Lexicon Garden

io.atcr.hold.subscribeScanJobs

Subscribe to vulnerability scan jobs via WebSocket. Scanners connect to receive pending scan jobs and send back results. Authenticated via shared secret (query parameter or X-Scanner-Secret header).

Repository @seamark.cr did:plc:wfj5kyialpmcv2fzk6uqwsln namespace authority
Details · subscription
Kindsubscription
Authorityhold.atcr.io
Indexed
Compare Edit in builder → Fork →

Subscription

subscription · WebSocket

Parameters

query string

cursor

integer

Sequence number to resume from. If omitted, starts from latest. Use -1 to receive only new jobs.

Messages

DAG-CBOR frames

#scanJob

object

A scan job dispatched from hold to scanner. Sent as a JSON WebSocket message.

#scanResult

object

A scan result sent from scanner back to hold. Sent as a JSON WebSocket message.

Errors

InvalidSecret

Scanner shared secret is invalid

#scanJob

object

A scan job dispatched from hold to scanner. Sent as a JSON WebSocket message.

Properties

digest

requiredstring

Manifest digest (e.g., sha256:abc123...)

  • maxLength: 128

holdDid

requiredstring · did

DID of the hold where the image is stored

holdEndpoint

requiredstring · uri

HTTP endpoint of the hold for blob downloads

priority

integer

Scan priority (lower = higher priority). Tier-based scheduling.

repository

requiredstring

Repository name (e.g., myapp)

  • maxLength: 256

seq

requiredinteger

Monotonic sequence number for cursor-based resumption

tag

string

Optional tag that triggered the scan

  • maxLength: 256

type

requiredstring

Message type discriminator

  • maxLength: 32
  • const: "scan_job"

userDid

requiredstring · did

DID of the image owner

#scanResult

object

A scan result sent from scanner back to hold. Sent as a JSON WebSocket message.

Properties

digest

requiredstring

Manifest digest that was scanned

  • maxLength: 128

error

string

Error message if scan failed

  • maxLength: 1024

sbom

bytes

SBOM blob (SPDX JSON format, max 100MB)

  • maxLength: 104857600

scannerVersion

string

Scanner version string

  • maxLength: 64

summary

requiredref

Vulnerability count summary

Reference

type

requiredstring

Message type discriminator

  • maxLength: 32
  • const: "scan_result"

vulnReport

bytes

Grype vulnerability report blob (JSON, max 100MB)

  • maxLength: 104857600

#vulnSummary

object

Properties

critical

requiredinteger

Count of critical severity vulnerabilities

  • minimum: 0

high

requiredinteger

Count of high severity vulnerabilities

  • minimum: 0

low

requiredinteger

Count of low severity vulnerabilities

  • minimum: 0

medium

requiredinteger

Count of medium severity vulnerabilities

  • minimum: 0

total

requiredinteger

Total vulnerability count

  • minimum: 0

Similar lexicons

semantic match

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • io.atcr.hold.scan

    record

    Vulnerability scan results for a container manifest. Stored in the hold's embedded PDS. Record key is deterministic: the manifest digest hex without the 'sha256:' prefix, so re-scans upsert the existing record.