OpenAPI.yml

openapi: 3.0.3
info:
  title: APTRS
  description: >-
    APTRS (Automated Penetration Testing Reporting System) is a Python and
    Django-based automated reporting tool designed for penetration testers and
    security organizations. This tool streamlines the report generation process
    by enabling users to create PDF and Excel reports directly, eliminating the
    need for manual approaches. Additionally, APTRS offers a systematic way to
    monitor and manage vulnerabilities within various projects. Keep your
    penetration testing projects organized and efficient with APTRS.
  version: 1.0.1
  contact: {}
servers:
  - url: https://live.aptrs.com
    description: Local Hosted Server 
  - url: https://live.aptrs.com
    description: APTRS Demo Server
paths:
  /api/auth/user/1:
    get:
      tags:
        - Account
        - Admin
      summary: Get User
      description: Get User
      operationId: getUser
      responses:
        '200':
          description: ''
  /api/auth/adduser:
    post:
      tags:
        - Account
        - Admin
      summary: Add User
      description: >-
        ### Endpoint Description: Add New User (Admin Only API)


        This API endpoint allows you to add a new user to the system. It is an
        HTTP POST request to the `{{domainname}}/api/auth/adduser` URL.


        #### Request Method


        - **Method:** POST

        - **Endpoint:** `{{domainname}}/api/auth/adduser`
            

        #### Request Parameters


        ``` json

        {
            "first_name": "user1",
            "last_name": "user1",
            "company": "helloworld",
            "number":"+911123334567",
            "is_superuser": false,
            "is_active": true,
            "username": "user1",
            "email": "user1@anof.com",
            "password": "user1"
        }

         ```

        - `username` (string): The username of the new user.

        - `email` (string): The email address of the new user.

        - `first_name` (string): The first name of the new user.

        - `last_name` (string): The last name of the new user.

        - `is_superuser` (boolean): Indicates whether the new user is a
        superuser or not.

        - `is_active` (boolean): Indicates whether the new user is active or
        not.

        - `number` (string): The contact number of the new user.

        - `company` (string): The company name of the new user.

        - `username` (string): The unique username of the new user.
            

        #### Note


        The API is only for Admin User


        #### Example Response


        The response to this request will have a status code of 200 if the user
        was successfully added. The response body will include the following
        parameters:


        ``` json

        {
            "id": 5,
            "username": "1user1",
            "email": "1user1@anof.com",
            "first_name": "user1",
            "last_name": "user1",
            "is_superuser": false,
            "is_active": true,
            "profile": {
                "id": 4,
                "profilepic": "http://aptrsapi.souravkalal.tech/media/profile/avatar-1.svg",
                "number": "+911613334567",
                "company": "AnoF PVT LTD",
                "user": 5
            },
            "message": "User object created successfully.",
            "status": "true"
        }

        ```


        - `id` (integer): The ID of the newly created user.

        - `username` (string): The username of the newly created user.

        - `email` (string): The email address of the newly created user.

        - `first_name` (string): The first name of the newly created user.

        - `last_name` (string): The last name of the newly created user.

        - `is_superuser` (boolean): Indicates whether the newly created user is
        a superuser or not.

        - `is_active` (boolean): Indicates whether the newly created user is
        active or not.

        - `profile` (object): An object containing additional profile
        information for the newly created user.
            - `id` (integer): The ID of the profile.
            - `profilepic` (string): The profile picture of the newly created user.
            - `number` (string): The contact number of the newly created user.
            - `company` (string): The company name of the newly created user.
        - `message` (string): A message indicating the status of the request.

        - `status` (string): The status of the request.
            

        Please note that the values provided in the response example are
        placeholders and may not reflect the actual values returned by the API.


        The response will have a status code of 400 if there are any errors in
        the request. The response body will provide details about the errors,
        including specific error messages for each parameter.


        For example, if the `username` and `email` parameters are missing or
        empty, the response will be:


        ``` json

        {
            "username": ["This field is required."],
            "email": ["This field is required."]
        }

         ```
      operationId: addUser
      requestBody:
        content:
          text/plain:
            example: "{\r\n    \"full_name\": \"normal user\", \r\n    \"username\": \"normaluser\",\r\n    \"email\": \"normaluser@anof.com\",\r\n    \"is_active\":false,\r\n    \"number\":\"+911622445522\",\r\n    \"is_superuser\": false,\r\n    \"position\":\"Security Engineer\", // text field\r\n    \"password\": \"Admin@12345\",\r\n    \"groups\":[\r\n            \"Manangers\"   // Multiple Groups can be selected\r\n        ]\r\n}"
      responses:
        '200':
          description: ''
  /api/auth/edituser/73:
    post:
      tags:
        - Account
        - Admin
      summary: Edit User
      description: Edit User
      operationId: editUser
      requestBody:
        content:
          text/plain:
            example: "{\r\n    \"full_name\": \"Sourav Kalal\",\r\n    \"username\": \"admin\",\r\n    \"email\": \"admin@anof.com\",\r\n    \"is_active\":true,\r\n    \"number\":\"+911122445522\",\r\n    \"is_superuser\": false,\r\n    \"position\":\"Security Engineer\",\r\n    \"password\": \"admin\", // Optional\r\n    \"groups\":[\r\n            \"User Level Group\"   // Multiple Groups can be selected\r\n        ]\r\n}"
      responses:
        '200':
          description: ''
  /api/auth/deleteuser:
    delete:
      tags:
        - Account
        - Admin
      summary: Delete User
      description: Delete User
      operationId: deleteUser
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                type: number
                example: 73
              example:
                - 73
            example:
              - 73
      responses:
        '200':
          description: ''
  /api/auth/groups/create/:
    post:
      tags:
        - Account
        - Admin
      summary: Create Permission Group
      description: Create Permission Group
      operationId: createPermissionGroup
      requestBody:
        content:
          text/plain:
            example: "{\r\n    \"name\": \"Manager Groups\",\r\n    \"description\": \"Permission for Managers\",\r\n    \"list_of_permissions\": [  //multiple permissions can be selected\r\n        \"Change Password\",\r\n        \"Create Project\"\r\n    ]\r\n}"
      responses:
        '200':
          description: ''
  /api/auth/groups/update/4/:
    post:
      tags:
        - Account
        - Admin
      summary: Edit Permission Group
      description: Edit Permission Group
      operationId: editPermissionGroup
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                description:
                  type: string
                  example: Permission for Managers
                list_of_permissions:
                  type: array
                  items:
                    type: string
                    example: Change Password
                  example:
                    - Change Password
                    - Create Project
                name:
                  type: string
                  example: Managers
            example:
              description: Permission for Managers
              list_of_permissions:
                - Change Password
                - Create Project
              name: Managers
      responses:
        '200':
          description: ''
  /api/auth/groups/delete:
    delete:
      tags:
        - Account
        - Admin
      summary: Delete Group
      description: Delete Group
      operationId: deleteGroup
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                type: number
                example: 10
              example:
                - 10
                - 11
                - 12
            example:
              - 10
              - 11
              - 12
      responses:
        '200':
          description: ''
  /api/auth/list/permission/:
    get:
      tags:
        - Account
        - Admin
      summary: List Available Permissions
      description: List Available Permissions
      operationId: listAvailablePermissions
      responses:
        '200':
          description: ''
  /api/auth/groups/list/:
    get:
      tags:
        - Account
        - Admin
      summary: List All Permission Group
      description: List All Permission Group
      operationId: listAllPermissionGroup
      responses:
        '200':
          description: ''
  /api/auth/login/:
    post:
      tags:
        - Account
      summary: Login
      description: >-
        ### Endpoint Description: User Authentication


        #### Endpoint


        This API endpoint is used to authenticate a user and obtain access and
        refresh tokens for further API calls. Send a POST request to
        `{{domainname}}/api/auth/login/` with the required credentials.


        #### Request Method


        - **Method:** POST

        - **Endpoint:** `{{domainname}}/api/auth/login/`
            

        #### Request Body


        ``` json

        {

        "email": "admin@anof.com",

        "password": "admin"

        }

         ```

        ### Response


        The response will include the following information:


        ``` json

        {

        "refresh":
        "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbl90eXBlIjoicmVmcmVzaCIsImV4cCI6MTcwMzg2Mzc5NSwiaWF0IjoxNzAyNTY3Nzk1LCJqdGkiOiJhOGE0Y2I5MTZjMTk0ZmUyYmY3NWUxN2I5MDQxZmQ4NSIsInVzZXJfaWQiOjd9.elLzk-U5A_xqte3V2HfrzPkExeJaUX1Xj5WdVJWb_24",

        "access":
        "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbl90eXBlIjoiYWNjZXNzIiwiZXhwIjoxNzA1MTU5Nzk1LCJpYXQiOjE3MDI1Njc3OTUsImp0aSI6IjJkYTgyMTdhODc1YjQ0M2U4NjE2ZWI2NjY3ZWY5MWMzIiwidXNlcl9pZCI6N30.C4kOCx0B4FDrVAEvHreAnv9R7nQ5gSH33FLeWpUKSsU",

        "Status": "True",

        "username": "admin",

        "Pic": "/media/profile/avatar-1.svg",

        "isAdmin": true,

        "permissions": [

        "Create Project",

        "Delete Images",

        "Add Retest for Projects",

        "Change Password",

        ....

        ]

        }

         ```

        - `refresh`: A refresh token that can be used to obtain a new access
        token when it expires.

        - `access`: An access token that should be included in the headers of
        subsequent requests to authorize the user.

        - `Status`: The status of the authentication process.

        - `username`: The username of the authenticated user.

        - `Pic`: The profile picture of the authenticated user.

        - `isAdmin`: A boolean value indicating whether the authenticated user
        has admin privileges.

        - permissions - List of permissions users have. Each user could have
        different sets of permissions.
            

        > _**NOTE:**_ Admin user is not restricted with permission. The admin
        user is not part of the permission group and has all access irrespective
        of what permissions are assigned.
      operationId: login
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                email:
                  type: string
                  example: sourav.kalal@aptrs.com
                password:
                  type: string
                  example: I-am-Weak-Password-Please-Change-Me
            example:
              email: sourav.kalal@aptrs.com
              password: I-am-Weak-Password-Please-Change-Me
      responses:
        '200':
          description: ''
  /api/auth/token/refresh/:
    post:
      tags:
        - Account
      summary: Refresh Token
      description: >
        ### Endpoint Description: User Refresh Token


        #### Endpoint


        This endpoint allows the user to refresh the access token. Send a POST
        request to `{{domainname}}/api/auth/token/refresh/` with the required
        credentials.




