# Corgea Documentation

## Documentation

### Getting Started

- [Corgea Documentation](https://docs.corgea.app/introduction.md): Find, triage, and fix security issues in your code with AI.
- [Quickstart](https://docs.corgea.app/quickstart.md): Setup Corgea in less than 5 mins.
- [Settings](https://docs.corgea.app/settings.md): Find and change every account, company, and automation setting from one place

### Core Features

- [Corgea Agent](https://docs.corgea.app/agent.md): AI-powered assistant for managing security vulnerabilities in your codebase
- [Security Design Reviews](https://docs.corgea.app/security-review.md): Review design documents, PRDs, and specifications for security recommendations before implementation
- [Code Quality](https://docs.corgea.app/code-quality-scanner.md): AI-powered code review tool for maintainability, readability, and performance
- [Reporting](https://docs.corgea.app/reporting.md): Track scan activity, vulnerabilities, and developer insights across your organization.

#### Security Scanning

- [AI-native SAST](https://docs.corgea.app/blast.md): Comprehensive vulnerability coverage in Corgea
- [Secret Scanning](https://docs.corgea.app/secret-scanning.md): Detect and secure hardcoded secrets in your codebase
- [Dependency Scanning (SCA)](https://docs.corgea.app/sca.md): Dependency Scanning, also known as Software Composition Analysis (SCA), automatically identifies known security vulnerabilities in your project's third-party dependencies and libraries. It scans dependency manifest files (like `package.json`, `requirements.txt`, `pom.xml`) and provides detailed vuln…
- [Container Image Scanning](https://docs.corgea.app/container-scanning.md): Container image scanning identifies known security vulnerabilities in the base images your project depends on, including operating system packages, system libraries, and other software installed within the image layers.
- [Malicious Package Detection](https://docs.corgea.app/malware-scanning.md): Malicious package detection flags known malicious and compromised packages in your dependencies, such as typosquats, hijacked releases, and backdoored versions, before they reach production.
- [PII/PHI Scanning](https://docs.corgea.app/pii.md): PII/PHI Scanning automatically detects and identifies Personally Identifiable Information (PII) and Protected Health Information (PHI) in your codebase. It scans source code, configuration files, and documentation to find sensitive data patterns like credit card numbers, social security numbers, ema…
- [Infrastructure as Code (IaC) Scanning](https://docs.corgea.app/iac.md): IaC Scanning automatically detects security misconfigurations and exposed secrets in your infrastructure code before deployment. It analyzes configuration files for Kubernetes, Terraform, Docker, CloudFormation, and other IaC tools to identify security risks, compliance violations, and best practice…
- [Uploading Scans](https://docs.corgea.app/upload-report.md): Start generating fixes for your repository
- [Scheduled Scans](https://docs.corgea.app/scheduled-scans.md): Automatically run security scans on a recurring schedule
- [Issue Fingerprinting](https://docs.corgea.app/fingerprint.md): Learn how Corgea uniquely identifies and tracks security vulnerabilities across scans
- [Pentesting](https://docs.corgea.app/pentesting.md): Run AI-driven penetration tests against configured web application targets

#### Issue Management

- [Vulnerabilities Workbench](https://docs.corgea.app/vulnerabilities.md): Review and triage findings across your organization
- [Applying Fixes](https://docs.corgea.app/fixes.md): Start fixing vulnerable code.
- [False Positive Detection](https://docs.corgea.app/false_positive.md): Corgea Auto-detects False Positives
- [Issue Assignment & Status Management](https://docs.corgea.app/issue_assignment.md): Assign and track security issues across your team
- [Issue Export](https://docs.corgea.app/issue_export.md): Export security findings in various formats including SARIF, CSV, and PDF
- [Project Management](https://docs.corgea.app/project.md): Configure scanning behavior for your project including CWE filters and file ignore rules

#### Policy Management

- [PolicyIQ](https://docs.corgea.app/policies.md): Enriching Corgea with Business Context through Policies
- [SLA Management](https://docs.corgea.app/sla_management.md): Configure and manage Service Level Agreements (SLAs) for security issues
- [Blocking Rules](https://docs.corgea.app/blocking_rules.md): Blocking rules enforce security and quality standards in pull requests or CI pipelines.

