Experimental API | Qodana Documentation

Prerequisites

The experimental API requires an organization API token for authentication purposes.

Before using the experimental API, make sure that the following requirements were met:

Your Qodana Cloud organization is licensed under the Ultimate Plus license of Qodana.
You have an organization API token. To generate a token, on the organization setting page of Qodana Cloud, use the API token tab. Generating a token requires the organization Owner or Admin role in Qodana Cloud.
To authorize API requests, use the organization API token as an Authorization header bearer token:
Authorization: Bearer $organization_API_token
Use https://qodana.cloud as the base URL for Qodana Cloud API requests. If you use Qodana Self-Hosted, replace this with your custom base URL.

Get project dependencies

The dependency data returned by the experimental API matches an SPDX/JSON file available using the Download license list button in Qodana Cloud.

To return a SPDX/JSON dependency list to a specific Qodana Cloud project, send the following GET request:

GET /api/experimental/organizations/projects/{projectID}/dependencies

Here is the description of the accepted parameter:

Parameter	Type	Required	Description	Example value
`projectId`	String	Yes	ID of the project	`proj_123`

The accepted Accept values are absent or application/json.

If the stored object exists, the API responds with a redirect to a presigned URL to the projectStructure/thirdPartySoftwareList.json file; otherwise it returns 204 No Content.

Get project insights by vulnerability IDs

To retrieve project insights by vulnerability IDs, send the following POST request:

POST /api/experimental/organizations/project-insights/query

Here is the description of the request body:

Parameter	Type	Required	Description	Example value
`includeProjectIds`	array[string]	No	List of project IDs to include in the query	`["Dg9Ca", "Ec3Bb"]`
`includeInspectionIds`	array[string]	No	List of inspection IDs to include in the query	`["ReplaceMapGetOrDefault", "ObjectPrivatePropertyName"]`
`includeTeamIds`	array[string]	No	List of team IDs to include in the query	`["2rcq6", "3hen0"]`
`includeVulnerabilityIds`	array[string]	No	List of vulnerability IDs to include in the query	`["CVE-2026-109618", "CVE-2026-109619"]`
`timeRange`	object	No	Time range for the query. Contains start and end timestamps	`{"start": "2026-01-01T00:00:00Z", "end": "2026-05-12T00:00:00Z"}`

Here is the description of responses:

Response code	Description and examples
`200`	A list of projects with scan data for the given timestamp, where one entry exists for each unique combination of project ID and timestamp. If no time range is specified, entries at the latest timestamp are returned: HTTP/2 200 OK date: Wed, 24 Sep 2025 10:39:06 GMT content-type: application/json x-request-id: 7vrrlorq2ocrz957 vary: Origin content-length: 514 x-http2-stream-id: 3 { "projects": [ { "id": "proj_123", "name": "My Awesome Project", "teamId": "team_456", "teamName": "Dev Team A", "codeCoverage": { "percentage": 85, "isEnabled": true }, "licenseAudit": { "isPassed": true, "isEnabled": true }, "severityToActualProblems": { "info": 5, "low": 10, "moderate": 3, "high": 1, "critical": 0, "total": 19 }, "severityToBaselineProblems": { "info": 8, "low": 12, "moderate": 5, "high": 2, "critical": 0, "total": 27 }, "timestamp": "2026-05-12T00:00:00Z" } ] }
`400`	HTTP/2 400 Bad Request date: Wed, 24 Sep 2025 10:36:37 GMT content-type: application/json x-request-id: 89ztzxra5ptt3vio vary: Origin content-length: 67 x-http2-stream-id: 3 { "name": "NO_FILTER_SELECTION", "details": "At least one filter (includeProjectIds, includeInspectionIds, or includeTeamIds) must be provided." }
`401`	HTTP/2 401 Unauthorized date: Wed, 24 Sep 2025 10:36:37 GMT content-type: application/json x-request-id: 89zthxrm5pxt9phi vary: Origin content-length: 67 x-http2-stream-id: 3 { "name": "INVALID_TOKEN", "details": "The provided API token is expired or invalid." }
`403`	HTTP/2 403 Forbidden date: Wed, 24 Sep 2025 10:36:37 GMT content-type: application/json x-request-id: 89zthxrm5pxt9phi vary: Origin content-length: 67 x-http2-stream-id: 3 { "name": "FEATURE_NOT_SUPPORTED", "details": "Project insights are not enabled for this organization." }

Retrieve latest SARIF report

To retrieve the latest project report in SARIF format, send the following GET request:

GET /api/experimental/report/latest?branch={branch}

Here is the description of the accepted parameter:

Parameter	Type	Required	Description	Example value
`branch`	String	No	Name of the branch to retrieve the report for. If not specified, the default branch is used	`feature`

The API response does not include code snippets or full rule descriptions.