Mend Integration

Application security and open-source vulnerability scanning. Automate Mend deploys, issues, and webhook events across engineering workflows. When Watch Integrations fires, automatically update documentation, notify a team, or continue with Get a Project AI Implementation Finding Snippet.

Explore Documentation

3-day trialCancel anytimeUp to 10 minutes quick set up

GDPR
Data Encryption
2FA
Local Data Region

Supported triggers and actions for Mend integration

Triggers can detect changes in Mend and run actions that can create, search or modify data inside Mend automatically [3] — exactly how you set them.

Watch IntegrationsWatches for integrations.
Watch LabelsWatches for labels.
Watch ReportsWatches for reports.
Watch Zero Day EventsWatches for zero day events.
Get a Project AI Implementation Finding SnippetRetrieves detailed information for a specific AI implementation finding snippet within a project. This includes the associated code snippet, origin, implementation type, severity breakdown, risk factors, and linked findings, providing full context for analyzing and remediating AI-related issues detected in the codebase.
Get a Project AI VulnurabilityRetrieves detailed information about a specific AI vulnerability identified within a project. This includes vulnerability metadata such as name, type, description, publication details, references, and scoring data (including severity and risk metrics), providing deep context for analysis, prioritization, and remediation decisions.
Get a Project Code FindingRetrieves detailed information for a specific code finding in a project, including severity, risk factors, data flow analysis, suppression status, linked issues, and vulnerability classification metadata.
Get a Report StatusRetrieve the current status and metadata of an asynchronous report generation process using its report UUID, including progress and completion state.
Get a ScanRetrieve detailed information about a specific project scan using its scan UUID.
Get a Scan FindingRetrieve detailed information for a specific finding within a project scan.
Get a Scan SummaryRetrieve a summary of a specific scan within a project.
Get an Application AI VulnurabilityRetrieves detailed information about a specific AI vulnerability detected within an application. Includes vulnerability metadata such as name, type, description, publish and update timestamps, reference links, and scoring details like severity and risk scores. Useful for deep-dive analysis and remediation tracking of AI-related security issues.
Get Application TotalsRetrieve aggregated application statistics for a specified time period.
Get GroupRetrieve details of a specific group within an organization.
List Application AI Implementation FindingsRetrieves a paginated list of AI implementation findings aggregated across all projects within a specific application. This includes code-level AI issues such as snippets, implementation type, severity breakdowns, risk factors, and related findings, providing a consolidated view of AI-related implementation risks at the application level.
List Application AI ModelsRetrieves a paginated list of AI models detected within a specific application. This includes details such as model name, provider, version, category, origin, verification status, licensing, and associated risk information, enabling visibility into AI usage, compliance, and security posture at the application level.
List Application AI VulnurabilitiesRetrieves a paginated list of AI vulnerabilities detected within a specific application. Each entry includes identifiers, vulnerability name, scan metadata, timestamps, and related scan details, enabling visibility into AI-related security issues at the application level for tracking, prioritization, and remediation.
List Application LabelsRetrieve all labels associated with a specific application.
List Application ScansRetrieve a paginated list of scans associated with a specific application.
List Application StatisticsRetrieve statistics summaries for selected applications and related projects.
List ApplicationsRetrieve a paginated list of all applications accessible within an organization.
List Group RolesRetrieve all roles assigned to a specific group.
List Group UsersRetrieve all users that belong to a specific group.
List GroupsRetrieve a list of all groups within an organization, with pagination support.
List Image Scan PackagesRetrieve a paginated list of packages identified in an image scan.
List Image Scan Secret FindingsRetrieve a paginated list of secret-related findings from an image scan.
List Image Scan Security FindingsRetrieve a paginated list of security-related findings from an image scan.
List Implementation WeaknessesReturns a list of implementation weakness types and their details.
List IntegrationsRetrieve a paginated list of all integrations configured for an organization, with optional filtering.
List LabelsRetrieve a paginated list of all labels within an organization.
