---
title: Semgrep API Integration on Truto
slug: semgrep
category: Security
canonical: "https://truto.one/integrations/detail/semgrep/"
---

# Semgrep API Integration on Truto



**Category:** Security  
**Status:** Generally available

## MCP-ready AI tools

Truto exposes 208 tools for Semgrep that AI agents can call directly.

- **list_all_semgrep_agent_deployments** — List all Semgrep agent deployments associated with the current authentication token. Returns: id.
- **create_a_semgrep_agent_deployment** — Create a new Semgrep agent deployment. Returns: id.
- **get_single_semgrep_agent_deployment_by_id** — Get a single Semgrep agent deployment by id. Returns: id, name. Required: id.
- **update_a_semgrep_agent_deployment_by_id** — Update a Semgrep agent deployment by id. Returns the updated deployment including its id, name, and slug. Required: id.
- **semgrep_agent_deployments_list_tags** — List deployment tags for a Semgrep deployment by deployment id. Returns: tags. Required: deployment_id.
- **semgrep_agent_deployments_list_notification_rules** — List notification rules for a Semgrep deployment. Returns a collection of notification rule objects, each including its id. Required: deployment_id.
- **create_a_semgrep_deployment_action** — Create a notification rule for a Semgrep deployment. Returns the notification rule object with schema-defined fields. Required: deployment_id.
- **update_a_semgrep_deployment_action_by_id** — Replace a notification rule for a Semgrep deployment. Returns the notification rule object with schema-defined fields. Required: deployment_id, id.
- **delete_a_semgrep_deployment_action_by_id** — Delete a notification rule from a Semgrep deployment. Returns a DeleteNotificationRuleResponse confirming the deletion. Required: deployment_id, id.
- **create_a_semgrep_action_test** — Test a notification rule in Semgrep by triggering a test action for the specified deployment and notification rule. Returns the test notification rule response from Semgrep. Required: deployment_id, notification_rule_id.
- **list_all_semgrep_deployment_authorized_actions** — List authorized actions for a Semgrep deployment. Returns: actions (the list of action identifiers the user is authorized to take on the deployment). Required: deployment_id.
- **list_all_semgrep_deployment_default_user_roles** — Get the default user role for a Semgrep deployment. Returns the default user role configuration assigned to new users in the deployment. Required: deployment_id.
- **list_all_semgrep_deployment_findings** — List code, supply chain, or AI-powered scan findings for a Semgrep deployment, ordered by relevant_since descending. Returns: id, assistant, categories, click_to_fix_failures, click_to_fix_prs, confidence, created_at, external_ticket, first_seen_scan_id, line_of_code_url, location, match_based_id, ref, relevant_since, repository, review_comments, rule, rule_message, rule_name, severity,…. Required: deployment_slug.
- **semgrep_deployment_findings_bulk_update** — Bulk triage Semgrep issues that match specified filters within a deployment, applying triage updates to matching findings in a single operation. Returns the bulk update findings response. Required: deployment_id.
- **list_all_semgrep_deployment_github_app_status** — Check if the Semgrep GitHub app is installed for a deployment in Semgrep. Returns: installed. Required: deployment_id.
- **create_a_semgrep_deployment_has_deepsemgrep** — Update the DeepSemgrep setting for a Semgrep deployment by deployment id. Returns a JSON response object confirming the update. Required: deployment_id.
- **create_a_semgrep_deployment_has_dependency_query** — Update the has_dependency_query setting for a Semgrep deployment. Returns an OK response confirming the updated deployment has_dependency_query state. Required: deployment_id.
- **create_a_semgrep_deployment_has_triage_via_comment** — Update the "has triage via comment" setting for a specific Semgrep deployment. Returns the update response confirming the deployment's triage-via-comment configuration. Required: deployment_id.
- **list_all_semgrep_deployment_ignores** — List deployment product ignores for a Semgrep deployment. Returns the deployment product ignore configuration via the attributes field, with the exact field structure defined by the upstream protobuf schema. Required: deployment_id.
