Sonatype
Sonatype provides software supply chain management solutions including Sonatype Lifecycle (IQ Server), Sonatype Repository Firewall, SBOM Manager, and Nexus Repository. The Lifecycle Public REST API provides 188 endpoints for application portfolio management, policy enforcement, vulnerability reporting, component analysis, SBOM generation, source control integration, and software composition analysis across the SDLC.
Real signal across most facets with visible, nameable gaps — the contract exists but is thin, or the portal is good while governance and commercial terms are absent.
API Evangelist profiles Sonatype the way a machine reads it — 73 machine-readable artifacts across 58 APIs, pulled from the provider's own public surface and indexed so a developer, an analyst, or an AI agent can evaluate it against every other provider on the network.
Every provider in the network is reduced to the same set of machine-readable artifacts — OpenAPI contracts, event specifications, GraphQL schemas, runnable collections, pricing and rate-limit signals, security posture, OAuth scopes, and the agent surfaces (MCP servers and skills) that let software drive the API on its own. We profile them because the interface is the part of a company you can actually inspect: it is a truer signal of what a provider does than any marketing page. From those artifacts we compute the Kin Score — Sonatype scores 56.9/100 (developing), with a separate agent-readiness read of 48/100 (agent ready). The full breakdown is below, followed by every artifact we hold — each card links through to its machine-readable definition on apis.io.
Kin Score
This is the API Evangelist rating — a single, repeatable read computed from the artifacts on this page. Green fill is points earned; the red track is points possible, so every bar shows earned-versus-possible at a glance.
Kin Score
How this is scored →scored 2026-07-27 · rubric v0.5
How we profile Sonatype
Each block below is one kind of artifact we hold for Sonatype. For each we say what it is and why it earns a place in the profile, then list every one we've indexed — capped at two rows, scroll within the panel for the rest.
APIs 58
Each API is captured as its own OpenAPI definition — every operation, parameter, and response. This is the single most useful machine-readable description of what an API does, and it's what lets us score, lint, mock, and generate against it without asking the provider for anything.
Individual APIs this provider publishes, each with its own machine-readable definition.
Sonatype Advanced Search API
Use the Advanced Search REST API to perform searches on Lifecycle application scan reports.
Sonatype Application Categories API
Use the Application Categories REST API to manage the application categories or tags assigned to the applications in an organization.
Sonatype Application Report Data API
Use this REST API to retrieve the data from an application composition report, that is generated after an evaluation.
Sonatype Applications API
Use this REST API to manage applications. In addition to the primary functions of create, update and delete, you can also move applications from one organization to other.
Sonatype Audit Logs API
Use this REST API to access the IQ Server audit logs.
Sonatype Auto Policy Waiver Exclusions API
Use this REST API to create and delete auto policy waiver exclusions.
Sonatype Auto Policy Waivers API
Use this REST API to create, modify and retrieve auto policy waivers.
Sonatype CI Configuration API
Use this REST API to manage CI integration configuration. Configurations can be set at organization or application level and are merged from the organization hierarchy with lowe...
Sonatype Claim Components API
Use this REST API to manage components that are developed in-house and are not open-source. Claiming the component stores the identity information for the component hash and avo...
Sonatype Component Labels API
Use this REST API to manage component labels for applications, organizations and repositories. Component Labels can be used as attributes of a component at the time of creating ...
Sonatype Component Search API
Use this REST API to search for components in application evaluation reports.
Sonatype Components API
Use this REST API to retrieve a component's security vulnerability data, license data, age and popularity.
Sonatype Composite Source Control API
Use this REST API to access the composite source control management configuration (SCM) for an application or organization. Composite source control configuration is defined as ...
Sonatype Composite Source Control Validator API
Use this REST API to validate the composite source control management (SCM) configuration. Composite source control configuration is defined as the configuration that is inherit...
Sonatype Config Crowd API
Use this REST API to manage the configuration of an existing Atlassian Crowd Server that is being used to authenticate users for IQ Server.
Sonatype Config Jira API
Use this REST API to manage Jira configurations to receive notifications from Lifecycle. It is supported for Jira Cloud, Jira Server, and Jira Data Center.
