Developers
SARIF & STIX export
Verdicts leave in the formats your pipeline already speaks — SARIF for code scanning gates, STIX 2.1 for threat intel.
01SARIF (CI gate)
GET /jobs/{id}/verdicts.sarif returns a SARIF run where each CONTRADICTED claim is an error-level result pointing at the evidence — drop it into GitHub code scanning to fail the build.
02STIX 2.1 (threat intel)
GET /jobs/{id}/verdicts.stix returns a bundle of indicators for the VERIFIED IOCs, ready to feed a TIP. Fabricated indicators never make it in — they were contradicted upstream.
More for developers