# Synchronous bulk artifact scan evaluation (no DB write)

Synchronously evaluates firewall policies for up to 50 artifacts and returns the scan result for each one. No data is written to the database.

Endpoint: POST /har/api/v3/scans/bulk-evaluate-sync
Version: 1.0
Security: x-api-key

## Query parameters:

  - `account_identifier` (string, required)
    Unique identifier for the Harness account.

  - `org_identifier` (string)
    Unique identifier for the organization within the account.

Example: default or engineering_org

  - `project_identifier` (string)
    Unique identifier for the project within the organization.

Example: my_project or frontend_services

## Request fields (application/json):

  - `artifacts` (array, required)
    List of artifacts to evaluate (max 50)

  - `artifacts.packageName` (string, required)
    Name of the package

  - `artifacts.version` (string, required)
    Version of the package

  - `registryId` (string, required)
    Registry identifier

  - `skipCache` (boolean)
    When true, skip the cached scan result and force a fresh OPA evaluation

## Response 200 fields (application/json):

  - `data` (array, required)
    List of scan details, one per evaluated artifact

  - `data.buildDetails` (array, required)
    List of build detail entries containing pipeline and package info.

  - `data.buildDetails.lastExecutionTime` (integer, required)
    Epoch time (seconds) of the latest execution.

  - `data.buildDetails.latestExecutionId` (string, required)
    Latest execution identifier.

  - `data.buildDetails.pipelineId` (string, required)
    Pipeline identifier.

  - `data.buildDetails.rootPackage` (string, required)
    Root package identifier in name@version format.

  - `data.buildDetails.stageId` (string, required)
    Stage identifier.

  - `data.buildDetails.stepId` (string)
    Step identifier.

  - `data.createdAt` (string)

  - `data.exemptionStatus` (object)
    Exemption status for an artifact, showing if an exception exists.

  - `data.exemptionStatus.createdAt` (integer,null, required)
    Unix timestamp in milliseconds when the resource was created
    Example: 1736360000123

  - `data.exemptionStatus.expirationAt` (integer,null)
    Unix timestamp in milliseconds when the resource was created
    Example: 1736360000123

  - `data.exemptionStatus.id` (string, required)
    Firewall exception ID for navigation to the exception detail.

  - `data.exemptionStatus.status` (string, required)
    Current status of the exception.
    Enum: "PENDING", "APPROVED", "REJECTED", "EXPIRED"

  - `data.fixVersionDetails` (object)
    Fix version Details

  - `data.fixVersionDetails.currentVersion` (string, required)
    The current version
    Example: "1.2.0"

  - `data.fixVersionDetails.fixVersion` (string)
    The fix version
    Example: "1.2.2"

  - `data.fixVersionDetails.fixVersionAvailable` (boolean, required)
    Fix version available or not

  - `data.id` (string, required)
    Unique identifier for this artifact scan details

  - `data.lastEvaluatedAt` (string)

  - `data.packageName` (string, required)
    Package name

  - `data.packageType` (string, required)
    Package type. Known values include: DOCKER, MAVEN, PYTHON, GENERIC, HELM, HELM_HTTP, NUGET, NPM, RPM, CARGO, COMPOSER, GO, HUGGINGFACE, CONDA, DART, SWIFT, PUPPET, RUBY, RAW, DEBIAN, CONAN, TERRAFORM. This field is extensible; clients must handle unknown values.
    Example: "DOCKER"

  - `data.parentRegistryId` (string, required)
    Parent virtual registry UUID

  - `data.parentRegistryName` (string, required)
    Parent virtual registry name

  - `data.parentRegistryOrgId` (string)
    Parent registry organization identifier

  - `data.parentRegistryProjectId` (string)
    Parent registry project identifier

  - `data.policySetFailureDetails` (array, required)

  - `data.policySetFailureDetails.policyFailureDetails` (array, required)

  - `data.policySetFailureDetails.policyFailureDetails.category` (string, required)
    Policy failure detail category.
    Enum: "Security", "License", "MaliciousPackage", "PackageAge", "OssRiskLevel", "Unknown"

  - `data.policySetFailureDetails.policyFailureDetails.policyName` (string, required)
    Policy name.

  - `data.policySetFailureDetails.policyFailureDetails.policyRef` (string, required)
    Policy Ref.

  - `data.policySetFailureDetails.policySetName` (string, required)
    Policy set name.

  - `data.policySetFailureDetails.policySetRef` (string, required)
    Policy set reference.

  - `data.purl` (string, required)
    Package URL (PURL) identifying the package version

  - `data.registryId` (string)
    Registry ID

  - `data.registryName` (string, required)
    Registry name

  - `data.registryOrgId` (string)
    Organization identifier of the registry

  - `data.registryProjectId` (string)
    Project identifier of the registry

  - `data.rootPackages` (array, required)
    Unique set of root packages (name@version) impacted by this scan

  - `data.scanStatus` (string, required)
    Scan status
    Enum: "BLOCKED", "WARN"

  - `data.version` (string, required)
    Version

  - `data.versionId` (string)
    Version

## Response default fields (application/json):

  - `error` (object, required)

  - `error.code` (string)
    For some errors that could be handled programmatically, a short string indicating the [error code](https://docs.stripe.com/error-codes) reported.

  - `error.message` (string)
    A human-readable message providing more details about the error. These messages can be shown to users.

  - `error.param` (string)
    If the error is parameter-specific, the parameter related to the error. For example, we can use this to display a message near the correct form field.

  - `error.type` (string, required)
    The type of error returned.
    Enum: "INVALID_REQUEST_ERROR", "AUTHENTICATION_ERROR", "PERMISSION_ERROR", "API_ERROR"