- **create_a_semgrep_deployment_ignore** — Create deployment product ignores for a Semgrep deployment by submitting a JSON request body. Returns the created configuration via the attributes field, with the exact field structure defined by the upstream protobuf schema. Required: deployment_id.
- **semgrep_deployment_ignores_bulk_update** — Update deployment product ignores for a Semgrep deployment by submitting a JSON request body. Returns the updated configuration via the attributes field, with the exact field structure defined by the upstream protobuf schema. Required: deployment_id.
- **semgrep_deployment_ignores_bulk_delete** — Delete deployment product ignores for a Semgrep deployment, optionally filtered by product type. Returns the deletion result via the attributes field, with the exact field structure defined by the upstream protobuf schema. Required: deployment_id.
- **semgrep_deployment_issues_search** — Search and group Semgrep deployment issues by rule with filtering and pagination. Returns: issue_groups. Required: deployment_id.
- **get_single_semgrep_deployment_issue_by_id** — Get a single Semgrep deployment issue by id with full details. Returns: id, state, status, severity, confidence, rule_name, rule_message, rule, repository, location, line_of_code_url, categories, created_at, relevant_since, state_updated_at, triaged_at, triage_state, triage_reason, triage_comment, syntactic_id, match_based_id, ref, first_seen_scan_id, is_archived, sourcing_policy,…
- **create_a_semgrep_issues_export** — Asynchronously export Semgrep issues matching filters to a file for a deployment. Accepts a ListIssuesRequest filter body and returns a 202 Accepted acknowledgment confirming the export job has been queued. Required: deployment_id. The export runs asynchronously; poll for completion separately.
- **list_all_semgrep_issue_code_snippets** — List code snippets for a Semgrep issue within a deployment. Returns: code_snippets. Required: deployment_id, issue_id.
- **create_a_semgrep_issue_fix_job** — Create an automated SAST fix job for a given issue in Semgrep, triggering an AI-powered workflow that analyzes the vulnerability, generates a fix, and opens a pull request in the repository. Returns the created fix job response. Required: deployment_id, issue_id. This feature is currently in Public Beta.
- **list_all_semgrep_deployment_managed_scan_settings** — List managed scan settings for a Semgrep deployment. Returns the managed scan settings response object including id and attributes containing deployment-specific scan configuration fields. Required: deployment_id.
- **create_a_semgrep_deployment_managed_scan_setting** — Create managed scan settings for a Semgrep deployment. Returns the created managed scan settings object including its managed_scan_settings_id. Required: deployment_id.
- **update_a_semgrep_deployment_managed_scan_setting_by_id** — Update a Semgrep managed scan settings record for a specific deployment. Returns: id. Required: deployment_id, id. A JSON request body is required but its fields are defined in the upstream proto schema (UpdateManagedScanSettingsRequest) and are not enumerable from the discovered documentation.
- **delete_a_semgrep_deployment_managed_scan_setting_by_id** — Delete a Semgrep managed scan settings record from a specific deployment. Returns: id. Required: deployment_id, id.
- **list_all_semgrep_deployment_packagemanagerauthconfigs** — List all package manager authentication configurations for a Semgrep deployment. Returns: id. Required: deployment_id.
- **create_a_semgrep_deployment_packagemanagerauthconfig** — Create a new package manager authentication configuration for a Semgrep deployment. Returns: id. Required: deployment_id.
- **update_a_semgrep_deployment_packagemanagerauthconfig_by_id** — Update an existing package manager authentication configuration in Semgrep. Returns: id. Required: deployment_id, id.
- **delete_a_semgrep_deployment_packagemanagerauthconfig_by_id** — Delete a package manager authentication configuration from a Semgrep deployment. Returns: id. Required: deployment_id, id.
- **list_all_semgrep_deployment_products** — Get the product configuration for a Semgrep deployment. Returns the deployment product config object including id and attributes. Required: deployment_id.
- **semgrep_deployment_products_bulk_update** — Create or update the product configuration for a Semgrep deployment. Returns the updated deployment product config object including id and attributes. Required: deployment_id.
