What actions can I run in Mend?

127 actions are available, including "Get an Application AI Vulnurability", "Get Application Totals", and "Get a Project AI Implementation Finding Snippet", and more. Run them from any trigger in your automation stack — map fields once and they execute automatically.

Do I need to write code to automate this?

No. Most automations are built visually on the canvas by picking triggers, actions, and mapping fields. You can add custom JavaScript with Functions when advanced logic is needed — but it is never required.

Is the integration secure?

Yes. Connections are authenticated per account, credentials are encrypted at rest, and you can enforce approvals and team-level access controls on any automation.

Mend Integrations

Application security and open-source vulnerability scanning. Automate Mend deploys, issues, and webhooks into chat, tickets, or status pages.

Explore Documentation

GDPR
Data Encryption
2FA
Local Data Region

Watch IntegrationsWatches for integrations.
Watch LabelsWatches for labels.
Watch ReportsWatches for reports.
Watch Zero Day EventsWatches for zero day events.
Get an Application AI VulnurabilityRetrieves detailed information about a specific AI vulnerability detected within an application. Includes vulnerability metadata such as name, type, description, publish and update timestamps, reference links, and scoring details like severity and risk scores. Useful for deep-dive analysis and remediation tracking of AI-related security issues.
Get Application TotalsRetrieve aggregated application statistics for a specified time period.
Get a Project AI Implementation Finding SnippetRetrieves detailed information for a specific AI implementation finding snippet within a project. This includes the associated code snippet, origin, implementation type, severity breakdown, risk factors, and linked findings, providing full context for analyzing and remediating AI-related issues detected in the codebase.
Get a Project AI VulnurabilityRetrieves detailed information about a specific AI vulnerability identified within a project. This includes vulnerability metadata such as name, type, description, publication details, references, and scoring data (including severity and risk metrics), providing deep context for analysis, prioritization, and remediation decisions.
Get a Project Code FindingRetrieves detailed information for a specific code finding in a project, including severity, risk factors, data flow analysis, suppression status, linked issues, and vulnerability classification metadata.
Get a Report StatusRetrieve the current status and metadata of an asynchronous report generation process using its report UUID, including progress and completion state.
Get a ScanRetrieve detailed information about a specific project scan using its scan UUID.
Get a Scan FindingRetrieve detailed information for a specific finding within a project scan.
Get a Scan SummaryRetrieve a summary of a specific scan within a project.
Get GroupRetrieve details of a specific group within an organization.
List Application AI Implementation FindingsRetrieves a paginated list of AI implementation findings aggregated across all projects within a specific application. This includes code-level AI issues such as snippets, implementation type, severity breakdowns, risk factors, and related findings, providing a consolidated view of AI-related implementation risks at the application level.
List Application AI ModelsRetrieves a paginated list of AI models detected within a specific application. This includes details such as model name, provider, version, category, origin, verification status, licensing, and associated risk information, enabling visibility into AI usage, compliance, and security posture at the application level.
List Application AI VulnurabilitiesRetrieves a paginated list of AI vulnerabilities detected within a specific application. Each entry includes identifiers, vulnerability name, scan metadata, timestamps, and related scan details, enabling visibility into AI-related security issues at the application level for tracking, prioritization, and remediation.
List Application LabelsRetrieve all labels associated with a specific application.
List ApplicationsRetrieve a paginated list of all applications accessible within an organization.
List Application ScansRetrieve a paginated list of scans associated with a specific application.
List Application StatisticsRetrieve statistics summaries for selected applications and related projects.
List Group RolesRetrieve all roles assigned to a specific group.
List GroupsRetrieve a list of all groups within an organization, with pagination support.
List Group UsersRetrieve all users that belong to a specific group.
List Image Scan PackagesRetrieve a paginated list of packages identified in an image scan.
List Image Scan Secret FindingsRetrieve a paginated list of secret-related findings from an image scan.
List Image Scan Security FindingsRetrieve a paginated list of security-related findings from an image scan.
List Implementation WeaknessesReturns a list of implementation weakness types and their details.