List Project AI Implementation FindingsRetrieves a paginated list of AI implementation findings for a specified project. These findings highlight AI-related issues detected in code snippets, including severity breakdowns (critical, high, medium, low), risk factors, and associated findings per element. This helps identify and prioritize AI implementation risks within the project’s codebase.
List Project AI ModelsRetrieves a paginated list of AI models detected within a specified project. This includes details such as model name, provider, version, origin, verification status, licensing, and associated risk factors, enabling visibility into AI model usage, compliance, and security posture across the project.
List Project AI TechnologiesRetrieves a paginated list of AI technologies detected within a specified project. This includes information about AI-related components such as their name, type, version, and identifier, providing visibility into AI usage and dependencies across the project’s codebase.
List Project AI VulnurabilitiesRetrieves a paginated list of AI-related vulnerabilities detected within a specified project. Each vulnerability entry includes identifiers, name, scan metadata, timestamps, and related scan information, providing visibility into security issues affecting AI components and enabling prioritization and remediation efforts.
List Project Code FindingsRetrieves a paginated list of code security findings for a project, including vulnerability details, severity, risk ratings, data flows, suppression status, and linked ALM issues.
List Project Due Diligence InformationRetrieves a paginated due diligence report for a project, including library source, license details, ownership, and risk scoring information for all dependencies.
List Project Image Scan PackagesRetrieves a paginated list of packages detected in the latest image scan for a specified project. Each package entry includes details such as name, version, type, and reachability status, enabling visibility into all components present within scanned container images for security and dependency analysis.
List Project Image Scan Secret FindingsRetrieves a paginated list of secret detection findings identified during the latest image scan for a specified project. Each result includes metadata such as secret category, severity, file location, and scan context (including layer and line information), enabling investigation and remediation of exposed sensitive data within container images.
List Project Image Scan Security FindingsRetrieves a paginated list of security vulnerabilities detected in the latest image scan for a specified project. Each finding includes vulnerability details such as CVSS score, EPS score, affected package information, severity, fix availability, and reachability data to support prioritization and remediation of container image security issues.
List Project In-House LibrariesRetrieves a paginated list of in-house libraries in a project, which are excluded from security alerts and license analysis, including metadata such as versions, locations, and security risk indicators.
List Project LabelsRetrieve all labels associated with a specific project.
List Project LibrariesRetrieves a paginated list of all libraries used by a project, including metadata such as version, type, dependencies, licenses, security risks, and additional package information.
List Project Library Security FindingsRetrieves a paginated list of open-source libraries in a project that have known security vulnerabilities, grouped by library, including severity counts, exploitability, reachability, and status information.
List Project Root Libraries Security FindingsRetrieves a paginated list of security findings grouped by root libraries for a project, including vulnerability counts, severity, exploitability, reachability, and optional zero-day filtering.
List Project Security FindingsRetrieves a paginated list of security findings for a project’s dependencies, including vulnerability details, component metadata, and remediation suggestions, with optional filtering by zero-day identifier.
List Project StatisticsRetrieve statistics summaries for selected projects and/or applications.
List Project TotalsRetrieve aggregated project statistics for a specified time period.
List Project Totals by DateRetrieve project statistics grouped by date within a specified period.
List Project ViolationsRetrieve a paginated list of policy violations for a specific project.
List Project Vulnerability TracesRetrieve vulnerability trace data (dependency paths) for a specific project.
List ProjectsRetrieve a paginated list of all projects accessible within an organization.
List ReportsRetrieve a paginated list of all reports for an organization, including metadata such as report type, status, format, and creation details.
List SBOM Import LogsRetrieve processing and validation logs generated during SBOM import for a specific scan.
List Scan FindingsRetrieve a paginated list of findings for a specific project scan.
List Scan TagsRetrieve all tags associated with a specific scan, with pagination support.
