> For the complete documentation index, see [llms.txt](https://docs.veedna.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veedna.com/lineaje-api/lql.md). # LQL The Lineaje Query Language (LQL) is exposed on a single REST endpoint for filtering, aggregating, and visualizing data about components, vulnerabilities, and the supply chain — including Frontier Model Scanning (`cwe.*`) and UnifAI policy findings (`findings.*`, `policy.*`). ### LQL syntax An LQL query has up to four parts, evaluated left to right and separated by the pipe (`|`) character: ``` search_term | function parameters | command(parameters) | clause parameters ``` A query can contain one search term, one or more functions, one or more commands, and one or more clauses. **Search terms** filter data (like a SQL WHERE clause) and support exact matching, wildcards, ranges, and logical operators: * `package.name=log4j` — exact match * `vulnerability.severity=critical` — field equals value * `project.created>=2025-06-21` — greater than or equal * `vulnerability.name=CVE-2021-*` — wildcard matching * `field1=value1 $OR field2=value2` — logical grouping **Functions** aggregate or transform data: * `| stats count(package.name)` — count package names * `| stats unique_count(package.name)` — count distinct package names * `| stats avg(irl.irl_score)` — average IRL score * `| chart table(field1, field2)` — format as a table **Commands** change how results are processed/presented (inspired by Splunk SPL), applied with the pipe symbol: * `| sort(field:asc)` — sort ascending * `| collapse(field)` — group by field, top document per group * `| collapse_latest(field)` — group by field, latest document per group * `| boost(field1:3.0, field2:1.5)` — increase match relevance **Clauses** modify how functions operate; the most common is `by`: * `| stats unique_count(project.name) by vulnerability.severity` * `| chart table(field1, field2) by group_field` * `| stats count(project.name) by (package.name, project.organisation)` — nested grouping **Evaluation order.** Queries evaluate strictly left to right. Operators work between fields (`field1=value $AND field2=value`) and within a field (`field=value1 $OR value2`). **Best practices.** Be specific to improve performance; split complex aggregations into multiple queries; avoid wildcards for exact matches; use ISO dates (YYYY-MM-DD); use `chart table` with a limited field set for readability. ### Search term operators | Operator | Meaning | Example | | ------------------------- | ----------------------- | ----------------------------------------- | | `field=value` | Exact match | `vulnerability.severity=critical` | | `field=value with spaces` | Exact match with spaces | `project.name=Apache Software Foundation` | | `field=*` | Any value (exists) | `vulnerability.severity=*` | | `field=value*` | Starts with | `vulnerability.name=CVE-28*` | | `field=*value*` | Contains | `vulnerability.name=*VE-28*` | | `field!=value` | Not equal | `vulnerability.exploited!=true` | | `field>value` | Greater than | `project.created > 2025-06-24` | | `field>=value` | Greater than or equal | `risk_level.score >= 9` | | `field(field1, ...) by (field4, ...)` | Aggregate grouped by one or more fields | | `\| chart table(field1, ...) by (field4, ...)` | Table grouped by one or more fields | | `\| chart table_fold(field1, ...) by (field4, ...)` | Folded table grouped by fields | | `\| chart histogram(field1, ...) by (field4, ...)` | Histogram grouped by fields | ### Field glossary (selected) **Package:** `package.purl`, `package.name`, `package.version`, `package.pkg_manager`, `package.download_loc`, `package.checksum.md5`, `package.checksum.sha1`, `package.checksum.sha256`, `package.checksum.sha512`, `package.description`, `package.last_modified`, `package.license`, `package.license.url`, `package.license.short_id`, `package.license.full_name`, `package.license.version`, `package.license.is_opensource`, `package.supplier`, `package.supplier_info.name`, `package.supplier_info.org`, `package.supplier_info.home_page`, `package.supplier_info.is_verified`, `package.total_vulnerability_count`, `package.total_fixed_vulnerability_count`, `package.category`, `package.classification`, `package.cpes`, `package.desc`, `package.file_name`, `package.friendly_name`, `package.id`, `package.scope`, `package.vuln_fixed_info.