        #### Request Method


        - **Method:** POST

        - **Endpoint:** `{{domainname}}/api/auth/token/refresh/`



        #### Request Body


        ``` json

        {

        "refresh":
        "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbl90eXBlIjoicmVmcmVzaCIsImV4cCI6MTcwMzQxMjYxNCwiaWF0IjoxNzAyMTE2NjE0LCJqdGkiOiJlNzQyZDFjMTQxZWI0OGQwYjlkOTg5NzViZWE1OGM3ZCIsInVzZXJfaWQiOjF9.MKSr0X-x2m6HZoZUQ4qBhOZVPUiBoC9vP8z9c4-91zw"

        }


        ```


        ### Response


        The response will include the following information:


        ``` json

        {

        "access":
        "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbl90eXBlIjoiYWNjZXNzIiwiZXhwIjoxNzA1MTYwMjgyLCJpYXQiOjE3MDIxMTY2MTQsImp0aSI6IjZjY2I4YTY1MmYzNjRkN2Q4NzIxOWVmZGE2NTdiYzUwIiwidXNlcl9pZCI6MX0.UI-4vmDQYIPs1YObzxmeXh-QgqqFSkxGkRDAAwZWbwE",

        "refresh":
        "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbl90eXBlIjoicmVmcmVzaCIsImV4cCI6MTcwMzg2NDI4MiwiaWF0IjoxNzAyNTY4MjgyLCJqdGkiOiIyOGViZWQ2OGZlYmE0YjZmYjg5ODM5ZjVhMmFkZDczYiIsInVzZXJfaWQiOjF9.LrYKjte1KUszcEq7Bd5742BUzP3ECT7S659GEqn-uzE"

        }


        ```


        - `refresh`: An updated refresh token that can be used to obtain a new
        access token when it expires.

        - `access`: An updated access token that should be included in the
        headers of subsequent requests to authorize the user.
      operationId: refreshToken
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                refresh:
                  type: string
                  example: '{{refreshToken}}'
            example:
              refresh: '{{refreshToken}}'
      responses:
        '200':
          description: ''
  /api/auth/users:
    get:
      tags:
        - Account
      summary: Get All User
      description: >+
        ### Endpoint Description: Retrieve All Users


        #### Endpoint


        This API endpoint allows you to retrieve a list of users from the
        server. Send a POST request to `{{domainname}}/api/auth/users` with the
        required credentials.




        #### Request Method


        - **Method:** GET

        - **Endpoint:** `{{domainname}}/api/auth/users`




        ### Response


        The response will include the following information:


        ``` json

        [

        {

        "id": 1,

        "username": "sourav",

        "full_name": "Sourav Kalal",

        "email": "admin2@anof.com",

        "is_staff": true,

        "is_active": true,

        "is_superuser": true,

        "profilepic": "/media/profile/avatar-1.svg",

        "number": "+911122345522",

        "company": "AnoF PVT LTD",

        "position": "Security Engineer",

        "groups": [

        "User Permission Group",

        "Manager Permission Group"

        ]

        },

        {

        "id": 7,

        "username": "admin",

        "full_name": "Sourav Kalal",

        "email": "admin@anof.com",

        "is_staff": true,

        "is_active": true,

        "is_superuser": true,

        "profilepic": "/media/profile/avatar-1.svg",

        "number": "+911122445522",

        "company": "AnoF PVT LTD",

        "position": "Security Engineer",

        "groups": [

        "User Permission Group"

        ]

        }

        ]


        ```

      operationId: getAllUser
      responses:
        '200':
          description: ''
  /api/auth/users/filter:
    get:
      tags:
        - Account
      summary: Get All User Filter
      description: Get All User Filter
      operationId: getAllUserFilter
      parameters:
        - name: username
          in: query
          schema:
            type: string
            example: ''
        - name: full_name
          in: query
          schema:
            type: string
            example: ''
        - name: email
          in: query
          schema:
            type: string
            example: ''
        - name: position
          in: query
          schema:
            type: string
            example: ''
        - name: is_active
          in: query
          schema:
            type: string
            example: ''
        - name: limit
          in: query
          schema:
            type: string
            example: '5'
          description: upto 50
        - name: offset
          in: query
          schema:
            type: string
            example: '0'
        - name: sort
          in: query
          schema:
            type: string
            example: full_name
        - name: order_by
          in: query
          schema:
            type: string
            example: desc
      responses:
        '200':
          description: ''
  /api/auth/myprofile:
    get:
      tags:
        - Account
      summary: Profile
      description: >-
        This API endpoint allows users to retrieve their own profile
        information. It is an HTTP GET request to
        `{{domainname}}/api/auth/myprofile`.


        ### Request


        The request does not require any parameters or headers. This request
        allows users to retrieve their own profile information.


        ### Response


        The response will have a status code of 200 if the request is
        successful. The response body will contain the following information:


        ``` json

        {
            "id": 1,
            "username": "admin",
            "email": "admin1@example.com",
            "first_name": "Sourav",
            "last_name": "Kalal",
            "is_superuser": true,
            "profile": {
                "id": 1,
                "profilepic": "/media/profile/avatar-1.svg",
                "number": "+911234564674",
                "company": "Example Inc.",
                "user": 1
            }
        }

         ```

        - `id` (integer): The unique identifier of the user.

        - `username` (string): The username of the user.

        - `email` (string): The email address of the user.

        - `first_name` (string): The first name of the user.

        - `last_name` (string): The last name of the user.

        - `is_superuser` (boolean): Indicates whether the user has superuser
        privileges.

        - `profile` (object): An object containing additional profile
        information.
            - `id` (integer): The unique identifier of the profile.
            - `profilepic` (string): The URL of the user's profile picture.
            - `number` (string): The contact number of the user.
            - `company` (string): The name of the company associated with the user.
            - `user` (integer): The ID of the user associated with the profile.

        Please note that the response may contain empty or default values for
        some fields if the user has not provided the information.
      operationId: profile
      responses:
        '200':
          description: ''
  /api/auth/editprofile:
    post:
      tags:
        - Account
      summary: Edit Profile
      description: >-
        ### Endpoint Description: Edit User Profile


        #### Endpoint


        This API endpoint allows users to edit their profile information. It is
        an HTTP POST request that should be sent to
        `{{domainname}}/api/auth/editprofile`.


        #### Request Method


        - **Method:** POST

        - **Endpoint:** `{{domainname}}/api/auth/editprofile`
            

        #### Request Parameters


        - `id` (integer): The unique identifier of the user.

        - `username` (string): The username of the user.

        - `email` (string): The email address of the user.

        - `first_name` (string): The first name of the user.

        - `last_name` (string): The last name of the user.

        - `is_superuser` (boolean): Indicates whether the user is a superuser or
        not.

        - `profile` (object): An object containing additional profile
        information.
            - `id` (integer): The unique identifier of the profile.
            - `profilepic` (string): The URL of the user's profile picture.
            - `number` (string): The contact number of the user.
            - `company` (string): The company name of the user.
            - `user` (integer): The user ID associated with the profile.

        #### Note


        Please send this request using form data, not JSON. Additionally, ensure
        to include the necessary information to update the desired profile
        fields.


        #### Response


        The response to this request will have a status code of `200`,
        indicating a successful operation. The response body will contain the
        updated profile information of the user.


        #### Example Response


        ``` json

        {
            "id": 1,
            "username": "admin",
            "email": "admin@aptrs.com",
            "first_name": "sourav11",
            "last_name": "kalal",
            "is_superuser": true,
            "profile": {
                "id": 1,
                "profilepic": "http://aptrsapi.souravkalal.tech/media/profile/avatar-1.svg",
                "number": "+911234567891",
                "company": "AnoF PVT LTD",
                "user": 1
            }
        }

         ```
      operationId: editProfile
      requestBody:
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                company:
                  type: string
                  example: test
                email:
                  description: // read only cannot be edited
                  type: string
                  example: admin@aptrs.com
                full_name:
                  type: string
                  example: user person
                is_superuser:
                  type: string
                  example: 'true'
                number:
                  type: string
                  example: '+911234567891'
                profilepic:
                  description: Optional
                  type: string
                  format: binary
                username:
                  type: string
                  example: admin
      responses:
        '200':
          description: ''
  /api/auth/changepassword:
    post:
      tags:
        - Account
      summary: Change Password
      description: >-
        ### Endpoint Description: Change Password


        This API endpoint is used to change the password of a user. It is an
        HTTP POST request that should be sent to
        `{{domainname}}/api/auth/changepassword`.


        #### Request Method


        - **Method:** POST

        - **Endpoint:** `{{domainname}}/api/auth/changepassword`
            

        #### Request Parameters


        - `old_password` (string): The current password of the user.

        - `new_password` (string): The new password to be set.
            

        ``` json

        {
            "newpassword": "admin",
            "oldpassword": "admin"
        }

         ```

        ### Response


        In case of a successful password change, the API will return a response
        with a status code of `200` and a message in the following format:


        ``` json

        {
            "message": "Password updated."
        }

         ```

        If there is an error in the request, the API will respond with a status
        code of `400` and an error message in the following format:


        ``` json

        {
          "non_field_errors": [""]
        }

         ```

        Please note that the error message may contain additional information if
        there are specific errors related to the request parameters.
      operationId: changePassword
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                newpassword:
                  type: string
                  example: PE#5GZ29PTZMSE
                oldpassword:
                  type: string
                  example: PE#5GZ29PTZMSE
            example:
              newpassword: PE#5GZ29PTZMSE
              oldpassword: PE#5GZ29PTZMSE
      responses:
        '200':
          description: ''
  /api/auth/users-active:
    get:
      tags:
        - Account
      summary: Get All Active User
      description: Get All Active User
      operationId: getAllActiveUser
      responses:
        '200':
          description: ''
  /api/auth/logout/:
    post:
      tags:
        - Account
      summary: Logout
      description: Logout
      operationId: logout
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                refresh_token:
                  type: string
                  example: '{{refreshToken}}'
            example:
              refresh_token: '{{refreshToken}}'
      responses:
        '200':
          description: ''
  /api/project/get-projects/:
    get:
      tags:
        - Project
        - Project1
      summary: All Project
      description: All Project
      operationId: allProject
      responses:
        '200':
          description: ''
  /api/project/projects/filter:
    get:
      tags:
        - Project
        - Project1
      summary: Get Project with Filters and Pagination
      description: Get Project with Filters and Pagination
      operationId: getProjectWithFiltersAndPagination
      parameters:
        - name: name
          in: query
          schema:
            type: string
            example: ''
        - name: companyname
          in: query
          schema:
            type: string
            example: ''
        - name: projecttype
          in: query
          schema:
            type: string
            example: ''
        - name: testingtype
          in: query
          schema:
            type: string
            example: ''
        - name: owner
          in: query
          schema:
            type: string
            example: ''
        - name: status
          in: query
          schema:
            type: string
            example: ''
        - name: startdate
          in: query
          schema:
            type: string
            example: ''
          description: 'full date or any number '
        - name: enddate_before
          in: query
          schema:
            type: string
            example: ''
          description: 'full date or any number '
        - name: limit
          in: query
          schema:
            type: string
            example: '7'
        - name: offset
          in: query
          schema:
            type: string
            example: '0'
        - name: order_by
          in: query
          schema:
            type: string
            example: asc
          description: desc/asc
        - name: sort
          in: query
          schema:
            type: string
            example: owner
      responses:
        '200':
          description: ''
  /api/project/my-projects/:
    get:
      tags:
        - Project
        - Project1
      summary: My Projects
      description: My Projects
      operationId: myProjects
      responses:
        '200':
          description: ''
  /api/project/get-project/1/:
    get:
      tags:
        - Project
        - Project1
      summary: Get Project
      description: Get Project
      operationId: getProject
      responses:
        '200':
          description: ''
  /api/project/add-project/:
    post:
      tags:
        - Project
        - Project1
      summary: New Project
      description: New Project
      operationId: newProject
      requestBody:
        content:
          text/plain:
            example: "{\r\n\t\"name\": \"Juice Shop2\",\r\n\t\"description\": \"The project is about Juice Shop application security assessment. The project involves finding security vulnerabilities in the application\",\r\n\t\"projecttype\": \"Web Application Penetration Testing\",\r\n\t\"startdate\": \"2024-10-26\",\r\n\t\"enddate\": \"2024-10-31\",\r\n\t\"companyname\": \"APTRS PVT\",\r\n\t\"testingtype\": \"Black Box\",\r\n\t\"projectexception\": \"\",\r\n\t\"owner\": [\r\n\t\t\"Sourav.Kalal\"\r\n\t] // only admin user can select owner\r\n}"
      responses:
        '200':
          description: ''
  /api/project/edit-project/7/:
    post:
      tags:
        - Project
        - Project1
      summary: Edit Project
      description: Edit Project
      operationId: editProject
      parameters:
        - name: Host
          in: header
          schema:
            type: string
            example: 127.0.0.1:8000
        - name: Content-Length
          in: header
          schema:
            type: string
            example: '355'
        - name: X-CSRFToken
          in: header
          schema:
            type: string
            example: t5s177WKrB9G67Z5piltnC7zceuVkVh69wGRAyTnbYo6FwJ9J3KJCadckaZKyGBH
        - name: Origin
          in: header
          schema:
            type: string
            example: ggg
        - name: Connection
          in: header
          schema:
            type: string
            example: close
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                companyname:
                  type: string
                  example: OWASP
                description:
                  type: string
                  example: >-
                    The project is about Juice Shop application security
                    assessment. The project involves finding security
                    vulnerabilities in the application
                enddate:
                  type: string
                  example: '2024-10-31'
                name:
                  type: string
                  example: Juice Shop
                owner:
                  type: array
                  items:
                    type: string
                    example: admin
                  example:
                    - admin
                projectexception:
                  type: string
                  example: ''
                projecttype:
                  type: string
                  example: Web Application Penetration Testing
                startdate:
                  type: string
                  example: '2022-10-26'
                testingtype:
                  type: string
                  example: Black Box
            example:
              companyname: OWASP
              description: >-
                The project is about Juice Shop application security assessment.
                The project involves finding security vulnerabilities in the
                application
              enddate: '2024-10-31'
              name: Juice Shop
              owner:
                - admin
              projectexception: ''
              projecttype: Web Application Penetration Testing
              startdate: '2022-10-26'
              testingtype: Black Box
      responses:
        '200':
          description: ''
  /api/project/delete-project/:
    delete:
      tags:
        - Project
        - Project1
      summary: Delete Projects
      description: Delete Projects
      operationId: deleteProjects
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                type: number
                example: 25
              example:
                - 25
                - 26
                - 27
                - 28
                - 29
                - 30
                - 31
                - 32
                - 33
                - 34
                - 35
                - 36
                - 37
                - 40
                - 41
            example:
              - 25
              - 26
              - 27
              - 28
              - 29
              - 30
              - 31
              - 32
              - 33
              - 34
              - 35
              - 36
              - 37
              - 40
              - 41
      responses:
        '200':
          description: ''
  /api/project/status/completed/1/:
    get:
      tags:
        - Project
        - Project1
      summary: Mark Project as Completed
      description: Mark Project as Completed
      operationId: markProjectAsCompleted
      responses:
        '200':
          description: ''
  /api/project/reopen/completed/1/:
    get:
      tags:
        - Project
        - Project1
      summary: ReOepn Project
      description: ReOepn Project
      operationId: reoepnProject
      responses:
        '200':
          description: ''
  /api/project/edit-owner/:
    post:
      tags:
        - Project
        - Project1
      summary: Update Project Owner
      description: Update Project Owner
      operationId: updateProjectOwner
      requestBody:
        content:
          text/plain:
            example: "{\r\n    \"id\": 1, //project-id\r\n    \"owner\": [\r\n        \"Sourav.Kalal\"\r\n    ]\r\n}"
      responses:
        '200':
          description: ''
  /api/project/findings/1/:
    get:
      tags:
        - Project
        - Vulnerability
      summary: Get Project Findings
      description: Get Project Findings
      operationId: getProjectFindings
      responses:
        '200':
          description: ''
  /api/project/vulnerability/115/:
    get:
      tags:
        - Project
        - Vulnerability
      summary: Get Vulnerability
      description: Get Vulnerability
      operationId: getVulnerability
      responses:
        '200':
          description: ''
  /api/project/vulnerability/instances/filter/14/:
    get:
      tags:
        - Project
        - Vulnerability
      summary: Get Vulnerability Instances Filter and Pagination
      description: Get Vulnerability Instances Filter and Pagination
      operationId: getVulnerabilityInstancesFilterAndPagination
      parameters:
        - name: URL
          in: query
          schema:
            type: string
            example: ''
        - name: Parameter
          in: query
          schema:
            type: string
            example: ''
        - name: status
          in: query
          schema:
            type: string
            example: ''
        - name: limit
          in: query
          schema:
            type: string
            example: '20'
        - name: offset
          in: query
          schema:
            type: string
            example: '0'
        - name: order_by
          in: query
          schema:
            type: string
            example: asc
          description: asc/desc
        - name: sort
          in: query
          schema:
            type: string
            example: id
      responses:
        '200':
          description: ''
  /api/project/vulnerability/add/vulnerability/:
    post:
      tags:
        - Project
        - Vulnerability
      summary: Add Vulnerability with Instance
      description: Add Vulnerability with Instance
      operationId: addVulnerabilityWithInstance
      requestBody:
        content:
          text/plain:
            example: "{\r\n    \"vulnerabilityname\": \"XXE\",\r\n    \"vulnerabilityseverity\": \"None\",\r\n    \"cvssscore\": 0.0,\r\n    \"cvssvector\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N\",\r\n    \"status\": \"Accepted Risk\",\r\n    \"vulnerabilitydescription\": \"<p>Information disclosure, also known as information leakage, is when a website unintentionally reveals sensitive information to its users. Depending on the context, websites may leak all kinds of information to a potential attacker, including:</p>\\\\n\\\\n<ul>\\\\n\\\\t<li>Data about other users, such as usernames or financial information</li>\\\\n\\\\t<li>Sensitive commercial or business data</li>\\\\n\\\\t<li>Technical details about the website and its infrastructure</li>\\\\n</ul>\\\\n\\\\n<p>The dangers of leaking sensitive user or business data are fairly obvious, but disclosing technical information can sometimes be just as serious. Although some of this information will be of limited use, it can potentially be a starting point for exposing an additional attack surface, which may contain other interesting vulnerabilities. The knowledge that you can gather could even provide the missing piece of the puzzle when trying to construct complex, high-severity attacks.</p>\",\r\n    \"POC\": \"test\",\r\n    \"vulnerabilitysolution\": \"<p>Preventing information disclosure completely is tricky due to the huge variety of ways in which it can occur. However, there are some general best practices that you can follow to minimize the risk of athese kinds of vulnerability creeping into your own websites.</p>\\\\n\\\\n<ul>\\\\n\\\\t<li>Make sure that everyone involved in producing the website is fully aware of what information is considered sensitive. Sometimes seemingly harmless information can be much more useful to an attacker than people realize. Highlighting these dangers can help make sure that sensitive information is handled more securely in general by your organization.</li>\\\\n\\\\t<li>Audit any code for potential information disclosure as part of your QA or build processes. It should be relatively easy to automate some of the associated tasks, such as stripping developer comments.</li>\\\\n\\\\t<li>Use generic error messages as much as possible.</li>\",\r\n    \"vulnerabilityreferlnk\":\"Another Ckedior\",\r\n    \"cwe\": [\r\n        \"CWE-564: SQL Injection: Hibernate\",\r\n        \"CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"\r\n    ],\r\n    \"project\": 1,\r\n    \"instance\": [\r\n        {\r\n            \"URL\": \"http://xss.com/#/search\",\r\n            \"Parameter\": \"\",\r\n            \"status\": \"Confirm Fixed\" //STATUS_CHOICES = [Vulnerable,Confirm Fixed, Accepted Risk]\r\n        },\r\n        {\r\n            \"URL\": \"http://10.10.14.68/ftp/coupons_2013.md.bak\",\r\n            \"Parameter\": \"\",\r\n            \"status\": \"Accepted Risk\"\r\n        }\r\n    ]\r\n}"
      responses:
        '200':
          description: ''
  /api/project/vulnerability/edit/3/:
    post:
      tags:
        - Project
        - Vulnerability
      summary: Project Edit Vulnerability
      description: Project Edit Vulnerability
      operationId: projectEditVulnerability
      parameters:
        - name: Host
          in: header
          schema:
            type: string
            example: 127.0.0.1:8000
        - name: X-CSRFToken
          in: header
          schema:
            type: string
            example: HzsA4lG3P8q6q8Le3sS76eKYWacuJzAHn0GqxMDGzvFwZxvindhnlMQB46HjXkUi
        - name: Accept-Encoding
          in: header
          schema:
            type: string
            example: gzip, deflate
        - name: Content-Length
          in: header
          schema:
            type: string
            example: '1626'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                POC:
                  type: string
                  example: "<ul>\r\n\t<li>As can be seen, the application discloses the internal data.</li>\r\n</ul>\r\n\r\n<p><img alt=\"\" height=\"500\" src=\"/media/uploads//ftp.png\" width=\"500\" /></p>"
                created:
                  type: string
                  example: '2024-01-09T13:44:28.406759Z'
                cvssscore:
                  type: number
                  example: 8.2
                cvssvector:
                  type: string
                  example: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
                cwe:
                  type: array
                  items:
                    type: string
                    example: 'CWE-564: SQL Injection: Hibernate'
                  example:
                    - 'CWE-564: SQL Injection: Hibernate'
                    - >-
                      CWE-89: Improper Neutralization of Special Elements used
                      in an SQL Command ('SQL Injection')
                project:
                  type: number
                  example: 1
                status:
                  type: string
                  example: Vulnerable
                vulnerabilitydescription:
                  type: string
                  example: "<p>Information disclosure, also known as information leakage, is when a website unintentionally reveals sensitive information to its users. Depending on the context, websites may leak all kinds of information to a potential attacker, including:</p>\r\n\r\n<ul>\r\n\t<li>Data about other users, such as usernames or financial information</li>\r\n\t<li>Sensitive commercial or business data</li>\r\n\t<li>Technical details about the website and its infrastructure</li>\r\n</ul>\r\n\r\n<p>The dangers of leaking sensitive user or business data are fairly obvious, but disclosing technical information can sometimes be just as serious. Although some of this information will be of limited use, it can potentially be a starting point for exposing an additional attack surface, which may contain other interesting vulnerabilities. The knowledge that you are able to gather could even provide the missing piece of the puzzle when trying to construct complex, high-severity attacks.</p>"
                vulnerabilityname:
                  type: string
                  example: Sensitive Data Exposure
                vulnerabilityreferlnk:
                  type: string
                  example: "<ul>\r\n\t<li><a href=\"https://portswigger.net/web-security/information-disclosure\">PortSwigger</a></li>\r\n</ul>"
                vulnerabilityseverity:
                  type: string
                  example: High
                vulnerabilitysolution:
                  type: string
