For the complete documentation index, see llms.txt. This page is also available as Markdown.

LQL

The Lineaje Query Language (LQL) is exposed on a single REST endpoint for filtering, aggregating, and visualizing data about components, vulnerabilities, and the supply chain — including Frontier Model Scanning (cwe.*) and UnifAI policy findings (findings.*, policy.*).

LQL syntax

An LQL query has up to four parts, evaluated left to right and separated by the pipe (|) character:

search_term | function parameters | command(parameters) | clause parameters

A query can contain one search term, one or more functions, one or more commands, and one or more clauses.

Search terms filter data (like a SQL WHERE clause) and support exact matching, wildcards, ranges, and logical operators:

  • package.name=log4j — exact match

  • vulnerability.severity=critical — field equals value

  • project.created>=2025-06-21 — greater than or equal

  • vulnerability.name=CVE-2021-* — wildcard matching

  • field1=value1 $OR field2=value2 — logical grouping

Functions aggregate or transform data:

  • | stats count(package.name) — count package names

  • | stats unique_count(package.name) — count distinct package names

  • | stats avg(irl.irl_score) — average IRL score

  • | chart table(field1, field2) — format as a table

Commands change how results are processed/presented (inspired by Splunk SPL), applied with the pipe symbol:

  • | sort(field:asc) — sort ascending

  • | collapse(field) — group by field, top document per group

  • | collapse_latest(field) — group by field, latest document per group

  • | boost(field1:3.0, field2:1.5) — increase match relevance

Clauses modify how functions operate; the most common is by:

  • | stats unique_count(project.name) by vulnerability.severity

  • | chart table(field1, field2) by group_field

  • | stats count(project.name) by (package.name, project.organisation) — nested grouping

Evaluation order. Queries evaluate strictly left to right. Operators work between fields (field1=value $AND field2=value) and within a field (field=value1 $OR value2).

Best practices. Be specific to improve performance; split complex aggregations into multiple queries; avoid wildcards for exact matches; use ISO dates (YYYY-MM-DD); use chart table with a limited field set for readability.

Search term operators

Operator
Meaning
Example

field=value

Exact match

vulnerability.severity=critical

field=value with spaces

Exact match with spaces

project.name=Apache Software Foundation

field=*

Any value (exists)

vulnerability.severity=*

field=value*

Starts with

vulnerability.name=CVE-28*

field=*value*

Contains

vulnerability.name=*VE-28*

field!=value

Not equal

vulnerability.exploited!=true

field>value

Greater than

project.created > 2025-06-24

field>=value

Greater than or equal

risk_level.score >= 9

field<value

Less than

project.created < 2025-06-24

field<=value

Less than or equal

risk_level.score <= 9

Logical operators

Operator
Meaning

field1=value1 $AND field2=value2

Both conditions must be true

field1=value1 $OR field2=value2

Either condition must be true

field=value1 $AND value2

Field equals value1 AND value2

field=value1 $OR value2

Field equals either value1 OR value2

Functions

Function
Meaning

| stats avg(field1, ...)

Average values of field

| stats count(field1, ...)

Count occurrences of field

| stats max(field1, ...)

Maximum value of field

| stats min(field1, ...)

Minimum value of field

| stats sum(field1, ...)

Sum values of field

| stats unique(field1, ...)

Get unique values of field

| stats unique_values(field1, ...)

Get unique values of field

| stats unique_count(field1, ...)

Count unique values of field

| stats top_hits(10)

Top 10 hits for the search term results

| chart table(field1, ...)

Format as table with specified fields

| chart table_fold(field1, ...)

Format as folded table

| chart histogram(field1, ...)

Create histogram of field values

Commands

Command
Meaning

| sort(field:asc)

Sort ascending

| sort(field:desc)

Sort descending

| sort(field1:asc, field2:desc)

Sort by multiple fields

| collapse(field)

Group by field, top document per group

| collapse_latest(field)

Group by field, latest document per group

| boost(field1:2.0, field2:1.5)

Boost relevance of specific fields

| histogram_interval(field1:day, field2:month, field3:100)

Set histogram interval for date fields

Clauses

Clause
Meaning

| stats <fn>(field1, ...) by (field4, ...)

Aggregate grouped by one or more fields

| chart table(field1, ...) by (field4, ...)

Table grouped by one or more fields

| chart table_fold(field1, ...) by (field4, ...)

Folded table grouped by fields

| chart histogram(field1, ...) by (field4, ...)

Histogram grouped by fields

Field glossary (selected)

Package: package.purl, package.name, package.version, package.pkg_manager, package.download_loc, package.checksum.md5, package.checksum.sha1, package.checksum.sha256, package.checksum.sha512, package.description, package.last_modified, package.license, package.license.url, package.license.short_id, package.license.full_name, package.license.version, package.license.is_opensource, package.supplier, package.supplier_info.name, package.supplier_info.org, package.supplier_info.home_page, package.supplier_info.is_verified, package.total_vulnerability_count, package.total_fixed_vulnerability_count, package.category, package.classification, package.cpes, package.desc, package.file_name, package.friendly_name, package.id, package.scope, package.vuln_fixed_info.*.

Image: image.name, image.version, image.os, image.tags, image.manifest, image.owner, image.size, image.architecture, image.repo_checksum, image.download_loc, image.layer.checksum.sha256, image.layer.size, image.config, image.docker_version, image.image_created.