*`. **Image:** `image.name`, `image.version`, `image.os`, `image.tags`, `image.manifest`, `image.owner`, `image.size`, `image.architecture`, `image.repo_checksum`, `image.download_loc`, `image.layer.checksum.sha256`, `image.layer.size`, `image.config`, `image.docker_version`, `image.image_created`. **Vulnerability:** `vulnerability.name`, `vulnerability.score`, `vulnerability.severity`, `vulnerability.base_score`, `vulnerability.name_space`, `vulnerability.description`, `vulnerability.vector`, `vulnerability.vuln_created`, `vulnerability.vuln_modified`, `vulnerability.vuln_withdrawn`, `vulnerability.fix_state`, `vulnerability.fix_versions`, `vulnerability.impact_score`, `vulnerability.is_exploited`, `vulnerability.exploitability_score`, `vulnerability.affected_versions`, `vulnerability.category`, `vulnerability.collector`, `vulnerability.created`, `vulnerability.cvs_version`, `vulnerability.data_source`, `vulnerability.origin`, `vulnerability.package.name`, `vulnerability.package.version`, `vulnerability.package_purl`, `vulnerability.target`. **Frontier Model Scanning (CWE):** `cwe.cwe_id`, `cwe.severity`, `cwe.reachability`, `cwe.location`, `cwe.source_model`, `cwe.title`, `cwe.bug_class`, `cwe.sha3_hash`, `cwe.technical_details`, `cwe.reproduction`, `cwe.usage.input_tokens`, `cwe.usage.output_tokens`, `cwe.usage.cache_creation_input_tokens`, `cwe.usage.cache_read_input_tokens`, `cwe.cost_estimate`, `cwe.scan_duration_seconds`, `cwe.confidence`. **Findings & Policy (UnifAI):** `findings.policy_name`, `findings.policy_severity`, `findings.created`, `findings.id`, `findings.doc_type`, `findings.doc_created`, `findings.file_name`, `file_location`, `findings.component_search_link`, `findings.external_policy_finding_id`, `findings.entity_type`, `findings.category`, `findings.type`, `policy.id`, `policy.name`, `policy.type`, `policy.severity`, `policy.category`, `policy.is_enabled`, `policy.module_name`, `policy.module_version`, `policy.domain`, `policy.url`, `policy.ai_policy_id`, `policy.compliance_frameworks`, `policy.applies_to`, `policy.guardrail`, `gate.id`, `gate.name`, `gate.stage`, `gate.category`, `gate.integration_type`, `gate.is_enabled`. **SBOM:** `sbom.document_name`, `sbom.id`, `sbom.org_name`, `sbom.version`, `sbom.supplier`, `sbom.url`. **Project:** `project.id`, `project.name`, `project.org_name`, `project.organisation`, `project.created`. **Attestation & Risk Score:** `attestation_level.lcal`, `risk_level.score`, `risk_level.severity`. **Security Posture:** `security_posture.name`, `security_posture.score`, `security_posture.severity`, `security_posture.reason`, `security_posture.desc`, `security_posture.entropy`, `security_posture.author`, `security_posture.commit`, `security_posture.created`, `security_posture.language`, `security_posture.loc`, `security_posture.rule_id`, `security_posture.source_link`, `security_posture.checksum.sha256`. **Code Quality:** `code_quality.name`, `code_quality.score`, `code_quality.severity`, `code_quality.reason`, `code_quality.desc`, `code_quality.author`, `code_quality.commit`, `code_quality.created`, `code_quality.language`, `code_quality.loc`, `code_quality.rule_id`, `code_quality.source_link`, `code_quality.checksum.sha256`. **Source Code:** `source_code.loc`, `source_code.url`, `source_code.version`, `source_code.tag`, `source_code.name`, `source_code.friendly_name`, `source_code.score`, `source_code.code_quality_score`, `source_code.security_posture_score`, `source_code.contributors_count`, `source_code.total_commits`, `source_code.first_commit`, `source_code.last_commit`, `source_code.is_opensource`, `source_code.is_suspicious_activity`, `source_code.languages`, `source_code.latest_version`, `source_code.latest_version_date`, `source_code.direct_dep_count`, `source_code.transitive_dep_count`. **Provenance & Commits:** `provenance.country.code`, `provenance.country_code`, `provenance.timezone`, `provenance.count`, `provenance.contributor.name`, `provenance.contributor.email`, `provenance.contributor.commit_count`, `provenance.contributor.commits`, `provenance.contributor.is_suspicious`, `provenance.contributor.link`, `commits.commit`, `commits.count`, `commits.contributor_commit_count`, `commits.country_code`, `commits.timezone`, `commits.contributor.name`, `commits.contributor.email`, `commits.contributor.country.code`, `commits.contributor.is_suspicious`. **Contributor:** `contributor.name`, `contributor.email`, `contributor.id`, `contributor.commits`, `contributor.is_suspicious`, `contributor.link`, `commit.contributor.commit_count`, `commit.contributor.country.code`, `commit.contributor.email`, `commit.contributor.name`. **License:** `license.name`, `license.full_name`, `license.short_id`, `license.url`, `license.category`, `license.component_category`, `license.version`, `license.license_id`, `license.is_opensource`, `license.is_osi_approved`, `license.is_deprecated`, `license.is_fsf_libre`, `license.details_url`, `license.reference_number`, `license.references`. **Supplier:** `supplier.name`, `supplier_info.name`, `supplier.is_verified`, `supplier.verified`, `supplier.organisation`. ## Query components with LQL > Run a Lineaje Query Language (LQL) query. Provide the query in the \`lql\` body field. Use the \`company-id\` and \`product-id\` headers to scope the request. See the LQL tag description for full syntax, operators, and the field glossary.\ > \ > Namespaces include \`package.\*\`, \`image.\*\`, \`vulnerability.\*\`, \`security\_posture.\*\`, \`code\_quality.\*\`, \`source\_code.\*\`, \`commits.\*\`, \`provenance.\*\`, \`license.\*\`, \`supplier.\*\`, \`cwe.\*\` (Frontier Model Scanning), and \`findings.\*\`/\`policy.\*\` (UnifAI).
````json {"openapi":"3.0.3","info":{"title":"Lineaje API Documentation","version":"1.0.0"},"tags":[{"name":"LQL","description":"The Lineaje Query Language (LQL) is exposed on a single REST endpoint for\nfiltering, aggregating, and visualizing data about components,\nvulnerabilities, and the supply chain — including Frontier Model Scanning\n(`cwe.*`) and UnifAI policy findings (`findings.*`, `policy.*`).\n\n## LQL syntax\n\nAn LQL query has up to four parts, evaluated left to right and separated by\nthe pipe (`|`) character:\n\n```\nsearch_term | function parameters | command(parameters) | clause parameters\n```\n\nA query can contain one search term, one or more functions, one or more\ncommands, and one or more clauses.\n\n**Search terms** filter data (like a SQL WHERE clause) and support exact\nmatching, wildcards, ranges, and logical operators:\n\n- `package.name=log4j` — exact match\n- `vulnerability.severity=critical` — field equals value\n- `project.created>=2025-06-21` — greater than or equal\n- `vulnerability.name=CVE-2021-*` — wildcard matching\n- `field1=value1 $OR field2=value2` — logical grouping\n\n**Functions** aggregate or transform data:\n\n- `| stats count(package.name)` — count package names\n- `| stats unique_count(package.name)` — count distinct package names\n- `| stats avg(irl.irl_score)` — average IRL score\n- `| chart table(field1, field2)` — format as a table\n\n**Commands** change how results are processed/presented (inspired by\nSplunk SPL), applied with the pipe symbol:\n\n- `| sort(field:asc)` — sort ascending\n- `| collapse(field)` — group by field, top document per group\n- `| collapse_latest(field)` — group by field, latest document per group\n- `| boost(field1:3.0, field2:1.5)` — increase match relevance\n\n**Clauses** modify how functions operate; the most common is `by`:\n\n- `| stats unique_count(project.name) by vulnerability.severity`\n- `| chart table(field1, field2) by group_field`\n- `| stats count(project.name) by (package.name, project.organisation)` — nested grouping\n\n**Evaluation order.** Queries evaluate strictly left to right. Operators\nwork between fields (`field1=value $AND field2=value`) and within a field\n(`field=value1 $OR value2`).\n\n**Best practices.** Be specific to improve performance; split complex\naggregations into multiple queries; avoid wildcards for exact matches; use\nISO dates (YYYY-MM-DD); use `chart table` with a limited field set for\nreadability.\n\n## Search term operators\n\n| Operator | Meaning | Example |\n|---|---|---|\n| `field=value` | Exact match | `vulnerability.severity=critical` |\n| `field=value with spaces` | Exact match with spaces | `project.name=Apache Software Foundation` |\n| `field=*` | Any value (exists) | `vulnerability.severity=*` |\n| `field=value*` | Starts with | `vulnerability.name=CVE-28*` |\n| `field=*value*` | Contains | `vulnerability.name=*VE-28*` |\n| `field!=value` | Not equal | `vulnerability.exploited!