                  example: "<p>Preventing information disclosure completely is tricky due to the huge variety of ways in which it can occur. However, there are some general best practices that you can follow to minimize the risk of these kinds of vulnerability creeping into your own websites.</p>\r\n\r\n<ul>\r\n\t<li>Make sure that everyone involved in producing the website is fully aware of what information is considered sensitive. Sometimes seemingly harmless information can be much more useful to an attacker than people realize. Highlighting these dangers can help make sure that sensitive information is handled more securely in general by your organization.</li>\r\n\t<li>Audit any code for potential information disclosure as part of your QA or build processes. It should be relatively easy to automate some of the associated tasks, such as stripping developer comments.</li>\r\n\t<li>Use generic error messages as much as possible.</li>\r\n</ul>"
            example:
              POC: "<ul>\r\n\t<li>As can be seen, the application discloses the internal data.</li>\r\n</ul>\r\n\r\n<p><img alt=\"\" height=\"500\" src=\"/media/uploads//ftp.png\" width=\"500\" /></p>"
              created: '2024-01-09T13:44:28.406759Z'
              cvssscore: 8.2
              cvssvector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
              cwe:
                - 'CWE-564: SQL Injection: Hibernate'
                - >-
                  CWE-89: Improper Neutralization of Special Elements used in an
                  SQL Command ('SQL Injection')
              project: 1
              status: Vulnerable
              vulnerabilitydescription: "<p>Information disclosure, also known as information leakage, is when a website unintentionally reveals sensitive information to its users. Depending on the context, websites may leak all kinds of information to a potential attacker, including:</p>\r\n\r\n<ul>\r\n\t<li>Data about other users, such as usernames or financial information</li>\r\n\t<li>Sensitive commercial or business data</li>\r\n\t<li>Technical details about the website and its infrastructure</li>\r\n</ul>\r\n\r\n<p>The dangers of leaking sensitive user or business data are fairly obvious, but disclosing technical information can sometimes be just as serious. Although some of this information will be of limited use, it can potentially be a starting point for exposing an additional attack surface, which may contain other interesting vulnerabilities. The knowledge that you are able to gather could even provide the missing piece of the puzzle when trying to construct complex, high-severity attacks.</p>"
              vulnerabilityname: Sensitive Data Exposure
              vulnerabilityreferlnk: "<ul>\r\n\t<li><a href=\"https://portswigger.net/web-security/information-disclosure\">PortSwigger</a></li>\r\n</ul>"
              vulnerabilityseverity: High
              vulnerabilitysolution: "<p>Preventing information disclosure completely is tricky due to the huge variety of ways in which it can occur. However, there are some general best practices that you can follow to minimize the risk of these kinds of vulnerability creeping into your own websites.</p>\r\n\r\n<ul>\r\n\t<li>Make sure that everyone involved in producing the website is fully aware of what information is considered sensitive. Sometimes seemingly harmless information can be much more useful to an attacker than people realize. Highlighting these dangers can help make sure that sensitive information is handled more securely in general by your organization.</li>\r\n\t<li>Audit any code for potential information disclosure as part of your QA or build processes. It should be relatively easy to automate some of the associated tasks, such as stripping developer comments.</li>\r\n\t<li>Use generic error messages as much as possible.</li>\r\n</ul>"
      responses:
        '200':
          description: ''
  /api/project/vulnerability/add/instances/3/:
    post:
      tags:
        - Project
        - Vulnerability
      summary: Add Vulnerable Instances
      description: Add Vulnerable Instances
      operationId: addVulnerableInstances
      parameters:
        - name: Host
          in: header
          schema:
            type: string
            example: 127.0.0.1:8000
        - name: X-CSRFToken
          in: header
          schema:
            type: string
            example: HzsA4lG3P8q6q8Le3sS76eKYWacuJzAHn0GqxMDGzvFwZxvindhnlMQB46HjXkUi
        - name: Connection
          in: header
          schema:
            type: string
            example: close
        - name: Content-Length
          in: header
          schema:
            type: string
            example: '165'
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                type: object
                properties:
                  Parameter:
                    type: string
                    example: username
                  URL:
                    type: string
                    example: https://google.com
                  status:
                    type: string
                    example: Vulnerable
              example:
                - Parameter: username
                  URL: https://google.com
                  status: Vulnerable
                - Parameter: hellworld
                  URL: google.com
                  status: Vulnerable
            example:
              - Parameter: username
                URL: https://google.com
                status: Vulnerable
              - Parameter: hellworld
                URL: google.com
                status: Vulnerable
      responses:
        '200':
          description: ''
  /api/project/vulnerability/edit/instances/41/:
    post:
      tags:
        - Project
        - Vulnerability
      summary: Edit Vulnerable Instances
      description: Edit Vulnerable Instances
      operationId: editVulnerableInstances
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                Parameter:
                  type: string
                  example: hellworld
                URL:
                  type: string
                  example: googl.com
                status:
                  type: string
                  example: Vulnerable
            example:
              Parameter: hellworld
              URL: googl.com
              status: Vulnerable
      responses:
        '200':
          description: ''
  /api/project/vulnerability/status/instances/:
    post:
      tags:
        - Project
        - Vulnerability
      summary: Vulnerability Instance Status Update
      description: Vulnerability Instance Status Update
      operationId: vulnerabilityInstanceStatusUpdate
      parameters:
        - name: status
          in: query
          schema:
            type: string
            example: Confirm Fixed
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                type: number
                example: 311
              example:
                - 311
                - 312
            example:
              - 311
              - 312
      responses:
        '200':
          description: ''
  /api/project/vulnerability/status/vulnerability/88/:
    get:
      tags:
        - Project
        - Vulnerability
      summary: Vulnerability Status Update
      description: Vulnerability Status Update
      operationId: vulnerabilityStatusUpdate
      parameters:
        - name: status
          in: query
          schema:
            type: string
            example: Vulnerable
      responses:
        '200':
          description: ''
  /api/project/vulnerability/delete/instances/:
    delete:
      tags:
        - Project
        - Vulnerability
      summary: Delete Instances
      description: Delete Instances
      operationId: deleteInstances
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                type: string
                example: '72'
              example:
                - '72'
                - '34'
            example:
              - '72'
              - '34'
      responses:
        '200':
          description: ''
  /api/project/vulnerability/instances/17/:
    get:
      tags:
        - Project
        - Vulnerability
      summary: Get Vulnerability Instances
      description: Get Vulnerability Instances
      operationId: getVulnerabilityInstances
      parameters:
        - name: Host
          in: header
          schema:
            type: string
            example: 127.0.0.1:8000
        - name: Connection
          in: header
          schema:
            type: string
            example: close
      responses:
        '200':
          description: ''
  /api/project/vulnerability/delete/vulnerability/:
    delete:
      tags:
        - Project
        - Vulnerability
      summary: Delete Vulnerability
      description: Delete Vulnerability
      operationId: deleteVulnerability
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                type: string
                example: '11'
              example:
                - '11'
                - '73'
            example:
              - '11'
              - '73'
      responses:
        '200':
          description: ''
  /api/project/vulnerability/Nessus/csv/1/:
    post:
      tags:
        - Project
        - Vulnerability
      summary: Nessus CSV
      description: Nessus CSV
      operationId: nessusCsv
      requestBody:
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                file:
                  type: string
                  format: binary
      responses:
        '200':
          description: ''
  /api/project/ckeditor/imageupload/:
    post:
      tags:
        - Project
        - Vulnerability
      summary: Ckeditor Image Upload
      description: Ckeditor Image Upload
      operationId: ckeditorImageUpload
      requestBody:
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                images:
                  type: string
                  format: binary
                upload:
                  type: string
                  format: binary
      responses:
        '200':
          description: ''
  /api/project/ckeditor/delete-images/:
    delete:
      tags:
        - Project
        - Vulnerability
      summary: Delete Images
      description: Delete Images
      operationId: deleteImages
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                type: string
                example: /media/uploads/ParaForge.png
              example:
                - /media/uploads/ParaForge.png
                - /media/uploads/ParaForge_kJvGvXr.png
            example:
              - /media/uploads/ParaForge.png
              - /media/uploads/ParaForge_kJvGvXr.png
      responses:
        '200':
          description: ''
  /api/project/getimage/:
    get:
      tags:
        - Project
        - Vulnerability
      summary: Get Ckeditor Image
      description: Get Ckeditor Image
      operationId: getCkeditorImage
      parameters:
        - name: filename
          in: query
          schema:
            type: string
            example: 5ee42d78-6be6-4560-8b38-3d1a75f965dd.jpg
      responses:
        '200':
          description: ''
  /api/project/Retest/2/:
    get:
      tags:
        - Project
        - Retest
      summary: Project Retest
      description: Project Retest
      operationId: projectRetest
      parameters:
        - name: Host
          in: header
          schema:
            type: string
            example: 127.0.0.1:8000
      responses:
        '200':
          description: ''
  /api/project/Retest/add:
    post:
      tags:
        - Project
        - Retest
      summary: Add Retest
      description: Add Retest
      operationId: addRetest
      parameters:
        - name: Host
          in: header
          schema:
            type: string
            example: 127.0.0.1:8000
        - name: X-CSRFToken
          in: header
          schema:
            type: string
            example: HzsA4lG3P8q6q8Le3sS76eKYWacuJzAHn0GqxMDGzvFwZxvindhnlMQB46HjXkUi
        - name: Accept-Encoding
          in: header
          schema:
            type: string
            example: gzip, deflate
        - name: Content-Length
          in: header
          schema:
            type: string
            example: '101'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                enddate:
                  type: string
                  example: '2024-08-25'
                owner:
                  type: array
                  items:
                    type: string
                    example: Sourav.Kalal
                  example:
                    - Sourav.Kalal
                project:
                  type: number
                  example: 2
                startdate:
                  type: string
                  example: '2024-08-03'
            example:
              enddate: '2024-08-25'
              owner:
                - Sourav.Kalal
              project: 2
              startdate: '2024-08-03'
      responses:
        '200':
          description: ''
  /api/project/Retest/delete/14/:
    delete:
      tags:
        - Project
        - Retest
      summary: Delete Retest
      description: Delete Retest
      operationId: deleteRetest
      parameters:
        - name: Host
          in: header
          schema:
            type: string
            example: 127.0.0.1:8000
        - name: User-Agent
          in: header
          schema:
            type: string
            example: PostmanRuntime/7.29.2
        - name: Postman-Token
          in: header
          schema:
            type: string
            example: 388999ac-bae0-4258-a085-30c06b1c4c54
        - name: Accept-Encoding
          in: header
          schema:
            type: string
            example: gzip, deflate
        - name: Connection
          in: header
          schema:
            type: string
            example: close
      responses:
        '200':
          description: ''
  /api/project/retest/status/completed/1/:
    get:
      tags:
        - Project
        - Retest
      summary: Mark Retest as Completed
      description: Mark Retest as Completed
      operationId: markRetestAsCompleted
      responses:
        '200':
          description: ''
  /api/project/scope/1/:
    get:
      tags:
        - Project
        - Project Scope
      summary: All Project Scope
      description: All Project Scope
      operationId: allProjectScope
      responses:
        '200':
          description: ''
  /api/project/scope/edit/3/:
    post:
      tags:
        - Project
        - Project Scope
      summary: Edit Project Scope
      description: Edit Project Scope
      operationId: editProjectScope
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                description:
                  type: string
                  example: localnet test1
                scope:
                  type: string
                  example: https://map.google.com
            example:
              description: localnet test1
              scope: https://map.google.com
      responses:
        '200':
          description: ''
  /api/project/scope/add/1/:
    post:
      tags:
        - Project
        - Project Scope
      summary: Add Project Scope
      description: Add Project Scope
      operationId: addProjectScope
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                type: object
                properties:
                  description:
                    type: string
                    example: Google MAp
                  scope:
                    type: string
                    example: https://map.google.com
              example:
                - description: Google MAp
                  scope: https://map.google.com
                - description: Google App
                  scope: google.com
            example:
              - description: Google MAp
                scope: https://map.google.com
              - description: Google App
                scope: google.com
      responses:
        '200':
          description: ''
  /api/project/scope/delete/:
    delete:
      tags:
        - Project
        - Project Scope
      summary: Delete Project Scope
      description: Delete Project Scope
      operationId: deleteProjectScope
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                type: string
                example: '1'
              example:
                - '1'
                - '2'
                - '3'
                - '4'
            example:
              - '1'
              - '2'
              - '3'
              - '4'
      responses:
        '200':
          description: ''
  /api/project/report/1/:
    get:
      tags:
        - Project
        - Report
      summary: GET Report API
      description: GET Report API
      operationId: getReportApi
      parameters:
        - name: Format
          in: query
          schema:
            type: string
            example: pdf
        - name: Type
          in: query
          schema:
            type: string
            example: Re-Audit
        - name: Standard
          in: query
          schema:
            type: string
            example: OWASP%20Top%2010%20web,OWASP%20Top%2010%20API,NIST
      responses:
        '200':
          description: ''
    post:
      tags:
        - Project
        - Report
      summary: Report - API Sunset
      description: Report - API Sunset
      operationId: reportApiSunset
      requestBody:
        content:
          text/plain:
            example: "{\r\n    \"Format\": \"docx\", //pdf,excel,docx\r\n    \"Type\": \"Re-Audit\",\r\n    \"Standard\": [\r\n        \"OWASP Top 10 web\",\r\n        \"OWASP Top 10 API\",\r\n        \"NIST\"\r\n    ]\r\n}"
      responses:
        '200':
          description: ''
  /api/vulndb/filter/:
    get:
      tags:
        - Vulnerability Database
      summary: Search Database
      description: >-
        # API Documentation - Search Vulnerabilities