Sonatype Config Mail API
Use this REST API to manage the configuration of an SMTP server, to receive email notifications.
Sonatype Config OIDC API
Use this REST API to manage the OIDC configuration for IQ Server.
Sonatype Config Proxy Server API
Use this REST API to manage the configuration of IQ Server with an existing HTTP proxy server.
Sonatype Config Reverse Proxy Authentication API
Use this REST API to manage the configuration of a reverse proxy server.
Sonatype Config SAML API
Use this REST API to manage the SAML configuration for IQ Server.
Sonatype Config Source Control API
Use this REST API to manage the configuration of IQ Server with your Source Control Management (SCM) system (e.g. GitHub).
Sonatype Config Zscaler API
Use this REST API to manage the configuration of a Zscaler service.
Sonatype Configuration API
Use this REST API to configure the IQ Server system properties. We strongly recommend using this REST API instead of config.yml for versions 142 and higher.
Sonatype Configure Artifactory Connection API
Use this REST API to manage the configuration of Firewall for JFrog Artifactory.
Sonatype CPE Matching Configuration API
Use the CPE Matching Configuration REST API to add/set/remove cpe matching configuration to organizations and applications
Sonatype CycloneDX API
Use the CycloneDX REST API to generate CycloneDX SBOMs in XML or JSON formats, containing coordinates and licenses for components found in a scan report.
Sonatype Data Retention Policies API
Set policies for automatic purging of obsolete application and Success Metrics reports.
Note that IQ Server has a preset limit of purging 5000 reports in one execution of its...
Sonatype Developer Priorities API
Use this REST API to export Sonatype Developer component priorities data, including security reachability data.
Sonatype Endpoints API
This REST API returns the OpenAPI documentation for the specified IQ Server REST API.
Sonatype Feature Configuration API
Use this REST API to enable/disable the IQ Server features.
Sonatype Firewall API
Use this REST API for managing and monitoring firewall features, including metrics, repository management, quarantine operations, and namespace confusion prevention.
Sonatype GitHub App Configuration API
GitHub App configuration operations
Sonatype License Legal Metadata Report API
Use this REST API to retrieve license legal metadata in raw or HTML format.
Sonatype License Legal Metadata Template API
Use this REST API to manage and customize templates for the license legal metadata generated in HTML format.
Sonatype License Overrides API
Use this REST API to manage license overrides for components in your applicationsorganizations and repositories.
Sonatype Organizations API
Use this REST API to create new organizations, retrieve, edit or delete existing organizations.
Sonatype Policies API
Use this REST API to retrieve details on all existing policies in your instance of Lifecycle.
Sonatype Policy Evaluation API
Use this REST API to perform an application policy evaluation. Policy evaluations are executed asynchronously.
This is a 2-step process that involves: 1. Requesting a policy e...
Sonatype Policy Violation Details API
Use this REST API to obtain the violation details, violation details across stages (cross stage), violations occurring due to transitive dependencies and all waivers applicable ...
Sonatype Policy Waiver Reasons API
Use this rest API to fetch available policy waiver reasons
Sonatype Policy Waiver Requests API
Use this REST API to manage policy waiver requests.
Sonatype Policy Waivers API
Use this REST API to create and retrieve policy waivers.
Sonatype Product License API
Use this REST API to manage a product license.
Sonatype Reports API
Use this REST API to view application scan reports, generate a list of stale waivers, view existing policy waivers on components, view quarantined components and retrieve additi...
Sonatype Repositories API
Use this REST API to manage quarantined components.
Sonatype Role Memberships API
Use this REST API to manage authorizations for users or user groups. You can view existing role assignments and grant or revoke user authorization on organizations, applications...
Sonatype Roles API
Roles provide sets of permissions that grant access to the functionality in the user interface, through integrations, and when using REST APIs. Permissions are granted by assign...
Sonatype Security Vulnerability Overrides API
Use this REST API to retrieve security vulnerabilities that have been overridden.
Sonatype Solutions API
The Solutions API from Sonatype — 1 operation(s) for solutions.
Sonatype Source Control API
Use this REST API to:
- Create, update and delete source control management (SCM) configuration for the root organization, sub-organizations and applications.