=true` |\n| `field>value` | Greater than | `project.created > 2025-06-24` |\n| `field>=value` | Greater than or equal | `risk_level.score >= 9` |\n| `field(field1, ...) by (field4, ...)` | Aggregate grouped by one or more fields |\n| `\\| chart table(field1, ...) by (field4, ...)` | Table grouped by one or more fields |\n| `\\| chart table_fold(field1, ...) by (field4, ...)` | Folded table grouped by fields |\n| `\\| chart histogram(field1, ...) by (field4, ...)` | Histogram grouped by fields |\n\n## Field glossary (selected)\n\n**Package:** `package.purl`, `package.name`, `package.version`,\n`package.pkg_manager`, `package.download_loc`, `package.checksum.md5`,\n`package.checksum.sha1`, `package.checksum.sha256`, `package.checksum.sha512`,\n`package.description`, `package.last_modified`, `package.license`,\n`package.license.url`, `package.license.short_id`, `package.license.full_name`,\n`package.license.version`, `package.license.is_opensource`, `package.supplier`,\n`package.supplier_info.name`, `package.supplier_info.org`,\n`package.supplier_info.home_page`, `package.supplier_info.is_verified`,\n`package.total_vulnerability_count`, `package.total_fixed_vulnerability_count`,\n`package.category`, `package.classification`, `package.cpes`, `package.desc`,\n`package.file_name`, `package.friendly_name`, `package.id`, `package.scope`,\n`package.vuln_fixed_info.*`.\n\n**Image:** `image.name`, `image.version`, `image.os`, `image.tags`,\n`image.manifest`, `image.owner`, `image.size`, `image.architecture`,\n`image.repo_checksum`, `image.download_loc`, `image.layer.checksum.sha256`,\n`image.layer.size`, `image.config`, `image.docker_version`, `image.image_created`.\n\n**Vulnerability:** `vulnerability.name`, `vulnerability.score`,\n`vulnerability.severity`, `vulnerability.base_score`, `vulnerability.name_space`,\n`vulnerability.description`, `vulnerability.vector`, `vulnerability.vuln_created`,\n`vulnerability.vuln_modified`, `vulnerability.vuln_withdrawn`,\n`vulnerability.fix_state`, `vulnerability.fix_versions`, `vulnerability.impact_score`,\n`vulnerability.is_exploited`, `vulnerability.exploitability_score`,\n`vulnerability.affected_versions`, `vulnerability.category`, `vulnerability.collector`,\n`vulnerability.created`, `vulnerability.cvs_version`, `vulnerability.data_source`,\n`vulnerability.origin`, `vulnerability.package.name`, `vulnerability.package.version`,\n`vulnerability.package_purl`, `vulnerability.target`.\n\n**Frontier Model Scanning (CWE):** `cwe.cwe_id`, `cwe.severity`,\n`cwe.reachability`, `cwe.location`, `cwe.source_model`, `cwe.title`,\n`cwe.bug_class`, `cwe.sha3_hash`, `cwe.technical_details`, `cwe.reproduction`,\n`cwe.usage.input_tokens`, `cwe.usage.output_tokens`,\n`cwe.usage.cache_creation_input_tokens`, `cwe.usage.cache_read_input_tokens`,\n`cwe.cost_estimate`, `cwe.scan_duration_seconds`, `cwe.confidence`.\n\n**Findings & Policy (UnifAI):** `findings.policy_name`, `findings.policy_severity`,\n`findings.created`, `findings.id`, `findings.doc_type`, `findings.doc_created`,\n`findings.file_name`, `file_location`, `findings.component_search_link`,\n`findings.external_policy_finding_id`, `findings.entity_type`, `findings.category`,\n`findings.type`, `policy.id`, `policy.name`, `policy.type`, `policy.severity`,\n`policy.category`, `policy.is_enabled`, `policy.module_name`, `policy.module_version`,\n`policy.domain`, `policy.url`, `policy.ai_policy_id`, `policy.compliance_frameworks`,\n`policy.applies_to`, `policy.guardrail`, `gate.id`, `gate.name`, `gate.stage`,\n`gate.category`, `gate.integration_type`, `gate.is_enabled`.\n\n**SBOM:** `sbom.document_name`, `sbom.id`, `sbom.org_name`, `sbom.version`,\n`sbom.supplier`, `sbom.url`.\n\n**Project:** `project.id`, `project.name`, `project.org_name`,\n`project.organisation`, `project.created`.\n\n**Attestation & Risk Score:** `attestation_level.lcal`, `risk_level.score`,\n`risk_level.severity`.\n\n**Security Posture:** `security_posture.name`, `security_posture.score`,\n`security_posture.severity`, `security_posture.reason`, `security_posture.desc`,\n`security_posture.entropy`, `security_posture.author`, `security_posture.commit`,\n`security_posture.created`, `security_posture.language`, `security_posture.loc`,\n`security_posture.rule_id`, `security_posture.source_link`,\n`security_posture.checksum.sha256`.