LQL

The Lineaje Query Language (LQL) is exposed on a single REST endpoint for filtering, aggregating, and visualizing data about components, vulnerabilities, and the supply chain — including Frontier Model Scanning (cwe.*) and UnifAI policy findings (findings.*, policy.*).

LQL syntax

An LQL query has up to four parts, evaluated left to right and separated by the pipe (|) character:

search_term | function parameters | command(parameters) | clause parameters

A query can contain one search term, one or more functions, one or more commands, and one or more clauses.

Search terms filter data (like a SQL WHERE clause) and support exact matching, wildcards, ranges, and logical operators:

• package.name=log4j — exact match

• vulnerability.severity=critical — field equals value

• project.created>=2025-06-21 — greater than or equal

• vulnerability.name=CVE-2021-* — wildcard matching

• field1=value1 $OR field2=value2 — logical grouping

Functions aggregate or transform data:

• | stats count(package.name) — count package names

• | stats unique_count(package.name) — count distinct package names

• | stats avg(irl.irl_score) — average IRL score

• | chart table(field1, field2) — format as a table

Commands change how results are processed/presented (inspired by Splunk SPL), applied with the pipe symbol:

• | sort(field:asc) — sort ascending

• | collapse(field) — group by field, top document per group

• | collapse_latest(field) — group by field, latest document per group

• | boost(field1:3.0, field2:1.5) — increase match relevance

Clauses modify how functions operate; the most common is by:

• | stats unique_count(project.name) by vulnerability.severity

• | chart table(field1, field2) by group_field

• | stats count(project.name) by (package.name, project.organisation) — nested grouping

Evaluation order. Queries evaluate strictly left to right. Operators work between fields (field1=value $AND field2=value) and within a field (field=value1 $OR value2).

Best practices. Be specific to improve performance; split complex aggregations into multiple queries; avoid wildcards for exact matches; use ISO dates (YYYY-MM-DD); use chart table with a limited field set for readability.

Search term operators

Operator	Meaning	Example
field=value	Exact match	vulnerability.severity=critical
field=value with spaces	Exact match with spaces	project.name=Apache Software Foundation
field=*	Any value (exists)	vulnerability.severity=*
field=value*	Starts with	vulnerability.name=CVE-28*
field=*value*	Contains	vulnerability.name=*VE-28*
field!=value	Not equal	vulnerability.exploited!=true
field>value	Greater than	project.created > 2025-06-24
field>=value	Greater than or equal	risk_level.score >= 9
field<value	Less than	project.created < 2025-06-24
field<=value	Less than or equal	risk_level.score <= 9

Logical operators

Operator	Meaning
field1=value1 $AND field2=value2	Both conditions must be true
field1=value1 $OR field2=value2	Either condition must be true
field=value1 $AND value2	Field equals value1 AND value2
field=value1 $OR value2	Field equals either value1 OR value2

Functions

Function	Meaning
| stats avg(field1, ...)	Average values of field
| stats count(field1, ...)	Count occurrences of field
| stats max(field1, ...)	Maximum value of field
| stats min(field1, ...)	Minimum value of field
| stats sum(field1, ...)	Sum values of field
| stats unique(field1, ...)	Get unique values of field
| stats unique_values(field1, ...)	Get unique values of field
| stats unique_count(field1, ...)	Count unique values of field
| stats top_hits(10)	Top 10 hits for the search term results
| chart table(field1, ...)	Format as table with specified fields
| chart table_fold(field1, ...)	Format as folded table
| chart histogram(field1, ...)	Create histogram of field values

Commands

Command	Meaning
| sort(field:asc)	Sort ascending
| sort(field:desc)	Sort descending
| sort(field1:asc, field2:desc)	Sort by multiple fields
| collapse(field)	Group by field, top document per group
| collapse_latest(field)	Group by field, latest document per group
| boost(field1:2.0, field2:1.5)	Boost relevance of specific fields
| histogram_interval(field1:day, field2:month, field3:100)	Set histogram interval for date fields

Clauses

Clause	Meaning
| stats <fn>(field1, ...) by (field4, ...)	Aggregate grouped by one or more fields
| chart table(field1, ...) by (field4, ...)	Table grouped by one or more fields
| chart table_fold(field1, ...) by (field4, ...)	Folded table grouped by fields
| chart histogram(field1, ...) by (field4, ...)	Histogram grouped by fields

Field glossary (selected)

Package: package.purl, package.name, package.version, package.pkg_manager, package.download_loc, package.checksum.md5, package.checksum.sha1, package.checksum.sha256, package.checksum.sha512, package.description, package.last_modified, package.license, package.license.url, package.license.short_id, package.license.full_name, package.license.version, package.license.is_opensource, package.supplier, package.supplier_info.name, package.supplier_info.org, package.supplier_info.home_page, package.supplier_info.is_verified, package.total_vulnerability_count, package.total_fixed_vulnerability_count, package.category, package.classification, package.cpes, package.desc, package.file_name, package.friendly_name, package.id, package.scope, package.vuln_fixed_info.*.

Image: image.name, image.version, image.os, image.tags, image.manifest, image.owner, image.size, image.architecture, image.repo_checksum, image.download_loc, image.layer.checksum.sha256, image.layer.size, image.config, image.docker_version, image.image_created.

Vulnerability: vulnerability.name, vulnerability.score, vulnerability.severity, vulnerability.base_score, vulnerability.name_space, vulnerability.description, vulnerability.vector, vulnerability.vuln_created, vulnerability.vuln_modified, vulnerability.vuln_withdrawn, vulnerability.fix_state, vulnerability.fix_versions, vulnerability.impact_score, vulnerability.is_exploited, vulnerability.exploitability_score, vulnerability.affected_versions, vulnerability.category, vulnerability.collector, vulnerability.created, vulnerability.cvs_version, vulnerability.data_source, vulnerability.origin, vulnerability.package.name, vulnerability.package.version, vulnerability.package_purl, vulnerability.target.