- Autom...
Sonatype Source Control Metrics API
Use this REST API to view the response times of a source control evaluation.
Sonatype SPDX API
Use this REST API to generate SPDX SBOMs in XML or JSON formats.
Sonatype Third-Party Analysis API
Use this REST API to scan SBOMs for your applications.
Sonatype User Token Configuration API
Use this REST API to manage user token expiration configuration.
Sonatype User Tokens API
Use this REST API to manage user tokens.
Sonatype Users API
Use this REST API to manage users.
Sonatype Vulnerability Details API
Use this REST API to retrieve vulnerability details.
Scroll within the panel for all 58 ·
Open Collections 1
Open, tool-agnostic collections carry the same runnable value as Postman without locking you to one client — the portable, forkable form of the same exercise.
Open, tool-agnostic API collections (OpenAPI-derived and Bruno).
Sonatype Lifecycle Public REST API
OPEN COLLECTIONPricing Plans 1
Pricing is part of the interface. Machine-readable plans tell you what a tier costs and includes before you commit — one of the six things the Kin Score reads for commercial clarity.
Published pricing tiers and plan structures.
Rate Limits 1
Rate limits are the difference between a demo that works and a production integration that doesn't fall over. Publishing them is an operational-transparency signal — and a hard requirement for any agent that plans its own throughput.
Documented rate limits and quota policies.
Sonatype Rate Limits
RATE LIMITSFinOps 1
Cost, billing, and metering signals let a buyer model the financial operations of an API before it's live. We profile them for the same reason we profile pricing: the money is part of the contract.
Cost, billing, and metering signals for API financial operations.
Sonatype Finops
FINOPSSemantic Vocabularies 1
JSON-LD contexts give the data shared meaning across APIs. We profile them because semantics are what let a machine reconcile 'customer' here with 'customer' somewhere else.
JSON-LD contexts and semantic vocabularies used across these APIs.
Sonatype Context
JSON-LDSpectral Rules 2
Governance rulesets we run against this provider's specs — the automated checks behind parts of the score. Profiling them makes the quality bar explicit and re-runnable, not a matter of opinion.
Sonatype API Rules
SPECTRALSonatype API Rules
SPECTRALJSON Schema 2
Standalone JSON Schema definitions describe the data models behind the API. We profile them so the shapes are validatable on their own — useful long after a single request is forgotten.
Standalone JSON Schema definitions for this provider's data models.
Sonatype Lifecycle Application
JSON SCHEMASonatype Policy Violation
JSON SCHEMAJSON Structure 1
JSON Structure captures the data shapes in a form built for tooling — a complement to JSON Schema that keeps the model machine-legible.
JSON Structure definitions describing this provider's data shapes.
Sonatype Application Structure
JSON STRUCTUREExamples 2
Real request and response payloads are what turn a spec from abstract into obvious — and they're one of the twelve things an agent needs to call an API correctly on the first try.
Example request and response payloads for these APIs.
Security Posture 2
Authentication, domain security, vulnerability disclosure, and trust-center signals — the evidence that a provider takes security seriously enough to document it. We profile it because you can't govern what you can't see.
Authentication, domain security, vulnerability disclosure, and trust-center signals.
Agentic Access 1
An x-agentic-access contract marks which operations are safe for an agent to run on its own and which need a human in the loop. It is the difference between an API an agent can use and one it can use safely.
Recommended x-agentic-access execution contracts for AI agents.
Resources
Every other property we hold for Sonatype — documentation, portals, status pages, policies, and corporate surface — grouped by the job it does, following the integrator's arc from getting started to running in production.
Get Started 1
Portal, sign-up, and the first successful call
Documentation 1
Reference material describing how the API behaves
Agent Surfaces 1
MCP servers, agent skills, and machine-readable catalogs
Build 1
SDKs, sample code, and the tooling you integrate with
Access & Security 2
Authentication, authorization, and security posture
Operate 2
Status, limits, changes, and where to get help
Commercial 1
Pricing, plans, and the legal terms of use
Company 3
The organization behind the API
← All providers · Data indexed from github.com/api-evangelist/sonatype · machine-readable index on apis.io