#### Users & Groups

- [User Management](https://docs.corgea.app/user_management.md): Manage your users in Corgea
- [Permission Groups](https://docs.corgea.app/permission_groups.md): This document provides a comprehensive overview of all permissions available for assignment to permission groups in the Corgea platform. Permissions control what actions users can perform within the system.
- [Teams](https://docs.corgea.app/teams.md): Organize users into teams and manage project access at scale with team-based permissions
- [Content Access Management](https://docs.corgea.app/content-access-management.md): Control project access for different teams and members.
- [Notifications](https://docs.corgea.app/notifications.md): Stay informed about important security events with email and webhook notifications

### Integrations

- [Private Package Registries](https://docs.corgea.app/private-package-registries.md): Connect Corgea to your private package registry so dependency scanning covers your internal packages and everything they depend on. Supports Maven, PyPI, and NuGet.
- [Agentic Integrations](https://docs.corgea.app/agentic_integrations.md): Empower your AI coding agents to scan, triage, and fix security vulnerabilities autonomously

#### IDEs

- [Visual Studio Code](https://docs.corgea.app/vsc_extension.md): Bring Corgea to your Visual Studio Code
- [Visual Studio 2022](https://docs.corgea.app/vs2022_extension.md): Bring Corgea to your Visual Studio Code
- [JetBrains IDEs](https://docs.corgea.app/jetbrains_extension.md): Bring Corgea to IntelliJ IDEA, PyCharm, WebStorm, and other JetBrains IDEs

#### Source Control

- [GitHub](https://docs.corgea.app/github.md): Start generating fixes for your repository
- [GitLab](https://docs.corgea.app/gitlab.md): Setting up a GitLab Integration in Corgea
- [Azure DevOps](https://docs.corgea.app/azure_devops.md): Comprehensive Guide to Configuring Azure DevOps with Corgea
- [Bitbucket](https://docs.corgea.app/bitbucket.md): Comprehensive Guide to Configuring Bitbucket with Corgea
- [Harness](https://docs.corgea.app/harness.md): Comprehensive Guide to Configuring Harness Code with Corgea

#### Automation Management

- [JIRA](https://docs.corgea.app/jira.md): Setting up the JIRA Integration in Corgea
- [Linear](https://docs.corgea.app/linear.md): Setting up the Linear Integration in Corgea
- [Slack](https://docs.corgea.app/slack.md): Setting up Slack notifications with Corgea webhooks
- [Zapier](https://docs.corgea.app/zapier.md): Setting up Zapier with Corgea webhooks
- [Webhooks](https://docs.corgea.app/webhooks.md): Automate HTTP callbacks from Corgea to any external system

### Tools & Utilities

- [Model Context Protocol (MCP)](https://docs.corgea.app/modelcontextprotocol.md): Connect AI assistants to Corgea using the Model Context Protocol

#### CLI

- [CLI](https://docs.corgea.app/cli.md): Supercharge your security from the command line
- [Dependency Scanning (CLI)](https://docs.corgea.app/cli/deps.md): Build offline dependency inventories, dependency graphs, SBOMs, and policy checks with corgea deps

### Releases

- [Changelog](https://docs.corgea.app/changelog.md): Product updates and announcements

### Trust & Compliance

- [Security](https://docs.corgea.app/security.md): Corgea's Security and Privacy Standards
- [Vulnerability Disclosure Policy](https://docs.corgea.app/vulnerability-disclosure.md): Guidelines for security researchers to responsibly report vulnerabilities in Corgea products and services
- [Legal](https://docs.corgea.app/legal.md): Corgea's Legal Documents

### Authentication

- [SSO](https://docs.corgea.app/sso.md): Enable seamless and secure access to multiple applications with Single Sign-On (SSO) using the SAML protocol, enhancing user experience and security.
- [JWT Auth](https://docs.corgea.app/jwt-token.md): Authenticate API requests using JWT Bearer tokens issued by your identity provider (Entra ID, Okta, etc.) for system-to-system integrations.