List ScansRetrieve a list of scans associated with a specific project, including pagination support and scan summary details.
List Source File Match Suggestion by ApplicationRetrieve library match recommendations for specified source files within an application.
List Source File MatchesSearch and retrieve library matches for source files within a project using custom criteria.
List Source File Matches by ApplicationSearch and retrieve library matches for source files within an application using custom criteria.
List Source Files InventoryRetrieve a paginated inventory of source files and their associated libraries within a project.
List Source Files Inventory by ApplicationRetrieve a paginated inventory of source files and their associated libraries within an application.
List Source Files Match SuggestionsRetrieve library match recommendations for specified source files within a project.
List UsersRetrieve a paginated list of all users within an organization.
List Zero Day Event FindingsRetrieve a paginated list of publicly known affected libraries and CVEs associated with a specific zero-day event.
List Zero Day EventsRetrieve a paginated list of all zero-day vulnerability events within an organization, with optional date filtering.
Bulk Update Project Code FindingsPerforms a bulk update on project code findings, allowing changes to review status, suppression state, suppression reason, or custom severity for multiple findings in a single request.
Bulk Update Project Image Findings StatusUpdates the status of multiple image security findings in a project, allowing bulk actions such as suppressing, reviewing, or marking issues with a reason and optional comments.
Create a Code Organization Compliance Report ExportGenerate and export a code compliance report at organization level asynchronously, with support for compliance standards, report levels, and formatting options.
Create a Code Project Compliance Report ExportGenerate and export a code compliance report for a specific project asynchronously, supporting compliance standards, report levels, and configurable output formats.
Create a Code Project Findings Report ExportGenerate and export a code findings report for a specific project asynchronously, supporting filtering, labeling, and configurable output formats.
Create a Code Project Reolved Findings Report ExportGenerate and export a resolved code findings report for a specific project asynchronously, including date range filtering and configurable output formats.
Create a Code Project Suppressions Report ExportGenerate and export a suppressed findings report for a specific project asynchronously, supporting filtering, labeling, and output format selection.
Create a Compliance Report ExportGenerate and export a code application compliance report asynchronously in the selected format and compliance standard.
Create a Due Dilligence Report ExportGenerate and export an image application due diligence report asynchronously in the selected format for compliance and risk assessment.
Create a Findings Report ExportGenerate and export a code application findings report asynchronously in the selected output format.
Create a GroupCreate a new group within an organization.
Create a Group RoleAssign a new role to a group within a specific scope.
Create a Group UserAdd one or more users to a group.
Create a Image Project Due Diligence ReportGenerate an asynchronous report analyzing security, compliance, and risk insights for image-based project dependencies.
Create a LabelCreate a new label definition within an organization.
Create a Project LabelAdd a new label to a specific project.
Create a Project SBOM ScanUpload an SBOM file to trigger a scan and update the project asynchronously.
Create a Resolve Findings Report ExportGenerate and export a report of resolved code application findings asynchronously for a specified date range and output format.
Create a SBOM Report ExportCreates a sbom report export.
Create a Suppressions Report ExportGenerate and export a report of suppressed code application findings asynchronously in the selected output format.
Create a Test RunTrigger a new AI red team test run for a project using the specified target and probe configurations.
Create a UserSend an invitation to add a new user to the organization.
Create a Users and Groups ReportGenerate an asynchronous report listing users and groups within an organization, including access and membership details.
Create an Account Inventory ReportGenerate an asynchronous inventory report of software dependencies (SCA) for a specific account, with optional filtering of libraries and components.
Create an AI Findings Report ExportGenerate and export an AI application findings report asynchronously in the selected report type and file format.
Create an AI Inventory Report ExportGenerate and export an AI application inventory report asynchronously in the selected report type and file format.
Create an AI Organization Findings Report ExportGenerate and export AI findings for an entire organization asynchronously, supporting filtering by scope, projects, and output format.