        ## Endpoint


        `GET /api/vulndb/filter/?search={query}`


        ## Description


        This API endpoint allows you to search for vulnerabilities in the
        vulnerability database.


        ## Authentication


        Include the authentication token in the request headers.


        ## Query Parameter


        - `{query}`: The search query to filter vulnerabilities with
        vulnerability title.
            

        ## Example


        ``` http

        GET /api/vulndb/filter/?search=s

         ```

        ## Response


        The API response will include a list of vulnerabilities that match the
        search query.


        ### Sample Response


        ``` json

        [
          {
            "vulnerabilityname": "Possible XSS"
          },
          {
            "vulnerabilityname": "Stored XSS"
          }
        ]

         ```

        ## Error Handling


        - If the authentication token is missing or invalid, a 401 Unauthorized
        response will be returned.

        - If there are issues with the search process, a 500 Internal Server
        Error response may be returned.

        - If there are validation errors or other issues with the request, a 400
        Bad Request response will be returned.
      operationId: searchDatabase
      parameters:
        - name: search
          in: query
          schema:
            type: string
            example: o
        - name: Host
          in: header
          schema:
            type: string
            example: 127.0.0.1:8000
        - name: Connection
          in: header
          schema:
            type: string
            example: close
      responses:
        '200':
          description: ''
  /api/vulndb/database/:
    get:
      tags:
        - Vulnerability Database
      summary: Get Vulnerability Details - Title
      description: >-
        # API Documentation - Fetch Vulnerability Details


        ## Endpoint


        `GET /api/vulndb/database/?title={title}`


        ## Description


        This API endpoint allows you to fetch details of a vulnerability from
        the vulnerability database based on its title.


        ## Authentication


        Include the authentication token in the request headers.


        ## Query Parameter


        - `{title}`: The title of the vulnerability to fetch details for.


        ## Example


        ```http

        GET /api/vulndb/database/?title=Possible%20XSS

        ```


        ## Response

        The API response will include details of the vulnerability if it exists
        in the database.


        ### Successful Response

        ```json

        {
          "id": 1,
          "vulnerabilityname": "Possible XSS",
          "vulnerabilityseverity": "None",
          "vulnerabilitydescription": "<p>IDOR.</p>",
          "vulnerabilitysolution": "<p>Access control vulnerabilities can generally be prevented by taking a defense-in-depth approach and applying the following principles:</p>\n\n<ul>\n\t<li>Never rely on obfuscation alone for access control.</li>\n\t<li>Unless a resource is intended to be publicly accessible, deny access by default.</li>\n\t<li>Wherever possible, use a single application-wide mechanism for enforcing access controls.</li>\n\t<li>At the code level, make it mandatory for developers to declare the access that is allowed for each resource, and deny access by default.</li>\n\t<li>Thoroughly audit and test access controls to ensure they are working as designed.</li>\n</ul>",
          "vulnerabilityreferlnk": "<ul>\n\t<li><a href=\"https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html\">OWASP</a></li>\n</ul>",
          "cvssscore": 0.0,
          "cvssvector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N"
        }

        ```


        ## Error Response

        - If the authentication token is missing or invalid, a 401 Unauthorized
        response will be returned.

        - If the vulnerability title does not match or does not exist in the
        database, a 200 OK response will be returned with an empty array in the
        body.

        ```json

        [ ]

        ```

        - If there are issues with the request or the server encounters an
        internal error, a 500 Internal Server Error response will be returned.
      operationId: getVulnerabilityDetailsTitle
      parameters:
        - name: title
          in: query
          schema:
            type: string
            example: Possible XSS
        - name: Host
          in: header
          schema:
            type: string
            example: 127.0.0.1:8000
        - name: Connection
          in: header
          schema:
            type: string
            example: close
      responses:
        '200':
          description: ''
  /api/vulndb/all-vulndb/filter:
    get:
      tags:
        - Vulnerability Database
      summary: Get All Vulnerability with Filters and pagination
      description: >-
        # API Documentation - Fetch All Vulnerabilities with Pagination and
        Filtering


        ## Endpoint


        `GET
        /api/vulndb/all-vulndb/filter?vulnerabilityname=&vulnerabilityseverity=&cvssscore&limit=1&offset=1`


        ## Description


        This API endpoint allows you to fetch all vulnerabilities from the
        vulnerability database with pagination and filtering options.


        ## Authentication


        Include the authentication token in the request headers.


        ## Query Parameters


        - `vulnerabilityname`: Filter vulnerabilities by name.

        - `vulnerabilityseverity`: Filter vulnerabilities by severity.

        - `cvssscore`: Filter vulnerabilities by CVSS score.

        - `limit`: Number of vulnerabilities to fetch per page (default is 1).

        - `offset`: Offset for pagination (default is 1).


        ## Example


        ```http

        GET
        /api/vulndb/all-vulndb/filter?vulnerabilityname=&vulnerabilityseverity=&cvssscore&limit=1&offset=1

        ```


        ## Response

        The API response will include a paginated list of vulnerabilities based
        on the provided filters.


        ```json

        {
            "count": 3,
            "next": "http://aptrsapi.souravkalal.tech/api/vulndb/all-vulndb/filter?cvssscore=&limit=1&offset=2&vulnerabilityname=&vulnerabilityseverity=",
            "previous": "http://aptrsapi.souravkalal.tech/api/vulndb/all-vulndb/filter?cvssscore=&limit=1&vulnerabilityname=&vulnerabilityseverity=",
            "results": [
                {
                    "id": 2,
                    "vulnerabilityname": "Stored XSS",
                    "vulnerabilityseverity": "None",
                    "vulnerabilitydescription": "<p>IDOR.</p>",
                    "vulnerabilitysolution": "<p>Access control vulnerabilities can generally be prevented by taking a defense-in-depth approach and applying the following principles:</p>\n\n<ul>\n\t<li>Never rely on obfuscation alone for access control.</li>\n\t<li>Unless a resource is intended to be publicly accessible, deny access by default.</li>\n\t<li>Wherever possible, use a single application-wide mechanism for enforcing access controls.</li>\n\t<li>At the code level, make it mandatory for developers to declare the access that is allowed for each resource, and deny access by default.</li>\n\t<li>Thoroughly audit and test access controls to ensure they are working as designed.</li>\n</ul>",
                    "vulnerabilityreferlnk": "<ul>\n\t<li><a href=\"https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html\">OWASP</a></li>\n</ul>",
                    "cvssscore": 0.0,
                    "cvssvector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N"
                }
            ]
        }

        ```

        - count: Total number of vulnerabilities matching the query.

        - next: Link to the next page of results if available.

        - previous: Link to the previous page of results if available.

        - results: Array containing the vulnerabilities matching the query
        parameters.



        ## Error Response

        - If the authentication token is missing or invalid, a 401 Unauthorized
        response will be returned.