## API Reference

### API Reference

- [API Reference](https://docs.corgea.app/api-reference/introduction.md): Get started with the Corgea API
- [Chunked scan upload](https://docs.corgea.app/api-reference/chunked-scan-upload.md): Upload large BLAST scans in chunks with the Start Scan API

### Authentication

- [Verify Token (Deprecated)](https://docs.corgea.app/api-reference/authentication/verify-token-deprecated.md)
- [Verify Token](https://docs.corgea.app/api-reference/authentication/verify-token.md): Verify the API token and optionally return user information
- [Get Login Attempts](https://docs.corgea.app/api-reference/authentication/get-login-attempts.md): Retrieve successful login attempts for users
- [Get Failed Login Attempts](https://docs.corgea.app/api-reference/authentication/get-failed-login-attempts.md): Retrieve failed login attempts for users
- [Get User Login Attempts](https://docs.corgea.app/api-reference/authentication/get-user-login-attempts.md): Retrieve successful login attempts for a specific user
- [Get User Failed Login Attempts](https://docs.corgea.app/api-reference/authentication/get-user-failed-login-attempts.md): Retrieve failed login attempts for a specific user

### Scans

- [Get Scans](https://docs.corgea.app/api-reference/scans/get-scans.md): Retrieves a list of scans for the authenticated user's company
- [Get Scan](https://docs.corgea.app/api-reference/scans/get-scan.md): Retrieves details of a specific scan
- [Get Scan Report](https://docs.corgea.app/api-reference/scans/get-scan-report.md): Retrieve a scan report in HTML, SARIF, Markdown, or PDF format. PDF reports are available after a scan completes, including scans with no findings. format=pdf accepts only urgency and classification filters; other filters return 400. Reports with more than 500 findings are generated asynchronously a…
- [Check Blocking Rules](https://docs.corgea.app/api-reference/scans/check-blocking-rules.md): Check if scan issues violate any blocking rules

### Issues

- [List All Issues](https://docs.corgea.app/api-reference/issues/list-all-issues.md): Retrieve a list of all security issues for the authenticated user's company
- [List Code Quality Issues](https://docs.corgea.app/api-reference/issues/list-code-quality-issues.md): Retrieve code quality findings separately from security issues. Classification values are code quality labels, such as Maintainability, rather than CWEs.
- [Get Code Quality Issues for Scan](https://docs.corgea.app/api-reference/issues/get-code-quality-issues-for-scan.md): Retrieve code quality findings for a specific scan.
- [Get Issues for Scan](https://docs.corgea.app/api-reference/issues/get-issues-for-scan.md): Retrieves a list of issues for a specific scan
- [Get Issue](https://docs.corgea.app/api-reference/issues/get-issue.md): Retrieves details of a specific issue
- [Get SCA Issue](https://docs.corgea.app/api-reference/issues/get-sca-issue.md): Retrieve details for a specific Software Composition Analysis (SCA) issue, including dependency reachability information.
- [Get SCA Issues](https://docs.corgea.app/api-reference/issues/get-sca-issues.md): Retrieve a list of Software Composition Analysis (SCA) issues
- [Get IaC Issues](https://docs.corgea.app/api-reference/issues/get-iac-issues.md): Retrieve Infrastructure-as-Code (IaC) security issues from the latest matching processed scan.
- [Get SCA Issues for Scan](https://docs.corgea.app/api-reference/issues/get-sca-issues-for-scan.md): Retrieve SCA issues for a specific scan
- [Get IaC Issues for Scan](https://docs.corgea.app/api-reference/issues/get-iac-issues-for-scan.md): Retrieve Infrastructure-as-Code (IaC) security issues for a specific scan.

### Triage

- [Bulk triage findings](https://docs.corgea.app/api-reference/triage/bulk-triage-findings.md): Preview or apply a rule-based status change to as many as 5,000 accessible SAST or SCA findings. Accepted-risk actions that meet the company's approval threshold return 202 and remain pending until a different company admin approves them.
- [Get a triage action](https://docs.corgea.app/api-reference/triage/get-a-triage-action.md): Retrieve a bulk triage action and its paginated, immutable finding audit records.
- [Review a triage action](https://docs.corgea.app/api-reference/triage/review-a-triage-action.md): Approve or reject a pending action. The reviewer must be a different company admin with permission to change every selected finding type.
- [Get the triage approval policy](https://docs.corgea.app/api-reference/triage/get-the-triage-approval-policy.md): Return the accepted-risk thresholds that require approval. Company admin access is required.
- [Update the triage approval policy](https://docs.corgea.app/api-reference/triage/update-the-triage-approval-policy.md): Partially update the accepted-risk approval thresholds. Set a threshold to null to disable it. Company admin access is required.