List IntegrationsRetrieve a paginated list of all integrations configured for an organization, with optional filtering.
List LabelsRetrieve a paginated list of all labels within an organization.
List Project AI Implementation FindingsRetrieves a paginated list of AI implementation findings for a specified project. These findings highlight AI-related issues detected in code snippets, including severity breakdowns (critical, high, medium, low), risk factors, and associated findings per element. This helps identify and prioritize AI implementation risks within the project’s codebase.
List Project AI ModelsRetrieves a paginated list of AI models detected within a specified project. This includes details such as model name, provider, version, origin, verification status, licensing, and associated risk factors, enabling visibility into AI model usage, compliance, and security posture across the project.
List Project AI TechnologiesRetrieves a paginated list of AI technologies detected within a specified project. This includes information about AI-related components such as their name, type, version, and identifier, providing visibility into AI usage and dependencies across the project’s codebase.
List Project AI VulnurabilitiesRetrieves a paginated list of AI-related vulnerabilities detected within a specified project. Each vulnerability entry includes identifiers, name, scan metadata, timestamps, and related scan information, providing visibility into security issues affecting AI components and enabling prioritization and remediation efforts.
List Project Code FindingsRetrieves a paginated list of code security findings for a project, including vulnerability details, severity, risk ratings, data flows, suppression status, and linked ALM issues.
List Project Due Diligence InformationRetrieves a paginated due diligence report for a project, including library source, license details, ownership, and risk scoring information for all dependencies.
List Project Image Scan PackagesRetrieves a paginated list of packages detected in the latest image scan for a specified project. Each package entry includes details such as name, version, type, and reachability status, enabling visibility into all components present within scanned container images for security and dependency analysis.
List Project Image Scan Secret FindingsRetrieves a paginated list of secret detection findings identified during the latest image scan for a specified project. Each result includes metadata such as secret category, severity, file location, and scan context (including layer and line information), enabling investigation and remediation of exposed sensitive data within container images.
List Project Image Scan Security FindingsRetrieves a paginated list of security vulnerabilities detected in the latest image scan for a specified project. Each finding includes vulnerability details such as CVSS score, EPS score, affected package information, severity, fix availability, and reachability data to support prioritization and remediation of container image security issues.
List Project In-House LibrariesRetrieves a paginated list of in-house libraries in a project, which are excluded from security alerts and license analysis, including metadata such as versions, locations, and security risk indicators.
List Project LabelsRetrieve all labels associated with a specific project.
List Project LibrariesRetrieves a paginated list of all libraries used by a project, including metadata such as version, type, dependencies, licenses, security risks, and additional package information.
List Project Library Security FindingsRetrieves a paginated list of open-source libraries in a project that have known security vulnerabilities, grouped by library, including severity counts, exploitability, reachability, and status information.
List Project Root Libraries Security FindingsRetrieves a paginated list of security findings grouped by root libraries for a project, including vulnerability counts, severity, exploitability, reachability, and optional zero-day filtering.
List ProjectsRetrieve a paginated list of all projects accessible within an organization.
List Project Security FindingsRetrieves a paginated list of security findings for a project’s dependencies, including vulnerability details, component metadata, and remediation suggestions, with optional filtering by zero-day identifier.
List Project StatisticsRetrieve statistics summaries for selected projects and/or applications.
List Project TotalsRetrieve aggregated project statistics for a specified time period.
List Project Totals by DateRetrieve project statistics grouped by date within a specified period.
List Project ViolationsRetrieve a paginated list of policy violations for a specific project.
List Project Vulnerability TracesRetrieve vulnerability trace data (dependency paths) for a specific project.
List ReportsRetrieve a paginated list of all reports for an organization, including metadata such as report type, status, format, and creation details.
List SBOM Import LogsRetrieve processing and validation logs generated during SBOM import for a specific scan.
List Scan FindingsRetrieve a paginated list of findings for a specific project scan.