- **list_all_semgrep_products_admins** — Get the admin product configuration for a Semgrep deployment. Returns the admin product configuration object with schema-specific fields. Required: deployment_id.
- **create_a_semgrep_products_feedback** — Send deployment product toggle feedback to Semgrep for a specific deployment. Returns a SendDeploymentToggleFeedbackResponse acknowledgement object. Required: deployment_id.
- **list_all_semgrep_project_resolution_configs** — List custom SCA dependency resolution configurations for a Semgrep deployment and project. Returns the resolution configs response object with content-type-specific fields. Required: deployment_id, project_id.
- **update_a_semgrep_deployment_repo_by_id** — Bulk edit multiple Semgrep projects (repos) within a deployment, applying changes to all specified projects at once. Returns the bulk edit response confirming the applied changes. Required: deployment_id, id.
- **semgrep_deployment_repos_bulk_update** — Bulk edit multiple projects (repos) in a Semgrep deployment by applying changes to all specified projects at once. Returns the bulk edit response confirming the applied changes. Required: deployment_id.
- **create_a_semgrep_repos_provision** — Provision Semgrep CI GitHub Actions across repos in a Semgrep deployment by adding a "semgrep-ci" GitHub Action to GitHub Repositories associated with Semgrep Projects matching the filters provided in the request body. Returns a BulkProvisionReposResponse object with the results of the bulk provisioning operation. Required: deployment_id.
- **create_a_semgrep_repos_refresh_async** — Schedule an async job in Semgrep to sync all projects in a deployment to their source control manager. Returns a 202 Accepted response confirming the refresh job has been queued. Required: deployment_id.
- **create_a_semgrep_repos_secret** — Add Semgrep CI secrets to GitHub repositories in a deployment. Generates and adds a secret for the "semgrep-ci" GitHub Action to the GitHub repositories associated with any Semgrep Projects that match the given filters in the request body. Returns a BulkAddRepoSecretResponse object with the result of the bulk secret-addition operation. Required: deployment_id.
- **list_all_semgrep_repos_by_tags** — List all project IDs grouped by tag for a Semgrep deployment. Returns: repos_by_tag, a mapping from tag ID to related project IDs. Required: deployment_id.
- **semgrep_repos_filtereds_bulk_update** — Bulk apply a project update to many Semgrep projects in a deployment that match the given filters. Returns the bulk apply repo update response (protos.projects.v1.BulkApplyRepoUpdateResponse). Required: deployment_id.
- **create_a_semgrep_repo_sync** — Schedule a job to sync a Semgrep project repository with its source control manager. Returns a 202 Accepted response confirming the sync has been scheduled. Required: deployment_id, repo_id.
- **list_all_semgrep_deployment_ruleboards** — List ruleboards for a Semgrep deployment, optionally filtered by type. Returns: type. Required: deployment_id.
- **create_a_semgrep_deployment_ruleboard** — Create a new ruleboard for a Semgrep deployment. Returns: type. Required: deployment_id.
- **update_a_semgrep_deployment_ruleboard_by_id** — Update a Semgrep ruleboard within a deployment. Returns the updated ruleboard object including its slug and type. Required: deployment_id, id.
- **delete_a_semgrep_deployment_ruleboard_by_id** — Delete a Semgrep ruleboard for a deployment by id. Returns an empty 204 response on success. Required: deployment_id, id.
- **get_single_semgrep_deployment_ruleboard_by_id** — Get a single Semgrep ruleboard for a deployment by id. Returns: slug, type. Required: deployment_id, id.
- **list_all_semgrep_ruleboard_finding_counts** — Get Semgrep ruleboard finding counts for a specific deployment and ruleboard. Returns finding count data for the specified ruleboard, optionally filtered by time range. Required: deployment_id, ruleboard_slug.
- **list_all_semgrep_ruleboard_overviews** — Get the overview of a Semgrep ruleboard within a deployment. Returns the ruleboard overview object with fields defined in the upstream Semgrep API schema. Required: deployment_id, ruleboard_slug.