Create an AI Organization Inventory Report ExportGenerate and export an AI inventory report for an entire organization asynchronously, including scoped filtering, project selection, and output format options.
Create an AI Project Findings Report ExportGenerate and export AI findings for a specific project asynchronously, including scope filtering, labeling, and configurable output formats.
Create an AI Project Inventory Report ExportGenerate and export AI inventory data for a specific project asynchronously, with support for scope filtering, labeling, and configurable output formats.
Create an Application LabelAdd a new label to a specific application.
Create an Application SBOM Project ScanImport an SBOM file to create a new project under the application and trigger a scan asynchronously.
Create an Attribution Report ExportGenerate and export an image application attribution report asynchronously with configurable grouping, selected columns, and output format.
Create an Image Organization Attribution Report ExportGenerate and export an image attribution report at organization level asynchronously, with support for grouping, column selection, and scoped filtering options.
Create an Image Organization Due Dilligence Report ExportGenerate and export an image due diligence report at organization level asynchronously, supporting scoped filtering, vulnerability inclusion, and output formatting options.
Create an Image Organization SBOM Report ExportCreates an image organization sbom report export.
Create an Image Project Attribution ReportGenerate an asynchronous report of license and attribution details for image-based project dependencies.
Create an Image Project SBOM ReportCreates an image project sbom report.
Create Source File RemappingRemap source files to a target library across specified applications. This operation is asynchronous.
Create Source File Remapping by OrganizationRemap source files to a target library across the entire organization. This operation is asynchronous.
Delete a GroupDelete a specific group from an organization.
Delete a Group RoleRemove an assigned role from a group.
Delete a Group UserRemove a user from a group.
Delete a LabelRemove a label definition from an organization.
Delete a Project LabelRemove a label from a specific project.
Delete a ReportDelete an existing report using its report UUID (asynchronous process identifier) from the organization’s report list.
Delete a UserRemove a user from the organization.
Delete an Application LabelRemove a label from a specific application.
Download a ReportDownload a previously generated report file for an organization using its report UUID (asynchronous process identifier).
Export Account Dependency Security Findings by Library ReportExports account dependency security findings by library report.
Export Account Dependency Security Findings ReportExports account dependency security findings report.
Export Application Due Diligence ReportTriggers an asynchronous export of an application due diligence report in multiple formats, with optional project and label filtering, and returns a support token for tracking export status.
Export Application SBOM ReportExports application sbom report.
Export Project Due Diligence ReportTriggers an asynchronous export of a project due diligence report in multiple formats, with optional label filtering and inactive project exclusion, and returns a support token for tracking export status.
Export Project SBOM ReportExports project sbom report.
Make an API CallPerform an arbitrary authorized API request.
Update a GroupUpdate the name or description of an existing group.
Update a LabelUpdate the namespace or value of an existing label.
Update a Project Code FindingUpdates the state of a single project code finding, allowing changes to review status, suppression state, suppression reason, or custom severity.
Update a Project Image Scan Security Finding StatusUpdates the status of a specific security vulnerability finding identified in an image scan. This includes actions such as marking the finding as reviewed, unreviewed, suppressed, or creating an issue, with optional comments and suppression reasons to support vulnerability triage and remediation workflows.
Update a Project Package StatusUpdates the review state of a specific package vulnerability finding within image scan results. This includes changing its status (e.g. reviewed, suppressed, unreviewed, issue created), optionally providing a suppression reason and comment to support triage and vulnerability management decisions.
Update a User (Block)Block a user from accessing the organization.
Update a User (Unblock)Unblock a user and restore their access to the organization.
Update an Application Violation SLAUpdate the SLA for multiple violations associated with an application.
Update Project Root Library Security FindingUpdates the status of a project root library security finding, including review state (e.g. suppress or unsuppress) and optional comments indicating why the change was made.
Update Project Violation SLAUpdate the SLA for multiple project violations.