List ScansRetrieve a list of scans associated with a specific project, including pagination support and scan summary details.
List Scan TagsRetrieve all tags associated with a specific scan, with pagination support.
List Source File MatchesSearch and retrieve library matches for source files within a project using custom criteria.
List Source File Matches by ApplicationSearch and retrieve library matches for source files within an application using custom criteria.
List Source File Match Suggestion by ApplicationRetrieve library match recommendations for specified source files within an application.
List Source Files InventoryRetrieve a paginated inventory of source files and their associated libraries within a project.
List Source Files Inventory by ApplicationRetrieve a paginated inventory of source files and their associated libraries within an application.
List Source Files Match SuggestionsRetrieve library match recommendations for specified source files within a project.
List UsersRetrieve a paginated list of all users within an organization.
List Zero Day Event FindingsRetrieve a paginated list of publicly known affected libraries and CVEs associated with a specific zero-day event.
List Zero Day EventsRetrieve a paginated list of all zero-day vulnerability events within an organization, with optional date filtering.
Bulk Update Project Code FindingsPerforms a bulk update on project code findings, allowing changes to review status, suppression state, suppression reason, or custom severity for multiple findings in a single request.
Bulk Update Project Image Findings StatusUpdates the status of multiple image security findings in a project, allowing bulk actions such as suppressing, reviewing, or marking issues with a reason and optional comments.
Create a Code Organization Compliance Report ExportGenerate and export a code compliance report at organization level asynchronously, with support for compliance standards, report levels, and formatting options.
Create a Code Project Compliance Report ExportGenerate and export a code compliance report for a specific project asynchronously, supporting compliance standards, report levels, and configurable output formats.
Create a Code Project Findings Report ExportGenerate and export a code findings report for a specific project asynchronously, supporting filtering, labeling, and configurable output formats.
Create a Code Project Reolved Findings Report ExportGenerate and export a resolved code findings report for a specific project asynchronously, including date range filtering and configurable output formats.
Create a Code Project Suppressions Report ExportGenerate and export a suppressed findings report for a specific project asynchronously, supporting filtering, labeling, and output format selection.
Create a Compliance Report ExportGenerate and export a code application compliance report asynchronously in the selected format and compliance standard.
Create a Due Dilligence Report ExportGenerate and export an image application due diligence report asynchronously in the selected format for compliance and risk assessment.
Create a Findings Report ExportGenerate and export a code application findings report asynchronously in the selected output format.
Create a GroupCreate a new group within an organization.
Create a Group RoleAssign a new role to a group within a specific scope.
Create a Group UserAdd one or more users to a group.
Create a Image Project Due Diligence ReportGenerate an asynchronous report analyzing security, compliance, and risk insights for image-based project dependencies.
Create a LabelCreate a new label definition within an organization.
Create an Account Inventory ReportGenerate an asynchronous inventory report of software dependencies (SCA) for a specific account, with optional filtering of libraries and components.
Create an AI Findings Report ExportGenerate and export an AI application findings report asynchronously in the selected report type and file format.
Create an AI Inventory Report ExportGenerate and export an AI application inventory report asynchronously in the selected report type and file format.
Create an AI Organization Findings Report ExportGenerate and export AI findings for an entire organization asynchronously, supporting filtering by scope, projects, and output format.
Create an AI Organization Inventory Report ExportGenerate and export an AI inventory report for an entire organization asynchronously, including scoped filtering, project selection, and output format options.
Create an AI Project Findings Report ExportGenerate and export AI findings for a specific project asynchronously, including scope filtering, labeling, and configurable output formats.
Create an AI Project Inventory Report ExportGenerate and export AI inventory data for a specific project asynchronously, with support for scope filtering, labeling, and configurable output formats.
Create an Application LabelAdd a new label to a specific application.
Create an Application SBOM Project ScanImport an SBOM file to create a new project under the application and trigger a scan asynchronously.