- **semgrep_ruleboard_overviews_bulk_update** — Update the overview of a Semgrep ruleboard within a deployment. Returns the updated ruleboard overview object with fields defined in the upstream Semgrep API schema. Required: deployment_id, ruleboard_slug.
- **list_all_semgrep_slack_channel_mappings** — List Slack channel mappings for a Semgrep deployment. Returns the response object with fields defined by the upstream GetSlackChannelMappingsResponse protobuf schema. Required: deployment_id.
- **list_all_semgrep_slack_channels** — List Slack notification mappings for a Semgrep deployment. Returns notification mapping records including id and attributes with channel and notification mapping details. Required: deployment_id.
- **list_all_semgrep_slack_installs** — Get the Slack app installation OAuth URL for a Semgrep deployment, generating the URL that initiates the Slack app installation flow. Returns: attributes (the InstallSlackAppResponse containing the installation OAuth URL). Required: deployment_id.
- **list_all_semgrep_slack_installations** — Get Slack app installation details for a Semgrep deployment. Returns the Slack installation response object whose shape is defined by the upstream GetSlackInstallationResponse schema. Required: deployment_id.
- **semgrep_slack_installations_bulk_delete** — Delete the Slack app installation for a Semgrep deployment and revoke its access token. Returns the deletion response object whose shape is defined by the upstream DeleteSlackInstallationResponse schema. Required: deployment_id.
- **create_a_semgrep_oauth_callback** — Handle a Slack OAuth callback for a Semgrep agent deployment, processing the callback to exchange the authorization code for an access token and store the Slack installation data. Returns the callback processing response. Required: deployment_id.
- **create_a_semgrep_tags_find** — Find deployment tags with their associated project counts in Semgrep. Returns the matching tags along with project count information. Required: deployment_id.
- **update_a_semgrep_deployment_tag_by_id** — Create or update a deployment tag in Semgrep. Returns the updated deployment tag object. Required: deployment_id, id (repository tag).
- **delete_a_semgrep_deployment_tag_by_id** — Delete a deployment tag in Semgrep by deployment id and tag identifier. Returns an empty 204 response on success. Required: deployment_id, id.
- **get_single_semgrep_deployment_tag_by_id** — Get a single deployment tag in Semgrep by deployment and repository tag identifier. Returns the deployment tag object including its id and attributes. Required: deployment_id, id.
- **list_all_semgrep_deployment_users** — List users for a Semgrep deployment, optionally filtering by GitHub pruning or active status. Returns: id. Required: deployment_id.
- **create_a_semgrep_deployment_user** — Add a user to a Semgrep deployment by providing user details in the request body. Returns: id. Required: deployment_id.
- **delete_a_semgrep_deployment_user_by_id** — Remove a user from a Semgrep deployment. Returns: id. Required: deployment_id, id.
- **semgrep_user_roles_bulk_update** — Update the roles assigned to a specific user within a Semgrep deployment. Returns the patched deployment user response. Required: deployment_id, user_id.
- **list_all_semgrep_agent_features** — List all available feature rollouts in Semgrep. Returns: available_feature_rollouts. No required parameters.
- **list_all_semgrep_agent_identities** — Get the agent's bearer identity in Semgrep. Returns: identity. No request parameters required.
- **list_all_semgrep_agent_ips** — Get the current IP address in Semgrep. Returns: ip_address.
- **list_all_semgrep_agent_pings** — Ping the Semgrep agent server to assert liveness. Returns: pong. No required parameters.
- **list_all_semgrep_agent_tenants** — Get the current tenant name for the Semgrep server (e.g. "default"). Returns: tenant_name.
- **list_all_semgrep_version_project_infos** — Get Semgrep version information for recent scans for a specific deployment and product in Semgrep. Returns: data (version info object whose exact fields depend on the upstream GetProjectVersionInfoResponse proto schema). Required: deployment_id, product.
- **create_a_semgrep_deployment_autotriage_feedback** — Post autotriage feedback for a Semgrep AI deployment. Returns a PostAutotriageFeedbackResponse object; the upstream schema fields are not documented in the available source. Required: deployment_id and a JSON request body.