        - If there are issues with the request or the server encounters an
        internal error, a 500 Internal Server Error response will be returned.
      operationId: getAllVulnerabilityWithFiltersAndPagination
      parameters:
        - name: vulnerabilityname
          in: query
          schema:
            type: string
            example: ''
        - name: vulnerabilityseverity
          in: query
          schema:
            type: string
            example: ''
        - name: sort
          in: query
          schema:
            type: string
            example: cvssscore
        - name: limit
          in: query
          schema:
            type: string
            example: '10'
        - name: offset
          in: query
          schema:
            type: string
            example: '1'
        - name: order_by
          in: query
          schema:
            type: string
            example: asc
      responses:
        '200':
          description: ''
  /api/vulndb/all-vulndb:
    get:
      tags:
        - Vulnerability Database
      summary: Get All Vunerability Database
      description: Get All Vunerability Database
      operationId: getAllVunerabilityDatabase
      responses:
        '200':
          description: ''
  /api/vulndb/16:
    get:
      tags:
        - Vulnerability Database
      summary: Get Vulnerability Details - ID
      description: Get Vulnerability Details - ID
      operationId: getVulnerabilityDetailsId
      responses:
        '200':
          description: ''
  /api/vulndb/add-vulndb:
    post:
      tags:
        - Vulnerability Database
      summary: Add Vulnerability DB
      description: Add Vulnerability DB
      operationId: addVulnerabilityDb
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                cvssscore:
                  type: number
                  example: 0
                cvssvector:
                  type: string
                  example: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N
                cwe:
                  type: array
                  items:
                    type: string
                    example: 'CWE-564: SQL Injection: Hibernate'
                  example:
                    - 'CWE-564: SQL Injection: Hibernate'
                    - >-
                      CWE-89: Improper Neutralization of Special Elements used
                      in an SQL Command ('SQL Injection')
                vulnerabilitydescription:
                  type: string
                  example: <p>IDOR.</p>
                vulnerabilityname:
                  type: string
                  example: Remote Code Execution
                vulnerabilityreferlnk:
                  type: string
                  example: "<ul>\n\t<li><a href=\"https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html\">OWASP</a></li>\n</ul>"
                vulnerabilityseverity:
                  type: string
                  example: None
                vulnerabilitysolution:
                  type: string
                  example: "<p>Access control vulnerabilities can generally be prevented by taking a defense-in-depth approach and applying the following principles:</p>\n\n<ul>\n\t<li>Never rely on obfuscation alone for access control.</li>\n\t<li>Unless a resource is intended to be publicly accessible, deny access by default.</li>\n\t<li>Wherever possible, use a single application-wide mechanism for enforcing access controls.</li>\n\t<li>At the code level, make it mandatory for developers to declare the access that is allowed for each resource, and deny access by default.</li>\n\t<li>Thoroughly audit and test access controls to ensure they are working as designed.</li>\n</ul>"
            example:
              cvssscore: 0
              cvssvector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N
              cwe:
                - 'CWE-564: SQL Injection: Hibernate'
                - >-
                  CWE-89: Improper Neutralization of Special Elements used in an
                  SQL Command ('SQL Injection')
              vulnerabilitydescription: <p>IDOR.</p>
              vulnerabilityname: Remote Code Execution
              vulnerabilityreferlnk: "<ul>\n\t<li><a href=\"https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html\">OWASP</a></li>\n</ul>"
              vulnerabilityseverity: None
              vulnerabilitysolution: "<p>Access control vulnerabilities can generally be prevented by taking a defense-in-depth approach and applying the following principles:</p>\n\n<ul>\n\t<li>Never rely on obfuscation alone for access control.</li>\n\t<li>Unless a resource is intended to be publicly accessible, deny access by default.</li>\n\t<li>Wherever possible, use a single application-wide mechanism for enforcing access controls.</li>\n\t<li>At the code level, make it mandatory for developers to declare the access that is allowed for each resource, and deny access by default.</li>\n\t<li>Thoroughly audit and test access controls to ensure they are working as designed.</li>\n</ul>"
      responses:
        '200':
          description: ''
  /api/vulndb/edit-vulndb/17/:
    post:
      tags:
        - Vulnerability Database
      summary: Edit Vulnerability DB
      description: Edit Vulnerability DB
      operationId: editVulnerabilityDb
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                cvssscore:
                  type: number
                  example: 8.3
                cvssvector:
                  type: string
                  example: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
                cwe:
                  type: array
                  items:
                    type: string
                    example: 'CWE-564: SQL Injection: Hibernate'
                  example:
                    - 'CWE-564: SQL Injection: Hibernate'
                    - >-
                      CWE-89: Improper Neutralization of Special Elements used
                      in an SQL Command ('SQL Injection')
                vulnerabilitydescription:
                  type: string
                  example: >-
                    <p>Privilege escalation occurs when a user gets access to
                    more resources or functionality than they are normally
                    allowed, and such elevation or changes should have been
                    prevented by the application. This is usually caused by a
                    flaw in the application. The result is that the application
                    performs actions with more privileges than those intended by
                    the developer or system administrator.</p>
                vulnerabilityname:
                  type: string
                  example: 21 Escalation
                vulnerabilityreferlnk:
                  type: string
                  example: "<ul>\n\t<li><a href=\"https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html\">OWASP</a></li>\n</ul>"
                vulnerabilityseverity:
                  type: string
                  example: High
                vulnerabilitysolution:
                  type: string
                  example: "<p>Access control vulnerabilities can generally be prevented by taking a defense-in-depth approach and applying the following principles:</p>\n\n<ul>\n\t<li>Never rely on obfuscation alone for access control.</li>\n\t<li>Unless a resource is intended to be publicly accessible, deny access by default.</li>\n\t<li>Wherever possible, use a single application-wide mechanism for enforcing access controls.</li>\n\t<li>At the code level, make it mandatory for developers to declare the access that is allowed for each resource, and deny access by default.</li>\n\t<li>Thoroughly audit and test access controls to ensure they are working as designed.</li>\n</ul>"
            example:
              cvssscore: 8.3
              cvssvector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
              cwe:
                - 'CWE-564: SQL Injection: Hibernate'
                - >-
                  CWE-89: Improper Neutralization of Special Elements used in an
                  SQL Command ('SQL Injection')
              vulnerabilitydescription: >-
                <p>Privilege escalation occurs when a user gets access to more
                resources or functionality than they are normally allowed, and
                such elevation or changes should have been prevented by the
                application. This is usually caused by a flaw in the
                application. The result is that the application performs actions
                with more privileges than those intended by the developer or
                system administrator.</p>
              vulnerabilityname: 21 Escalation
              vulnerabilityreferlnk: "<ul>\n\t<li><a href=\"https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html\">OWASP</a></li>\n</ul>"
              vulnerabilityseverity: High
              vulnerabilitysolution: "<p>Access control vulnerabilities can generally be prevented by taking a defense-in-depth approach and applying the following principles:</p>\n\n<ul>\n\t<li>Never rely on obfuscation alone for access control.</li>\n\t<li>Unless a resource is intended to be publicly accessible, deny access by default.</li>\n\t<li>Wherever possible, use a single application-wide mechanism for enforcing access controls.</li>\n\t<li>At the code level, make it mandatory for developers to declare the access that is allowed for each resource, and deny access by default.</li>\n\t<li>Thoroughly audit and test access controls to ensure they are working as designed.</li>\n</ul>"
      responses:
        '200':
          description: ''
  /api/vulndb/delete-vulndb:
    delete:
      tags:
        - Vulnerability Database
      summary: Delete Vulnerability DB
      description: Delete Vulnerability DB
      operationId: deleteVulnerabilityDb
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                type: number
                example: 16
              example:
                - 16
                - 14
            example:
              - 16
              - 14
      responses:
        '200':
          description: ''
  /api/vulndb/cwe/:
    get:
      tags:
        - Vulnerability Database
      summary: List CWE
      description: List CWE
      operationId: listCwe
      responses:
        '200':
          description: ''
  /api/customer/all-company/filter:
    get:
      tags:
        - Company
      summary: All Company Filter and Pagination
      description: >
        # API Documentation - Get Companies with Filters and Pagination


        ## Endpoint


        `GET /api/customer/all-company/filter`


        ## Description


        This API endpoint retrieves a list of companies with the option to apply
        filters and implement pagination.


        ## Authentication


        Include the authentication token in the request headers.


        ## Query Parameters


        - `name`: Filter by company name.

        - `limit`: Number of results to return (default is 1).

        - `offset`: Offset for pagination (default is 0).
            

        ## Example


        ``` http

        GET /api/customer/all-company/filter?name=&limit=1&offset=0

         ```

        ## Response


        The API response will include a list of companies based on the applied
        filters and pagination settings.


        ### Sample Response


        ```json

        {
            "count": 2,
            "next": "http://aptrsapi.souravkalal.tech/api/customer/all-company/filter?limit=1&name=&offset=1",
            "previous": null,
            "results": [
                {
                    "id": 1,
                    "img": "/media/company/OWASP_ZfWNj2c.png",
                    "name": "OWASP",
                    "address": "USA"
                }
            ]
        }

        ```



        ## Error Handling


        - If the authentication token is missing or invalid, a 401 Unauthorized
        response will be returned.

        - If there are validation errors or other issues with the request, a 400
        Bad Request response will be returned.
      operationId: allCompanyFilterAndPagination
      parameters:
        - name: name
          in: query
          schema:
            type: string
            example: ''
        - name: limit
          in: query
          schema:
            type: string
            example: '19'
        - name: offset
          in: query
          schema:
            type: string
            example: '0'
        - name: order_by
          in: query
          schema:
            type: string
            example: desc
          description: asc/desc
        - name: sort
          in: query
          schema:
            type: string
            example: id
      responses:
        '200':
          description: ''
  /api/customer/all-company:
    get:
      tags:
        - Company
      summary: All Company
      description: >-
        # API Documentation - Get All Companies


        ## Endpoint


        `GET /api/customer/all-company`


        ## Description


        This API endpoint retrieves a list of all companies.


        ## Authentication


        Include the authentication token in the request headers.


        ## Example


        ``` http

        GET /api/customer/all-company

         ```

        ## Response


        The API response will include a list of all companies.


        ### Sample Response


        ``` json

        [
            {
                "id": 1,
                "img": "/media/company/OWASP_ZfWNj2c.png",
                "name": "OWASP",
                "address": "USA"
            },
            {
                "id": 2,
                "img": null,
                "name": "AnoF PVT LTD",
                "address": ""
            }
        ]

         ```

        ## Error Handling


        - If the authentication token is missing or invalid, a 401 Unauthorized
        response will be returned.

        - If there are validation errors or other issues with the request, a 400
        Bad Request response will be returned.
      operationId: allCompany
      responses:
        '200':
          description: ''
  /api/customer/company/1/:
    get:
      tags:
        - Company
      summary: Get Company
      description: >-
        # API Documentation - Get Company Details by ID


        ## Endpoint


        `GET /api/customer/company/{id}`


        ## Description


        This API endpoint retrieves details for a specific company based on its
        ID.


        ## Authentication


        Include the authentication token in the request headers.


        ## Path Parameters


        - `{id}`: The unique identifier of the company.
            

        ## Example


        ``` http

        GET /api/customer/company/1


        ```


        ## Response

        The API response will include details for the specified company.

        ### Sample Response

        ```json 

        {
            "id": 1,
            "img": "/media/company/OWASP_ZfWNj2c.png",
            "name": "OWASP",
            "address": "USA"
        }

         ```

        ## Error Handling


        - If the authentication token is missing or invalid, a 401 Unauthorized
        response will be returned.  

        - If the specified company ID is not found, a 404 Not Found response
        will be returned.  

        - If there are validation errors or other issues with the request, a 400
        Bad Request response will be returned.
      operationId: getCompany
      responses:
        '200':
          description: ''
  /api/customer/company/add:
    post:
      tags:
        - Company
      summary: Add Company
      description: >-
        # API Documentation - Add New Company


        ## Endpoint


        `POST /api/customer/company/add`


        ## Description


        This API endpoint allows you to add a new company.


        ## Authentication


        Include the authentication token in the request headers.


        ## Request


        - Method: POST

        - Content-Type: application/json or multipart/form-data (for image
        upload)
            

        ### JSON Body (if not using form-data)


        ``` json

        {
            "name": "New Company",
            "address": "City, Country"
        }

         ```

        ### Form Data (for image upload)


        - img: (file) Logo image for the company

        - name: (text) Name of the company

        - address: (text) Address of the company
            

        ## Example


        ### Using JSON Body


        ``` http

        POST /api/customer/company/add

        Content-Type: application/json

        {
            "name": "New Company",
            "address": "City, Country"
        }

         ```

        ### Using Form Data (with Image Upload)


        ``` http

        POST /api/customer/company/add

        Content-Type: multipart/form-data

        --boundary

        Content-Disposition: form-data; name="img"; filename="company_logo.png"

        Content-Type: image/png

        ... (binary data for the image)

        --boundary

        Content-Disposition: form-data; name="name"

        New Company

        --boundary

        Content-Disposition: form-data; name="address"

        City, Country

        --boundary--

         ```

        ## Response


        The API response will include details for the newly added company.