Create an Attribution Report ExportGenerate and export an image application attribution report asynchronously with configurable grouping, selected columns, and output format.
Create an Image Organization Attribution Report ExportGenerate and export an image attribution report at organization level asynchronously, with support for grouping, column selection, and scoped filtering options.
Create an Image Organization Due Dilligence Report ExportGenerate and export an image due diligence report at organization level asynchronously, supporting scoped filtering, vulnerability inclusion, and output formatting options.
Create an Image Organization SBOM Report ExportCreates an image organization sbom report export.
Create an Image Project Attribution ReportGenerate an asynchronous report of license and attribution details for image-based project dependencies.
Create an Image Project SBOM ReportCreates an image project sbom report.
Create a Project LabelAdd a new label to a specific project.
Create a Project SBOM ScanUpload an SBOM file to trigger a scan and update the project asynchronously.
Create a Resolve Findings Report ExportGenerate and export a report of resolved code application findings asynchronously for a specified date range and output format.
Create a SBOM Report ExportCreates a sbom report export.
Create a Suppressions Report ExportGenerate and export a report of suppressed code application findings asynchronously in the selected output format.
Create a Test RunTrigger a new AI red team test run for a project using the specified target and probe configurations.
Create a UserSend an invitation to add a new user to the organization.
Create a Users and Groups ReportGenerate an asynchronous report listing users and groups within an organization, including access and membership details.
Create Source File RemappingRemap source files to a target library across specified applications. This operation is asynchronous.
Create Source File Remapping by OrganizationRemap source files to a target library across the entire organization. This operation is asynchronous.
Delete a GroupDelete a specific group from an organization.
Delete a Group RoleRemove an assigned role from a group.
Delete a Group UserRemove a user from a group.
Delete a LabelRemove a label definition from an organization.
Delete an Application LabelRemove a label from a specific application.
Delete a Project LabelRemove a label from a specific project.
Delete a ReportDelete an existing report using its report UUID (asynchronous process identifier) from the organization’s report list.
Delete a UserRemove a user from the organization.
Download a ReportDownload a previously generated report file for an organization using its report UUID (asynchronous process identifier).
Export Account Dependency Security Findings by Library ReportExports account dependency security findings by library report.
Export Account Dependency Security Findings ReportExports account dependency security findings report.
Export Application Due Diligence ReportTriggers an asynchronous export of an application due diligence report in multiple formats, with optional project and label filtering, and returns a support token for tracking export status.
Export Application SBOM ReportExports application sbom report.
Export Project Due Diligence ReportTriggers an asynchronous export of a project due diligence report in multiple formats, with optional label filtering and inactive project exclusion, and returns a support token for tracking export status.
Export Project SBOM ReportExports project sbom report.
Make an API CallPerform an arbitrary authorized API request.
Update a GroupUpdate the name or description of an existing group.
Update a LabelUpdate the namespace or value of an existing label.
Update an Application Violation SLAUpdate the SLA for multiple violations associated with an application.
Update a Project Code FindingUpdates the state of a single project code finding, allowing changes to review status, suppression state, suppression reason, or custom severity.
Update a Project Image Scan Security Finding StatusUpdates the status of a specific security vulnerability finding identified in an image scan. This includes actions such as marking the finding as reviewed, unreviewed, suppressed, or creating an issue, with optional comments and suppression reasons to support vulnerability triage and remediation workflows.
Update a Project Package StatusUpdates the review state of a specific package vulnerability finding within image scan results. This includes changing its status (e.g. reviewed, suppressed, unreviewed, issue created), optionally providing a suppression reason and comment to support triage and vulnerability management decisions.
Update a User (Block)Block a user from accessing the organization.
Update a User (Unblock)Unblock a user and restore their access to the organization.
Update Project Root Library Security FindingUpdates the status of a project root library security finding, including review state (e.g. suppress or unsuppress) and optional comments indicating why the change was made.
Update Project Violation SLAUpdate the SLA for multiple project violations.