Frontier Model Scanning (CWE): cwe.cwe_id, cwe.severity, cwe.reachability, cwe.location, cwe.source_model, cwe.title, cwe.bug_class, cwe.sha3_hash, cwe.technical_details, cwe.reproduction, cwe.usage.input_tokens, cwe.usage.output_tokens, cwe.usage.cache_creation_input_tokens, cwe.usage.cache_read_input_tokens, cwe.cost_estimate, cwe.scan_duration_seconds, cwe.confidence.

Findings & Policy (UnifAI): findings.policy_name, findings.policy_severity, findings.created, findings.id, findings.doc_type, findings.doc_created, findings.file_name, file_location, findings.component_search_link, findings.external_policy_finding_id, findings.entity_type, findings.category, findings.type, policy.id, policy.name, policy.type, policy.severity, policy.category, policy.is_enabled, policy.module_name, policy.module_version, policy.domain, policy.url, policy.ai_policy_id, policy.compliance_frameworks, policy.applies_to, policy.guardrail, gate.id, gate.name, gate.stage, gate.category, gate.integration_type, gate.is_enabled.

SBOM: sbom.document_name, sbom.id, sbom.org_name, sbom.version, sbom.supplier, sbom.url.

Project: project.id, project.name, project.org_name, project.organisation, project.created.

Attestation & Risk Score: attestation_level.lcal, risk_level.score, risk_level.severity.

Security Posture: security_posture.name, security_posture.score, security_posture.severity, security_posture.reason, security_posture.desc, security_posture.entropy, security_posture.author, security_posture.commit, security_posture.created, security_posture.language, security_posture.loc, security_posture.rule_id, security_posture.source_link, security_posture.checksum.sha256.

Code Quality: code_quality.name, code_quality.score, code_quality.severity, code_quality.reason, code_quality.desc, code_quality.author, code_quality.commit, code_quality.created, code_quality.language, code_quality.loc, code_quality.rule_id, code_quality.source_link, code_quality.checksum.sha256.

Source Code: source_code.loc, source_code.url, source_code.version, source_code.tag, source_code.name, source_code.friendly_name, source_code.score, source_code.code_quality_score, source_code.security_posture_score, source_code.contributors_count, source_code.total_commits, source_code.first_commit, source_code.last_commit, source_code.is_opensource, source_code.is_suspicious_activity, source_code.languages, source_code.latest_version, source_code.latest_version_date, source_code.direct_dep_count, source_code.transitive_dep_count.

Provenance & Commits: provenance.country.code, provenance.country_code, provenance.timezone, provenance.count, provenance.contributor.name, provenance.contributor.email, provenance.contributor.commit_count, provenance.contributor.commits, provenance.contributor.is_suspicious, provenance.contributor.link, commits.commit, commits.count, commits.contributor_commit_count, commits.country_code, commits.timezone, commits.contributor.name, commits.contributor.email, commits.contributor.country.code, commits.contributor.is_suspicious.

Contributor: contributor.name, contributor.email, contributor.id, contributor.commits, contributor.is_suspicious, contributor.link, commit.contributor.commit_count, commit.contributor.country.code, commit.contributor.email, commit.contributor.name.

License: license.name, license.full_name, license.short_id, license.url, license.category, license.component_category, license.version, license.license_id, license.is_opensource, license.is_osi_approved, license.is_deprecated, license.is_fsf_libre, license.details_url, license.reference_number, license.references.

Supplier: supplier.name, supplier_info.name, supplier.is_verified, supplier.verified, supplier.organisation.

Query components with LQL

post

Run a Lineaje Query Language (LQL) query. Provide the query in the lql body field. Use the company-id and product-id headers to scope the request. See the LQL tag description for full syntax, operators, and the field glossary.

Namespaces include package.*, image.*, vulnerability.*, security_posture.*, code_quality.*, source_code.*, commits.*, provenance.*, license.*, supplier.*, cwe.* (Frontier Model Scanning), and findings.*/policy.* (UnifAI).

Authorizations

AuthorizationstringRequired

Short-lived access token from the login or renew-access-token endpoint.

Header parameters

company-idstringOptionalExample: <company_id>

product-idstringOptionalExample: 1

Body

lqlstringRequired

The LQL query. See the LQL tag description for full syntax.

Example: package.name=log4j*

limitintegerOptional

Total items in the response.

Example: 10

page_nointegerOptional

Page number.

Example: 1

is_opensourcebooleanOptionalExample: true

include_raw_databooleanOptionalExample: false

agg_limitinteger · nullableOptional

company_idstringOptionalExample: <company_id>

product_idintegerOptionalExample: 1

valueschemastringOptionalExample: valueSchema

Responses

200

Query result. The shape depends on the query: a bare search term returns raw matching documents; chart table(...) returns the selected columns; stats ... returns aggregates.

application/json

Other propertiesanyOptional

post/api/v2/lql/components

POST /api/v2/lql/components HTTP/1.1
Host: data-service-v2-apigw.v2.prod.veedna.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 39

{
  "lql": "package.name=log4j*",
  "limit": 1
}

200

Query result. The shape depends on the query: a bare search term returns raw matching documents; chart table(...) returns the selected columns; stats ... returns aggregates.

{
  "ANY_ADDITIONAL_PROPERTY": "anything"
}