How to integrate Mend in automation workflow?

3 simple steps to make your Mend connected with other apps in automation workflows on WEXTL. Up to 10 minutes integration set up.

STEP 1

Select Mend in workflow

Pick Mend app in the workflow builder [4] - just one click to select the app.

STEP 2

Connect Mend

When prompted, authorize access to Mend in WEXTL once. Mend credentials are encrypted and never shared with WEXTL. Authorization will be reused in any future API calls [3].

WEXTL wants to integrate with your Mend account. Approve?

STEP 3

Build a workflow

Build your workflow with Mend yourself or with WEXTL® AI Builder. Connect Mend to any available integrations [5], or use HTTP node to go beyond them.

Mend

How Mend connects and integrates with WEXTL

Save and approve your credentials once — WEXTL® stores authorization information encrypted and reuses the authentication whenever Mend app is called in workflows. That allows your developer tools automations to run without your attention, per defined schedule [7]. Explore documentation [6] for a detailed list of fields that Mend supports.

Full Mend API documentation

The following table illustrates what fields Mend integration require during authorization flow inside our workflow builder [4].

Video slide demonstrates how Mend is connected in WEXTL builder [4].

Field	Type	Help
Base URLRequired	text	The base URL for your SCA API instance (e.g. https://api-mend.whitesourcesoftware.com).
EmailRequired	email	The email address associated with your account.
User KeyRequired	password	Your personal access token or service user key. For a service user, find it in the SCA App under Admin > Users.
Organization UUIDRequired	text	Your organization UUID. Find it in the SCA App under Administration > General > Organization UUID. Used in all API paths and token refresh.

Connect Mend to popular apps on WEXTL

Enter a name of the other app you want to sync with Mend below. Click on selected app to explore integration options with Mend. If the app you search for is not available in WEXTL yet, you can use HTTP node [10] instead to integrate it directly.

Example automation with Mend integration

Select Watch Reports trigger from Mend - this will be a starting point in your automation. Whenever event happens in Mend, workflow will start [7] from Watch Reports node.

Search for Create a Code Organization Compliance Report Export, connect it as the next step of integration sequence. You can use filters between Watch Reports and Create a Code Organization Compliance Report Export, so only important data pass from Watch Reports to the next step. WEXTL gives you full control over the process of Mend automation. All parts of workflow are visible on the canvas [4].

Mend on WEXTL has 131 modules for creating developer tools automations. Explore Mend documentation for more.

Video slide demonstrates how Watch Reports and Create a Code Organization Compliance Report Export nodes are used in Mend workflow.

Video slide demonstrates how Watch Reports and Create a Code Organization Compliance Report Export [6] nodes are used in Mend workflow.

Frequently asked questions

Common questions about automating Mend in your workflows.

Mend has 4 triggers, including "Watch Integrations", "Watch Labels", and "Watch Reports", and more. Triggers are start points of the workflow, and automations may start from them.

Integration has 127 actions, including "Get a Project AI Implementation Finding Snippet", "Get a Project AI Vulnurability", and "Get a Project Code Finding", and more. Refer to our Mend Documentation for detailed inputs and outputs.

No. Most automations are built visually on the canvas by picking triggers, actions, and mapping fields. You can add custom JavaScript with Functions when advanced logic is needed — but our customers do that in rare cases [4].

Yes. Connections are authenticated per account, credentials are encrypted at rest, and you can enforce approvals and team-level access controls on any automation.

The Mend integration on WEXTL runs directly on its vendor public API — every field name, authentication method, and rate limit is controlled by Mend official API and covered in documentation [3]. WEXTL handles the request signing and pagination for you.

Absolutely. Where Mend provides native webhooks, you can use instant triggers to eliminate polling delay. For custom webhooks, WEXTL offers Custom Webhook node, so you can start automation whenever Mend or any other service sends event to webhook URL.

WEXTL is an AI-first visual canvas. The platform allows you to describe automation in plain text — and AI will wire nodes for Mend inside the workflow builder [4]. You can also use built-in workflow nodes (AI Agent, Human in the Loop, Condition, Aggregate Results) in pair with Mend modules to craft complex integration flows with branches, filtering, and conditional logic. There are absolutely no limits of what you can build.

References

List of sources used to gather information about the Mend integration.

Mend integration source code, module specs and credentials implementation.
Internal Mend integration documentation, structured input and output parameters, scopes, and authentication methods.
Official Mend vendor API documentation — used to verify field meanings, authentication flows, and anything our own specs don't fully capture.
WEXTL® Visual Workflow Builder, anonymized data from our technical support team.
WEXTL® Apps Library
WEXTL® Mend App Documentation
WEXTL® Workflow Scheduler
WEXTL® HTTP node documentation

Mend Integration

Supported triggers and actions for Mend integration