        ### Sample Response


        ``` json

        {
            "Status": "Success",
            "id": 3,
            "img": "/media/company/facebook.png",
            "name": "FaceBook",
            "address": "USA"
        }

         ```

        ## Error Handling


        - If the authentication token is missing or invalid, a 401 Unauthorized
        response will be returned.

        - If there are validation errors or other issues with the request, a 400
        Bad Request response will be returned.
      operationId: addCompany
      requestBody:
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                address:
                  type: string
                  example: USA
                img:
                  description: 'Optional '
                  type: string
                  format: binary
                name:
                  type: string
                  example: FaceBook
      responses:
        '200':
          description: ''
  /api/customer/company/edit/1/:
    post:
      tags:
        - Company
      summary: Edit Company
      description: >-
        # API Documentation - Edit Company


        ## Endpoint


        `POST /api/customer/company/edit/{id}`


        ## Description


        This API endpoint allows you to edit an existing company based on its
        ID.


        ## Authentication


        Include the authentication token in the request headers.


        ## Path Parameters


        - `{id}`: The unique identifier of the company to be edited.


        ## Request


        - Method: POST

        - Content-Type: application/json or multipart/form-data (for image
        upload)



        ### JSON Body (if not using form-data)


        ```json

        {
            "name": "New Name",
            "address": "City, Country"
        }

        ```


        ### Form Data (for image upload)


        - img: (file) Logo image for the company

        - name: (text) Name of the company

        - address: (text) Address of the company



        ## Example


        ### Using JSON Body


        ```http

        POST /api/customer/company/edit/2/

        Content-Type: application/json


        {
            "name": "New name",
            "address": "City, Country"
        }

        ```


        ### Using Form Data (with Image Upload)


        ```http

        POST /api/customer/company/edit/2/

        Content-Type: multipart/form-data


        --boundary

        Content-Disposition: form-data; name="img"; filename="company_logo.png"

        Content-Type: image/png


        ... (binary data for the image)

        --boundary

        Content-Disposition: form-data; name="name"

         Company
        --boundary

        Content-Disposition: form-data; name="address"


        City, Country

        --boundary--

        ```


        ## Response

        The API response will include details for the newly added company.


        ### Sample Response


        ```json

        {
            "Status": "Success",
            "id": 3,
            "img": "/media/company/facebook.png",
            "name": "FaceBook",
            "address": "USA"
        }

        ```


        ## Error Handling

        - If the authentication token is missing or invalid, a 401 Unauthorized
        response will be returned.

        - If there are validation errors or other issues with the request, a 400
        Bad Request response will be returned.
      operationId: editCompany
      requestBody:
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                address:
                  type: string
                  example: India
                img:
                  type: string
                  format: binary
                name:
                  type: string
                  example: OWASP
      responses:
        '200':
          description: ''
  /api/customer/company/delete:
    delete:
      tags:
        - Company
      summary: Delete Company
      description: >
        # API Documentation - Delete Companies


        ## Endpoint


        `DELETE /api/customer/company/delete`


        ## Description


        This API endpoint allows you to delete multiple companies.


        > WARNING

        > Deleting a company will also delete all associated projects.


        ## Authentication


        Include the authentication token in the request headers.


        ## Request


        - Method: DELETE

        - Content-Type: application/json


        ### Request Body


        An array of company IDs to be deleted.


        ```json

        [
            1,
            13
        ]

        ```


        ## Example


        ```http

        DELETE /api/customer/company/delete

        Content-Type: application/json


        [
            1,
            13
        ]

        ```


        ## Response

        The API response will confirm the deletion of the specified companies.


        ###Sample Response


        ```json

        {
            "Status": "Success"
        }

        ```


        ## Error Handling


        - If the authentication token is missing or invalid, a 401 Unauthorized
        response will be returned.

        - If there are issues with the deletion process, a 500 Internal Server
        Error response may be returned.

        - If there are validation errors or other issues with the request, a 400
        Bad Request response will be returned.- 
      operationId: deleteCompany
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                type: number
                example: 1
              example:
                - 1
                - 13
            example:
              - 1
              - 13
      responses:
        '200':
          description: ''
  /api/customer/all-customer/filter:
    get:
      tags:
        - Customer
      summary: Get All Customer Filter and Pagination
      description: >-
        # API Documentation - All Customers with Filters and Pagination


        ## Endpoint


        `GET /api/customer/all-customer/filter`


        ## Description


        This API endpoint retrieves a list of customers with the option to apply
        filters and implement pagination.


        ## Authentication


        Include the authentication token in the request headers.


        ## Query Parameters


        - `username`: Filter by username.

        - `full_name`: Filter by full name.

        - `email`: Filter by email.

        - `position`: Filter by position.

        - `is_active`: Filter by active status.

        - `limit`: Number of results to return (default is 10).

        - `offset`: Offset for pagination (default is 0).
            

        ## Example


        ``` javascript

        GET
        /api/customer/all-customer/filter?username=&full_name=&email=&position=&is_active=&limit=1&offset=0

         ```

        ## Sample Response


        ``` json

        {
            "count": 1,
            "next": null,
            "previous": null,
            "results": [
                {
                    "id": 13,
                    "full_name": "Jame Lee",
                    "email": "jaes@owasp-test.com",
                    "is_active": true,
                    "number": "+911734566991",
                    "position": "CISO",
                    "company": "OWASP"
                }
            ]
        }

         ```

        ## Error Handling


        - If the authentication token is missing or invalid, a 401 Unauthorized
        response will be returned.

        - If there are validation errors or other issues with the request, a 400
        Bad Request response will be returned.
      operationId: getAllCustomerFilterAndPagination
      parameters:
        - name: username
          in: query
          schema:
            type: string
            example: ''
        - name: full_name
          in: query
          schema:
            type: string
            example: ''
        - name: company
          in: query
          schema:
            type: string
            example: ''
        - name: email
          in: query
          schema:
            type: string
            example: ''
        - name: position
          in: query
          schema:
            type: string
            example: ''
        - name: is_active
          in: query
          schema:
            type: string
            example: ''
        - name: limit
          in: query
          schema:
            type: string
            example: '1'
        - name: offset
          in: query
          schema:
            type: string
            example: '0'
        - name: order_by
          in: query
          schema:
            type: string
            example: asc
          description: asc/desc
        - name: sort
          in: query
          schema:
            type: string
            example: id
      responses:
        '200':
          description: ''
  /api/customer/all-customer:
    get:
      tags:
        - Customer
      summary: Get All Customers
      description: >
        # API Documentation - Fetch All Customers


        ## Endpoint


        `GET /api/customer/all-customer`


        ## Description


        This API endpoint retrieves all customer records without pagination or
        filters.


        ## Authentication


        Include the authentication token in the request headers.


        ## Example


        ```http

        GET /api/customer/all-customer


        ```


        ## Response


        The API response will include a list of all customer records.


        ```json

        [
            {
                "id": 13,
                "full_name": "Jame Lee",
                "email": "jaes@owasp-test.com",
                "is_active": true,
                "number": "+911734566991",
                "position": "CISO",
                "company": "OWASP"
            }
        ]

        ```


        ## Error Handling


        - If the authentication token is missing or invalid, a 401 Unauthorized
        response will be returned.

        - If there are validation errors or other issues with the request, a 400
        Bad Request response will be returned.
      operationId: getAllCustomers
      responses:
        '200':
          description: ''
  /api/customer/customer/13/:
    get:
      tags:
        - Customer
      summary: Get Customer
      description: >-
        # API Documentation - Fetch Specific Customer


        ## Endpoint


        `GET /api/customer/customer/{customer_id}/`


        ## Description


        This API endpoint retrieves details for a specific customer based on the
        provided customer ID.


        ## Authentication


        Include the authentication token in the request headers.


        ## Path Parameters


        - `customer_id`: The unique identifier for the customer.


        ## Example


        ```http

        GET /api/customer/customer/13/

        ```


        ## Response


        The API response will include the details of the specified customer.


        Sample Response


        ```json

        {
            "id": 13,
            "full_name": "Jame Lee",
            "email": "jaes@owasp-test.com",
            "is_active": true,
            "number": "+911734566991",
            "position": "CISO",
            "company": "OWASP"
        }

        ```


        ## Error Handling


        - If the authentication token is missing or invalid, a 401 Unauthorized
        response will be returned.

        - If the specified customer ID is not found, a 404 Not Found response
        will be returned.

        - If there are validation errors or other issues with the request, a 400
        Bad Request response will be returned.
      operationId: getCustomer
      responses:
        '200':
          description: ''
  /api/customer/customer/edit/13/:
    post:
      tags:
        - Customer
      summary: Edit Customer
      description: >-
        # API Documentation - Edit Customer Profile


        ## Endpoint


        `POST /api/customer/customer/edit/{customer_id}/`


        ## Description


        This API endpoint allows editing the profile of a specific customer with
        the provided customer ID.


        ## Authentication


        Include the authentication token in the request headers.


        ## Path Parameters


        - `customer_id`: The unique identifier for the customer to be edited.
            

        ## Request Body


        - `full_name` (required): Updated full name of the customer.

        - `email` (required): Updated email address of the customer.

        - `number` (optional): Updated contact number of the customer.
            
        - `is_active` (required): Updated active status of the customer.

        - `position` (optional): Updated position of the customer (text field).

        - `password` (optional): Updated password for the customer.

        - `company` (not editable): Company assigned during creation (cannot be
        changed).
            

        ### Sample Request Body


        ``` json

        {
          "full_name": "Jame Lee",
          "email": "james@owasp-test.com",
          "number": "+911734566991",
          "is_active": true,
          "position": "CISO",
          "password": "admin"
        }

         ```

        ## Example


        ``` http

        POST /api/customer/customer/edit/12/

        Content-Type: application/json

        Authorization: Bearer YOUR_AUTH_TOKEN

        {
          "full_name": "Jame Lee",
          "email": "james@owasp-test.com",
          "number": "+911734566991",
          "is_active": true,
          "position": "CISO",
          "password": "admin"
        }

         ```

        ## Response


        The API response will confirm the successful editing of the customer's
        profile.


        Sample Response


        ``` json

        {
            "Status": "Success",
            "id": 13,
            "full_name": "Jame Lee",
            "email": "jaes@owasp-test.com",
            "is_active": true,
            "number": "+911734566991",
            "position": "CISO",
            "company": "OWASP"
        }

         ```

        ## Error Handling


        - If the authentication token is missing or invalid, a 401 Unauthorized
        response will be returned.

        - If the specified customer ID is not found, a 404 Not Found response
        will be returned.

        - If there are validation errors or other issues with the request, a 400
        Bad Request response will be returned.
      operationId: editCustomer
      requestBody:
        content:
          text/plain:
            example: "{\r\n    \"full_name\": \"Jame Lee\",\r\n    \"email\": \"jaes@owasp-test.com\",\r\n    \"number\": \"+911734566991\", // optional\r\n    \"is_active\": true,\r\n    \"position\": \"CISO\", // Optional text field\r\n    \"password\": \"Password@123\", // Optional \r\n    \"company\": \"OWASP\"   /// Not Editable\r\n}"
      responses:
        '200':
          description: ''
  /api/customer/customer/add:
    post:
      tags:
        - Customer
      summary: Add Customer
      description: >-
        # API Documentation - Add Customer


        ## Endpoint


        `POST /api/customer/customer/add`


        ## Description


        This API endpoint allows creating a new customer profile.