Vulnerability: vulnerability.name, vulnerability.score, vulnerability.severity, vulnerability.base_score, vulnerability.name_space, vulnerability.description, vulnerability.vector, vulnerability.vuln_created, vulnerability.vuln_modified, vulnerability.vuln_withdrawn, vulnerability.fix_state, vulnerability.fix_versions, vulnerability.impact_score, vulnerability.is_exploited, vulnerability.exploitability_score, vulnerability.affected_versions, vulnerability.category, vulnerability.collector, vulnerability.created, vulnerability.cvs_version, vulnerability.data_source, vulnerability.origin, vulnerability.package.name, vulnerability.package.version, vulnerability.package_purl, vulnerability.target.

Frontier Model Scanning (CWE): cwe.cwe_id, cwe.severity, cwe.reachability, cwe.location, cwe.source_model, cwe.title, cwe.bug_class, cwe.sha3_hash, cwe.technical_details, cwe.reproduction, cwe.usage.input_tokens, cwe.usage.output_tokens, cwe.usage.cache_creation_input_tokens, cwe.usage.cache_read_input_tokens, cwe.cost_estimate, cwe.scan_duration_seconds, cwe.confidence.

Findings & Policy (UnifAI): findings.policy_name, findings.policy_severity, findings.created, findings.id, findings.doc_type, findings.doc_created, findings.file_name, file_location, findings.component_search_link, findings.external_policy_finding_id, findings.entity_type, findings.category, findings.type, policy.id, policy.name, policy.type, policy.severity, policy.category, policy.is_enabled, policy.module_name, policy.module_version, policy.domain, policy.url, policy.ai_policy_id, policy.compliance_frameworks, policy.applies_to, policy.guardrail, gate.id, gate.name, gate.stage, gate.category, gate.integration_type, gate.is_enabled.

SBOM: sbom.document_name, sbom.id, sbom.org_name, sbom.version, sbom.supplier, sbom.url.

Project: project.id, project.name, project.org_name, project.organisation, project.created.

Attestation & Risk Score: attestation_level.lcal, risk_level.score, risk_level.severity.

Security Posture: security_posture.name, security_posture.score, security_posture.severity, security_posture.reason, security_posture.desc, security_posture.entropy, security_posture.author, security_posture.commit, security_posture.created, security_posture.language, security_posture.loc, security_posture.rule_id, security_posture.source_link, security_posture.checksum.sha256.

Code Quality: code_quality.name, code_quality.score, code_quality.severity, code_quality.reason, code_quality.desc, code_quality.author, code_quality.commit, code_quality.created, code_quality.language, code_quality.loc, code_quality.rule_id, code_quality.source_link, code_quality.checksum.sha256.

Source Code: source_code.loc, source_code.url, source_code.version, source_code.tag, source_code.name, source_code.friendly_name, source_code.score, source_code.code_quality_score, source_code.security_posture_score, source_code.contributors_count, source_code.total_commits, source_code.first_commit, source_code.last_commit, source_code.is_opensource, source_code.is_suspicious_activity, source_code.languages, source_code.latest_version, source_code.latest_version_date, source_code.direct_dep_count, source_code.transitive_dep_count.

Provenance & Commits: provenance.country.code, provenance.country_code, provenance.timezone, provenance.count, provenance.contributor.name, provenance.contributor.email, provenance.contributor.commit_count, provenance.contributor.commits, provenance.contributor.is_suspicious, provenance.contributor.link, commits.commit, commits.count, commits.contributor_commit_count, commits.country_code, commits.timezone, commits.contributor.name, commits.contributor.email, commits.contributor.country.code, commits.contributor.is_suspicious.

Contributor: contributor.name, contributor.email, contributor.id, contributor.commits, contributor.is_suspicious, contributor.link, commit.contributor.commit_count, commit.contributor.country.code, commit.contributor.email, commit.contributor.name.

License: license.name, license.full_name, license.short_id, license.url, license.category, license.component_category, license.version, license.license_id, license.is_opensource, license.is_osi_approved, license.is_deprecated, license.is_fsf_libre, license.details_url, license.reference_number, license.references.

Supplier: supplier.name, supplier_info.name, supplier.is_verified, supplier.verified, supplier.organisation.

Query components with LQL

post

Run a Lineaje Query Language (LQL) query. Provide the query in the lql body field. Use the company-id and product-id headers to scope the request. See the LQL tag description for full syntax, operators, and the field glossary.

Namespaces include package.*, image.*, vulnerability.*, security_posture.*, code_quality.*, source_code.*, commits.*, provenance.*, license.*, supplier.*, cwe.* (Frontier Model Scanning), and findings.*/policy.* (UnifAI).

Authorizations
AuthorizationstringRequired

Short-lived access token from the login or renew-access-token endpoint.

Header parameters
company-idstringOptionalExample: <company_id>
product-idstringOptionalExample: 1
Body
lqlstringRequired

The LQL query. See the LQL tag description for full syntax.

Example: package.name=log4j*
limitintegerOptional

Total items in the response.

Example: 10
page_nointegerOptional

Page number.

Example: 1
is_opensourcebooleanOptionalExample: true
include_raw_databooleanOptionalExample: false
agg_limitinteger · nullableOptional
company_idstringOptionalExample: <company_id>
product_idintegerOptionalExample: 1
valueschemastringOptionalExample: valueSchema
Responses
200

Query result. The shape depends on the query: a bare search term returns raw matching documents; chart table(...) returns the selected columns; stats ... returns aggregates.

application/json
Other propertiesanyOptional
post/api/v2/lql/components
POST /api/v2/lql/components HTTP/1.1
Host: data-service-v2-apigw.v2.prod.veedna.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 39

{
  "lql": "package.name=log4j*",
  "limit": 1
}
200

Query result. The shape depends on the query: a bare search term returns raw matching documents; chart table(...) returns the selected columns; stats ... returns aggregates.

{
  "ANY_ADDITIONAL_PROPERTY": "anything"
}

Last updated