### Dependencies

- [Get Dependencies](https://docs.corgea.app/api-reference/dependencies/get-dependencies.md): Retrieve software dependencies (SBOM) from the latest matching processed scan.
- [Get Dependencies for Scan](https://docs.corgea.app/api-reference/dependencies/get-dependencies-for-scan.md): Retrieve software dependencies (SBOM) for a specific scan.

### Starting Corgea Scan

- [Start New Scan](https://docs.corgea.app/api-reference/starting-corgea-scan/start-new-scan.md): Starts a BLAST chunked upload. Send `scan_type=blast` as a form field and exactly one `files` part. The archive name must use `.zip`, `.tar`, `.json`, `.fpr`, `.sarif`, or `.xml`. The part body may be empty; send archive bytes with PATCH. BLAST scanning must be enabled for your company.
- [Check Upload Status](https://docs.corgea.app/api-reference/starting-corgea-scan/check-upload-status.md): Return the current upload offset for a transfer. This path requires a trailing slash. Does not return `scan_id`.
- [Continue Scan Upload](https://docs.corgea.app/api-reference/starting-corgea-scan/continue-scan-upload.md): Continue a BLAST chunked upload. This path requires a trailing slash. Intermediate responses include the `Upload-Offset` header and no `scan_id`. When the last chunk completes the archive, the JSON body includes `scan_id` and `project_id` and does not set `Upload-Offset`.

### Uploading 3rd Party Scan

- [Upload Scan](https://docs.corgea.app/api-reference/uploading-3rd-party-scan/upload-scan.md): Upload a completed scan report from CLI tools. Upload at least one source file with `/code-upload` for the same `run_id` before calling this endpoint. This endpoint receives pre-generated scan results from Semgrep, Snyk, Checkmarx, CodeQL, and Fortify and integrates them into the system.
- [Upload Git Config](https://docs.corgea.app/api-reference/uploading-3rd-party-scan/upload-git-config.md): Upload Git configuration data for a specific scan run to help with repository URL parsing and analysis.
- [Upload Source Code File](https://docs.corgea.app/api-reference/uploading-3rd-party-scan/upload-source-code-file.md): Upload individual source code files for a specific scan run. This is used to upload the actual source files that will be analyzed.
- [Upload CI/CD Data](https://docs.corgea.app/api-reference/uploading-3rd-party-scan/upload-cicd-data.md): Upload CI/CD pipeline metadata and context information for a specific scan run.

### Skills

- [List Skills](https://docs.corgea.app/api-reference/skills/list-skills.md): Retrieve skills in the authenticated user's company. Use status=approved to return only skills with an approved, installable version.
- [Get Skill](https://docs.corgea.app/api-reference/skills/get-skill.md): Retrieve a single skill by slug. By default, the latest approved version is returned when one exists. A specific version can be requested with the version query parameter. Version content is included only when the selected version is approved.

### Projects

- [List Projects](https://docs.corgea.app/api-reference/projects/list-projects.md): Retrieve a list of projects for the authenticated user's company
- [Update Project Tags](https://docs.corgea.app/api-reference/projects/update-project-tags.md): Add, remove, or replace tags for a project. Incoming tags are trimmed, lowercased, empty values are ignored, and duplicate values are removed before the update is applied.

### Policies

- [List Blocking Rules](https://docs.corgea.app/api-reference/policies/list-blocking-rules.md): Retrieve all blocking rules for the authenticated user's company
- [List Policies](https://docs.corgea.app/api-reference/policies/list-policies.md): Retrieve policies for the authenticated user's company. Results are ordered by newest first.
- [Create Policy](https://docs.corgea.app/api-reference/policies/create-policy.md): Create a policy for the authenticated user's company.
- [Get Policy](https://docs.corgea.app/api-reference/policies/get-policy.md): Retrieve a policy by ID.
- [Deactivate Policy](https://docs.corgea.app/api-reference/policies/deactivate-policy.md): Deactivate a policy by ID.
- [Update Policy](https://docs.corgea.app/api-reference/policies/update-policy.md): Partially update a policy. Updates to policy content create a new version; changing only active status updates the same policy.