When to use Mend

Common scenarios where Mend automation saves time and reduces manual work.

Trigger workflows automatically when "Watch Integrations" fires in Mend — start multi-step automations without polling or manual checks.
Automate "Get Application Totals" in Mend as a workflow step — combine it with triggers, filters, and AI steps for full-pipeline coverage.
Combine "Watch Reports" from Mend with triggers or actions in other apps to close the loop — one event, many downstream outcomes.

How to connect

Paste your credentials once — WEXTL® stores them encrypted and reuses the connection across every workflow that needs it.

Full API documentation

Enter your credentials below. WEXTL stores them encrypted and uses them only to call the API on your behalf.

Connecting Mend to WEXTL®

Field	Type	Help
Base URLRequired	text	The base URL for your SCA API instance (e.g. https://api-mend.whitesourcesoftware.com).
EmailRequired	email	The email address associated with your account.
User KeyRequired	password	Your personal access token or service user key. For a service user, find it in the SCA App under Admin > Users.
Organization UUIDRequired	text	Your organization UUID. Find it in the SCA App under Administration > General > Organization UUID. Used in all API paths and token refresh.

Use in workflow automation

Start from Mend’s Watch Reports trigger and the run begins the moment there’s something new — no cron job to babysit, no one remembering to check.

Add Create a Code Organization Compliance Report Export as the next step, then branch, filter or hand off to the rest of your stack. The whole path stays on one canvas your team can read.

This integration brings 131 ready-made steps for developer tools work, and every run records what went in and what came back.

Mend workflow on the canvas: Watch Reports then Create a Code Organization Compliance Report Export

Frequently asked questions

Common questions about automating Mend in your workflows.

Mend has 4 triggers, including "Watch Integrations", "Watch Labels", and "Watch Reports", and more. Use them to start workflows the moment Mend events fire — no polling required.

Field

Type

Help

Base URLRequired

text

The base URL for your SCA API instance (e.g. https://api-mend.whitesourcesoftware.com).

EmailRequired

The email address associated with your account.

User KeyRequired

password

Your personal access token or service user key. For a service user, find it in the SCA App under Admin > Users.

Organization UUIDRequired

text

Your organization UUID. Find it in the SCA App under Administration > General > Organization UUID. Used in all API paths and token refresh.

Use in workflow automation

Start from Mend’s Watch Reports trigger and the run begins the moment there’s something new — no cron job to babysit, no one remembering to check.

Add Create a Code Organization Compliance Report Export as the next step, then branch, filter or hand off to the rest of your stack. The whole path stays on one canvas your team can read.

This integration brings 131 ready-made steps for developer tools work, and every run records what went in and what came back.

Mend Integrations

When to use Mend

How to connect

Use in workflow automation

Frequently asked questions

Mend Integrations

When to use Mend

How to connect

Connect Mend to any app in workflows

Use in workflow automation

Frequently asked questions

Connect Mend to any app in workflows

Connect Mend to any app in workflows

Connect Mend to any app in workflows

Mend Integrations

Mend triggers and actions

When to use Mend

How to connect

Use in workflow automation

Frequently asked questions

What triggers does Mend support?

What actions can I run in Mend?

Do I need to write code to automate this?

Is the integration secure?

Mend Integrations

Mend triggers and actions

When to use Mend

How to connect

Connect Mend to any app in workflows

Use in workflow automation

Frequently asked questions

What triggers does Mend support?

What actions can I run in Mend?

Do I need to write code to automate this?

Is the integration secure?

Connect Mend to any app in workflows

Connect Mend to any app in workflows

Connect Mend to any app in workflows