name of the finding category. A finding category is determined by the detector that detected the finding.
", "CodeLine$content": "The code that contains a vulnerability.
", "ConflictException$errorCode": "The identifier for the error.
", "ConflictException$message": "Description of the error.
", "ConflictException$resourceId": "The identifier for the service resource associated with the request.
", "ConflictException$resourceType": "The type of resource associated with the request.
", "DetectorTags$member": null, "FilePath$name": "The name of the file.
", "FilePath$path": "The path to the resource with the security vulnerability.
", "Finding$description": "A description of the finding.
", "Finding$generatorId": "The identifier for the component that generated a finding such as AmazonCodeGuruSecurity.
", "Finding$id": "The identifier for a finding.
", "Finding$type": "The type of finding.
", "Finding$title": "The title of the finding.
", "Finding$detectorId": "The identifier for the detector that detected the finding in your code. A detector is a defined rule based on industry standards and AWS best practices.
", "Finding$detectorName": "The name of the detector that identified the security vulnerability in your code.
", "Finding$ruleId": "The identifier for the rule that generated the finding.
", "FindingIdentifier$scanName": "The name of the scan that generated the finding.
", "FindingIdentifier$findingId": "The identifier for a finding.
", "InternalServerException$error": "The internal error encountered by the server.
", "InternalServerException$message": "Description of the error.
", "Recommendation$text": "The recommended course of action to remediate the finding.
", "Recommendation$url": "The URL address to the recommendation for remediating the finding.
", "ReferenceUrls$member": null, "RelatedVulnerabilities$member": null, "Resource$id": "The scanName of the scan that was run on the resource.
The identifier for a section of the resource.
", "ResourceNotFoundException$errorCode": "The identifier for the error.
", "ResourceNotFoundException$message": "Description of the error.
", "ResourceNotFoundException$resourceId": "The identifier for the resource that was not found.
", "ResourceNotFoundException$resourceType": "The type of resource that was not found.
", "ScanNameWithFindingNum$scanName": "The name of the scan.
", "SuggestedFix$description": "A description of the suggested code fix and why it is being suggested.
", "SuggestedFix$code": "The suggested code fix. If applicable, includes code patch to replace your source code.
", "ThrottlingException$errorCode": "The identifier for the error.
", "ThrottlingException$message": "Description of the error.
", "ThrottlingException$serviceCode": "The identifier for the originating service.
", "ThrottlingException$quotaCode": "The identifier for the originating quota.
", "ValidationException$errorCode": "The identifier for the error.
", "ValidationException$message": "Description of the error.
", "ValidationExceptionField$name": "The name of the exception.
", "ValidationExceptionField$message": "Describes the exception.
", "Vulnerability$id": "The identifier for the vulnerability.
" } }, "SuggestedFix": { "base": "Information about the suggested code fix to remediate a finding.
", "refs": { "SuggestedFixes$member": null } }, "SuggestedFixes": { "base": null, "refs": { "Remediation$suggestedFixes": "A list of SuggestedFix objects. Each object contains information about a suggested code fix to remediate the finding.
A list of keys for each tag you want to remove from a scan.
" } }, "TagMap": { "base": null, "refs": { "CreateScanRequest$tags": "An array of key-value pairs used to tag a scan. A tag is a custom attribute label with two parts:
A tag key. For example, CostCenter, Environment, or Secret. Tag keys are case sensitive.
An optional tag value field. For example, 111122223333, Production, or a team name. Omitting the tag value is the same as using an empty string. Tag values are case sensitive.
An array of key-value pairs used to tag an existing scan. A tag is a custom attribute label with two parts:
A tag key. For example, CostCenter, Environment, or Secret. Tag keys are case sensitive.
An optional tag value field. For example, 111122223333, Production, or a team name. Omitting the tag value is the same as using an empty string. Tag values are case sensitive.
An array of key-value pairs used to tag an existing scan. A tag is a custom attribute label with two parts:
A tag key. For example, CostCenter, Environment, or Secret. Tag keys are case sensitive.
An optional tag value field. For example, 111122223333, Production, or a team name. Omitting the tag value is the same as using an empty string. Tag values are case sensitive.
The request was denied due to request throttling.
", "refs": {} }, "Timestamp": { "base": null, "refs": { "AccountFindingsMetric$date": "The date from which the findings metrics were retrieved.
", "Finding$createdAt": "The time when the finding was created.
", "Finding$updatedAt": "The time when the finding was last updated. Findings are updated when you remediate them or when the finding code location changes.
", "GetMetricsSummaryRequest$date": "The date you want to retrieve summary metrics from, rounded to the nearest day. The date must be within the past two years.
", "GetScanResponse$createdAt": "The time the scan was created.
", "GetScanResponse$updatedAt": "The time when the scan was last updated. Only available for STANDARD scan types.
The start date of the interval which you want to retrieve metrics from. Rounds to the nearest day.
", "ListFindingsMetricsRequest$endDate": "The end date of the interval which you want to retrieve metrics from. Round to the nearest day.
", "MetricsSummary$date": "The date from which the metrics summary information was retrieved.
", "ScanSummary$createdAt": "The time when the scan was created.
", "ScanSummary$updatedAt": "The time the scan was last updated. A scan is updated when it is re-run.
" } }, "UntagResourceRequest": { "base": null, "refs": {} }, "UntagResourceResponse": { "base": null, "refs": {} }, "UpdateAccountConfigurationRequest": { "base": null, "refs": {} }, "UpdateAccountConfigurationResponse": { "base": null, "refs": {} }, "Uuid": { "base": null, "refs": { "CreateScanResponse$runId": "UUID that identifies the individual scan run.
", "CreateUploadUrlResponse$codeArtifactId": "The identifier for the uploaded code resource. Pass this to CreateScan to use the uploaded resources.
UUID that identifies the individual scan run you want to view details about. You retrieve this when you call the CreateScan operation. Defaults to the latest scan run if missing.
UUID that identifies the individual scan run.
", "ResourceId$codeArtifactId": "The identifier for the code file uploaded to the resource object. Returned by CreateUploadUrl when you upload resources to be scanned.
The identifier for the scan run.
" } }, "ValidationException": { "base": "The input fails to satisfy the specified constraints.
", "refs": {} }, "ValidationExceptionField": { "base": "Information about a validation exception.
", "refs": { "ValidationExceptionFieldList$member": null } }, "ValidationExceptionFieldList": { "base": null, "refs": { "ValidationException$fieldList": "The field that caused the error, if applicable.
" } }, "ValidationExceptionReason": { "base": null, "refs": { "ValidationException$reason": "The reason the request failed validation.
" } }, "Vulnerability": { "base": "Information about a security vulnerability that Amazon CodeGuru Security detected.
", "refs": { "Finding$vulnerability": "An object that describes the detected security vulnerability.
" } } } }