### Notifications

- [List Notification Types](https://docs.corgea.app/api-reference/notifications/list-notification-types.md): Retrieve active notification types available to the authenticated user.
- [List Notification Preferences](https://docs.corgea.app/api-reference/notifications/list-notification-preferences.md): Retrieve resolved email notification preferences for the authenticated user.
- [Update Notification Preference](https://docs.corgea.app/api-reference/notifications/update-notification-preference.md): Set or reset the authenticated user's email preference for a notification type. Use null to inherit the company default.
- [Update Notification Preference](https://docs.corgea.app/api-reference/notifications/update-notification-preference-1.md): Set or reset the authenticated user's email preference for a notification type. Use null to inherit the company default.
- [List Company Notification Defaults](https://docs.corgea.app/api-reference/notifications/list-company-notification-defaults.md): Retrieve company-level email and webhook defaults for active notification types. Company admin access is required.
- [Update Company Notification Default](https://docs.corgea.app/api-reference/notifications/update-company-notification-default.md): Partially update company-level email or webhook defaults for a notification type. Use null to inherit the platform default. Company admin access is required.
- [Update Company Notification Default](https://docs.corgea.app/api-reference/notifications/update-company-notification-default-1.md): Partially update company-level email or webhook defaults for a notification type. Use null to inherit the platform default. Company admin access is required.

### Teams

- [List teams](https://docs.corgea.app/api-reference/teams/list-teams.md): Lists active teams for the authenticated user's company. Requires the `user_management.change_content_access` permission.
- [Create a team](https://docs.corgea.app/api-reference/teams/create-a-team.md): Creates a team and optionally assigns members, explicit projects, project-tag selectors, and repository URL fragment selectors. Requires the `user_management.change_content_access` permission.
- [Get a team](https://docs.corgea.app/api-reference/teams/get-a-team.md): Retrieves an active team for the authenticated user's company.
- [Delete a team](https://docs.corgea.app/api-reference/teams/delete-a-team.md): Permanently deletes a team. Requires the `user_management.change_content_access` permission.
- [Update a team](https://docs.corgea.app/api-reference/teams/update-a-team.md): Updates any supplied team fields. Selector lists replace their current values; omit a field to leave it unchanged. Requires the `user_management.change_content_access` permission.
- [Add team members](https://docs.corgea.app/api-reference/teams/add-team-members.md)
- [Remove team members](https://docs.corgea.app/api-reference/teams/remove-team-members.md): Removes the supplied users from the team. Company administrators cannot be removed.
- [List projects accessible to a team](https://docs.corgea.app/api-reference/teams/list-projects-accessible-to-a-team.md): Resolves projects granted through explicit assignment, project tags, or repository URL fragments. Use `sources` to see every matching access path.

### Harness integrations

- [List Harness integrations](https://docs.corgea.app/api-reference/harness-integrations/list-harness-integrations.md): Lists Harness Code SCM integrations for your company. Requires the `integrations.view_integration` permission.
- [Create a Harness integration](https://docs.corgea.app/api-reference/harness-integrations/create-a-harness-integration.md): Creates a Harness Code SCM integration after verifying its PAT or Service Account Token. Requires the `integrations.manage_integration` permission. An account can have multiple integrations when each uses a different organization allowlist.
- [Get a Harness integration](https://docs.corgea.app/api-reference/harness-integrations/get-a-harness-integration.md): Retrieves a Harness Code SCM integration for your company. Requires the `integrations.view_integration` permission.
- [Delete a Harness integration](https://docs.corgea.app/api-reference/harness-integrations/delete-a-harness-integration.md): Deletes a Harness Code SCM integration and attempts to remove its registered webhooks. Requires the `integrations.manage_integration` permission.
- [Update a Harness integration](https://docs.corgea.app/api-reference/harness-integrations/update-a-harness-integration.md): Updates selected fields. Changing the token, base URL, or gateway prefix re-verifies the credentials. A replacement token must belong to the existing Harness account. Requires the `integrations.manage_integration` permission.

## OpenAPI Specs

- [openapi](/api-reference/openapi.json)

## Optional

- [Service Status](https://status.corgea.app/)
- [Blog](https://corgea.com/blog)

> The links below point to documentation indexes. Follow each `/_llms/` index recursively until you reach documentation pages.

## Indexes

- [German (112 pages)](https://docs.corgea.app/_llms/de.md): Documentation for German.
- [French (112 pages)](https://docs.corgea.app/_llms/fr.md): Documentation for French.
- [Spanish (112 pages)](https://docs.corgea.app/_llms/es.md): Documentation for Spanish.
- [Japanese (112 pages)](https://docs.corgea.app/_llms/ja.md): Documentation for Japanese.