\n\n**Code Quality:** `code_quality.name`, `code_quality.score`,\n`code_quality.severity`, `code_quality.reason`, `code_quality.desc`,\n`code_quality.author`, `code_quality.commit`, `code_quality.created`,\n`code_quality.language`, `code_quality.loc`, `code_quality.rule_id`,\n`code_quality.source_link`, `code_quality.checksum.sha256`.\n\n**Source Code:** `source_code.loc`, `source_code.url`, `source_code.version`,\n`source_code.tag`, `source_code.name`, `source_code.friendly_name`,\n`source_code.score`, `source_code.code_quality_score`,\n`source_code.security_posture_score`, `source_code.contributors_count`,\n`source_code.total_commits`, `source_code.first_commit`, `source_code.last_commit`,\n`source_code.is_opensource`, `source_code.is_suspicious_activity`,\n`source_code.languages`, `source_code.latest_version`,\n`source_code.latest_version_date`, `source_code.direct_dep_count`,\n`source_code.transitive_dep_count`.\n\n**Provenance & Commits:** `provenance.country.code`, `provenance.country_code`,\n`provenance.timezone`, `provenance.count`, `provenance.contributor.name`,\n`provenance.contributor.email`, `provenance.contributor.commit_count`,\n`provenance.contributor.commits`, `provenance.contributor.is_suspicious`,\n`provenance.contributor.link`, `commits.commit`, `commits.count`,\n`commits.contributor_commit_count`, `commits.country_code`, `commits.timezone`,\n`commits.contributor.name`, `commits.contributor.email`,\n`commits.contributor.country.code`, `commits.contributor.is_suspicious`.\n\n**Contributor:** `contributor.name`, `contributor.email`, `contributor.id`,\n`contributor.commits`, `contributor.is_suspicious`, `contributor.link`,\n`commit.contributor.commit_count`, `commit.contributor.country.code`,\n`commit.contributor.email`, `commit.contributor.name`.\n\n**License:** `license.name`, `license.full_name`, `license.short_id`,\n`license.url`, `license.category`, `license.component_category`,\n`license.version`, `license.license_id`, `license.is_opensource`,\n`license.is_osi_approved`, `license.is_deprecated`, `license.is_fsf_libre`,\n`license.details_url`, `license.reference_number`, `license.references`.\n\n**Supplier:** `supplier.name`, `supplier_info.name`, `supplier.is_verified`,\n`supplier.verified`, `supplier.organisation`.\n"}],"servers":[{"url":"https://data-service-v2-apigw.v2.prod.veedna.com","description":"Data service API gateway"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","description":"Short-lived access token from the login or renew-access-token endpoint."}},"schemas":{"LqlRequest":{"type":"object","required":["lql"],"properties":{"lql":{"type":"string","description":"The LQL query. See the LQL tag description for full syntax."},"limit":{"type":"integer","description":"Total items in the response."},"page_no":{"type":"integer","description":"Page number."},"is_opensource":{"type":"boolean"},"include_raw_data":{"type":"boolean"},"agg_limit":{"type":"integer","nullable":true},"company_id":{"type":"string"},"product_id":{"type":"integer"},"valueschema":{"type":"string"}}}}},"paths":{"/api/v2/lql/components":{"post":{"tags":["LQL"],"summary":"Query components with LQL","operationId":"lqlComponents","description":"Run a Lineaje Query Language (LQL) query. Provide the query in the `lql` body field. Use the `company-id` and `product-id` headers to scope the request. See the LQL tag description for full syntax, operators, and the field glossary.\n\nNamespaces include `package.*`, `image.*`, `vulnerability.*`, `security_posture.*`, `code_quality.*`, `source_code.*`, `commits.*`, `provenance.*`, `license.*`, `supplier.*`, `cwe.*` (Frontier Model Scanning), and `findings.*`/`policy.*` (UnifAI).\n","parameters":[{"name":"company-id","in":"header","required":false,"schema":{"type":"string"}},{"name":"product-id","in":"header","required":false,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LqlRequest"}}}},"responses":{"200":{"description":"Query result. The shape depends on the query: a bare search term returns raw matching documents; `chart table(...)` returns the selected columns; `stats ...` returns aggregates.\n","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}}}} ```` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.veedna.com/lineaje-api/lql.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.