        ## Authentication


        Include the authentication token in the request headers.


        ## Request Body


        - `full_name` (required): Full name of the new customer.

        - `email` (required): Email address of the new customer.

        - `number` (required): Contact number of the new customer.

        - `is_active` (required): Active status of the new customer.

        - `position` (optional): Position of the new customer (text field).

        - `password` (required): Password for the new customer.

        - `company` (required): Company associated with the new customer.
            

        > NOTE  

        The company should already exist; Company APIs are available for
        managing companies. 
          

        ### Sample Request Body


        ``` json

        {
            "full_name": "odison leo",
            "email": "odison@owasp-test.com",
            "number": "+911734566990",
            "is_active": true,
            "position": "CISO", // Optional text field
            "password": "Password@1234",
            "company": "OWASP"
        }

         ```

        ## Example


        ``` http

        POST /api/customer/customer/add

        Content-Type: application/json

        Authorization: Bearer YOUR_AUTH_TOKEN

        {
            "full_name": "odison leo",
            "email": "odison@owasp-test.com",
            "number": "+911734566990",
            "is_active": true,
            "position": "CISO", // Optional text field
            "password": "Password@1234",
            "company": "OWASP"
        }

         ```

        ## Response


        The API response will confirm the successful creation of the new
        customer.


        Sample Response


        ``` json
         {
            "id": 16,
            "full_name": "odison leo",
            "email": "odison@owasp-test.com",
            "is_active": true,
            "number": "+911734566990",
            "position": "CISO",
            "company": "OWASP"
        }

         ```

        ## Error Handling


        - If the authentication token is missing or invalid, a 401 Unauthorized
        response will be returned.

        - If there are validation errors or other issues with the request, a 400
        Bad Request response will be returned.
      operationId: addCustomer
      requestBody:
        content:
          text/plain:
            example: "{\r\n    \"full_name\": \"odison leo\",\r\n    \"email\": \"odison@owasp-test.com\",\r\n    \"number\": \"+911734566990\", // Optional\r\n    \"is_active\": true,\r\n    \"position\": \"CISO\", // Optional text field\r\n    \"password\": \"Password@1234\",\r\n    \"company\": \"OWASP\"\r\n}"
      responses:
        '200':
          description: ''
  /api/customer/customer/delete:
    delete:
      tags:
        - Customer
      summary: Delete Customers
      description: >-
        # API Documentation - Delete Customers


        ## Endpoint


        `DELETE /api/customer/customer/delete`


        ## Description


        This API endpoint allows deleting multiple customers by providing a list
        of customer IDs.


        ## Authentication


        Include the authentication token in the request headers.


        ## Request Body


        - List of customer IDs to delete.
            

        ### Sample Request Body


        ``` json

        [
          15,
          10,
          20
        ]

        ```

        ### Example


        ```http

        DELETE /api/customer/customer/delete

        Content-Type: application/json

        Authorization: Bearer YOUR_AUTH_TOKEN

        [
          15,
          10,
          20
        ]

         ```

        ## Response


        The API response will confirm the successful deletion of the specified
        customers.


        ### Sample Response


        ``` json

        {
            "Status": "Success"
        }

         ```

        ## Error Handling


        - If the authentication token is missing or invalid, a 401 Unauthorized
        response will be returned.

        - If there are validation errors or other issues with the request, a 400
        Bad Request response will be returned.
      operationId: deleteCustomers
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                type: number
                example: 15
              example:
                - 15
            example:
              - 15
      responses:
        '200':
          description: ''
  /api/config/standards/:
    get:
      tags:
        - Config APIs
      summary: Fetch Report Standards
      description: Fetch Report Standards
      operationId: fetchReportStandards
      responses:
        '200':
          description: ''
  /api/config/standards/create/:
    post:
      tags:
        - Config APIs
      summary: Add Report Standard - Admin Only
      description: Add Report Standard - Admin Only
      operationId: addReportStandardAdminOnly
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                  example: OWASP Mobile TOP 10 2024
            example:
              name: OWASP Mobile TOP 10 2024
      responses:
        '200':
          description: ''
  /api/config/project-type/create/:
    post:
      tags:
        - Config APIs
      summary: Add Project Type - Admin Only
      description: Add Project Type - Admin Only
      operationId: addProjectTypeAdminOnly
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                  example: Web Application Penetration Testing
            example:
              name: Web Application Penetration Testing
      responses:
        '200':
          description: ''
  /api/config/project-type/:
    get:
      tags:
        - Config APIs
      summary: Fetch Project Type
      description: Fetch Project Type
      operationId: fetchProjectType
      responses:
        '200':
          description: ''
tags:
  - name: Account
    description: >-
      **Account APIs Overview**


      The Account APIs in APTRS facilitate the seamless management of internal
      company user accounts. These APIs empower administrators to add, update,
      and edit user profiles for internal company users. Additionally,
      individual users have the ability to modify their own profiles, change
      passwords, and manage user permissions and permission groups.


      **Key Features of Account APIs:**


      1. **User Management:**
          
          - Add, update, and edit user profiles for internal company users using the Account APIs.
              
          - Ensure accurate and up-to-date information for all users within the APTRS system.
              
      2. **Self-Service Profile Modification:**
          
          - Empower individual users to edit their own profiles, providing a self-service option for maintaining personal information.
              
      3. **Password Management:**
          
          - Allow users to change their passwords through dedicated API endpoints, enhancing security and user control.
              
      4. **User Permission Control:**
          
          - Manage user permissions for each API of APTRS, controlling access for individual users.
              
          - Utilize permission groups to efficiently assign and manage access control based on specific user roles.
              
      5. **Granular Access Control:**
          
          - Implement granular access control for each user, ensuring precise control over the functionalities and features accessible to different users.
              

      These APIs offer a comprehensive solution for internal company user
      account management, providing administrators and individual users with the
      tools needed to maintain accurate profiles, enhance security through
      password management, and control access to APTRS functionalities based on
      specific user roles and permissions.
  - name: Admin
    description: Admin APIs of APTRS
  - name: Project
    description: >+
      The Project APIs within APTRS provide a versatile platform for creating
      and managing projects associated with client companies. These APIs empower
      users to create projects with customizable details such as project name
      and type (e.g., white box, black box).


      **Key Features of Project APIs:**


      1. **Project Creation:**
         - Easily create projects for client companies using the Project APIs.
         - Specify project details, including the project name and type (e.g., white box, black box).

      2. **Project Scope Management:**
         - Within each project, add project scope details such as URLs or IP addresses.
         - APTRS supports multiple scopes within a single project, offering flexibility in project configuration.

      3. **Vulnerability Management:**
         - Create vulnerabilities within a project, providing a detailed overview of potential security risks.
         - Upload Nessus CSV reports directly to APTRS to seamlessly add vulnerabilities from Nessus scans.

      4. **Project Reporting:**
         - Generate comprehensive reports in various formats, including Excel, PDF, and HTML.
         - Enhance project communication and documentation through easily accessible and shareable reports.

      5. **Project Retesting and Ownership:**
         - Manage project retesting, allowing for the reassessment of vulnerabilities over time.
         - Assign project ownership for effective project management and accountability.

      These APIs offer a robust set of tools for creating, configuring, and
      managing projects, providing a centralized hub for vulnerability
      management, report generation, and ongoing project evaluation.

  - name: Project1
    description: Project APIs of APTRS
  - name: Vulnerability
    description: Project Vulnerability APIs of APTRS
  - name: Retest
    description: Project Retest APIs of APTRS
  - name: Project Scope
  - name: Report
  - name: Vulnerability Database
    description: >
      The Vulnerability Database APIs in APTRS offer a robust solution for
      maintaining a comprehensive list of vulnerabilities. These APIs empower
      users to manage vulnerability details, including descriptions,
      recommendations, and reference links.


      **Key Features of Vulnerability Database APIs:**


      1. **Vulnerability Details Management:**
         - Maintain a centralized repository of vulnerabilities, including crucial details such as description, recommendations, and reference links.
         - Effectively organize and categorize vulnerabilities for easy retrieval and reference.

      2. **Integration with Project Vulnerabilities:**
         - Streamline the process of populating project vulnerabilities by utilizing the Vulnerability Database APIs.
         - Avoid redundant data entry by leveraging the stored details of vulnerabilities from the database.

      3. **Vulnerability Database Search and Filter API:**
         - Facilitate efficient search and filtering of vulnerabilities within the database.
         - Automate the addition of vulnerability details, including description, title, recommendation, and reference links, during the creation or update of vulnerabilities within a project.

      4. **Enhanced Project Vulnerability Management:**
         - By integrating with the Vulnerability Database, project vulnerability management becomes more efficient and accurate.
         - Ensure consistency and accuracy in vulnerability details across projects.

      These APIs offer a powerful toolset for maintaining a centralized
      repository of vulnerabilities, enhancing project vulnerability management,
      and minimizing redundant data entry efforts. The ability to automatically
      populate project vulnerabilities with details from the Vulnerability
      Database streamlines the workflow and ensures data consistency.
  - name: Company
    description: >-
      In the context of APTRS, "Company" refers to the client companies
      associated with your organization. If your organization provides servers
      or services to external entities, these client companies can be seamlessly
      integrated into the system. Subsequently, you have the capability to
      create and manage projects specific to each client company.


      ### Key Features of Company APIs:


      1. **Create, Update, Retrieve, and Delete Operations:**
          
          - Create: Easily add new client companies to your system using the dedicated API endpoint.
          - Update: Modify and enhance company profiles as needed through the update functionality.
          - Retrieve: Retrieve detailed information about a specific company, facilitating seamless access to pertinent data.
          - Delete: Remove outdated or unnecessary company profiles from the system as required.
      2. **Project Creation:**
          - A pivotal aspect of the Company APIs is the requirement for companies to initiate project creation for their associated profiles.
          - This ensures a structured and organized approach, allowing for efficient project management within the APTRS ecosystem.

      These APIs empower your organization to efficiently handle and optimize
      interactions with client companies, providing a robust foundation for
      project management and customization based on the unique needs of each
      company.
  - name: Customer
    description: >-
      The Customer APIs within APTRS provide functionality to manage customer
      users associated with client companies. When your organization extends
      services to a client company using the Company APIs, you can leverage the
      Customer APIs to seamlessly onboard and manage customer users.


      ### Key Features of Customer APIs:


      1. **Add, Edit, and Delete Operations:**
          - Add User: Utilize the API endpoints to add customer users to the system, associating them with their respective client companies.
          - Edit User Profiles: Modify and update customer user profiles, ensuring accurate and up-to-date information.
          - Delete User: Remove customer users from the system when necessary, maintaining data integrity.
      2. **Client Company User Onboarding:**
          - The Customer APIs facilitate the onboarding of client company users, streamlining the process of integrating them into the APTRS ecosystem.
      3. **Future Updates:**
          - The current version of APTRS does not support client login for the management of projects, vulnerabilities, or real-time updates. However, upcoming updates are planned to address this, providing enhanced functionality for client interaction.

      These APIs empower your organization to efficiently handle customer user
      management, offering a comprehensive solution for onboarding, editing, and
      removing client company users associated with your services.
  - name: Config APIs