- **create_a_semgrep_deployment_memory** — Create a new AI memory in a Semgrep deployment. Returns the created memory object. Required: deployment_id.
- **update_a_semgrep_deployment_memory_by_id** — Update an existing AI memory in a Semgrep deployment by replacement. Returns the updated memory object. Required: deployment_id, id.
- **delete_a_semgrep_deployment_memory_by_id** — Delete a Semgrep AI deployment memory by its ID. Returns an empty 204 response on success. Required: deployment_id, id.
- **list_all_semgrep_memories_stats** — Get statistics about a Semgrep deployment's memories performance. Returns a memory performance statistics object whose fields are defined by the upstream GetMemoriesStatsResponse schema. Required: deployment_id.
- **list_all_semgrep_memories_suggesteds** — List all suggested memories for a Semgrep AI deployment. Returns: id, created_at, updated_at. Required: deployment_id.
- **create_a_semgrep_memories_triage** — Create a new Semgrep AI memory from a triage event for a deployment. Returns the created memory object as a CreateMemoryFromTriageResponse. Required: deployment_id, and a JSON request body describing the triage event.
- **create_a_semgrep_deployment_relevant_issue** — Find relevant issues for a given rule and repository in a Semgrep deployment. Returns the matching relevant issues response object defined by the upstream FindRelevantIssuesResponse schema. Required: deployment_id. A JSON request body is also required.
- **create_a_semgrep_ai_pattern_fix** — Create an AI pattern fix task in Semgrep for a given pattern and language, used in the editor's structure mode. Returns a task token for polling completion via the Tasks Service. Required: pattern, language.
- **create_a_semgrep_combined_task** — Create a combined task for a deployment in Semgrep. Returns the created combined task object with schema-specific fields defined in the upstream protobuf definition. Required: deployment_id.
- **list_all_semgrep_info** — Get task info for a Semgrep deployment. Returns the task info response object for the specified deployment. Required: deployment_id.
- **list_all_semgrep_auth_authorized_resources** — List all organizations and deployments available to the authenticated user in Semgrep. Returns authorized resource records, each with an id and an attributes object containing organization/deployment-specific fields from the upstream protobuf schema.
- **list_all_semgrep_deployment_providers** — List all SSO providers configured for a Semgrep deployment. Returns: sso_providers (array of SSO provider objects, each with an id). Required: deployment_id.
- **list_all_semgrep_auth_users** — Get the current Semgrep user's basic information including role, email, and auth details. Returns: id, email, role. If userId is supplied it must equal the requester's own ID.
- **list_all_semgrep_users_deployments** — List all Semgrep organizations/deployments that the current user is a member of. Returns: id, name, slug, findings. As of June 2025, the userId query parameter must equal the requester's ID.
- **list_all_semgrep_deployments_joinables** — List all Semgrep organizations/deployments that the current user can join. Returns: id, name, slug, findings. If provided, userId must equal the requester's ID.
- **list_all_semgrep_users_settings** — Get basic settings and onboarding info for the current Semgrep user. Returns the user settings object with schema-specific fields including contact preferences and product tour state.
- **semgrep_users_settings_bulk_update** — Update user settings and preferences for the current Semgrep user. Returns the updated user settings object; exact fields are defined by the upstream PatchUserSettingsResponse schema.
- **list_all_semgrep_deployment_scm_comment_product_contents** — List all review comment product contents for a Semgrep deployment. Returns: id. Required: deployment_id.
- **create_a_semgrep_deployment_scm_comment_product_content** — Create a new review comment product content in a Semgrep deployment. Returns: id. Required: deployment_id.
- **update_a_semgrep_deployment_scm_comment_product_content_by_id** — Update an existing review comment product content in a Semgrep deployment. Returns: id. Required: deployment_id, id.
- **delete_a_semgrep_deployment_scm_comment_product_content_by_id** — Delete a review comment product content by its ID in a Semgrep deployment. Returns: id. Required: deployment_id, id.
- **list_all_semgrep_health_checks** — Check if the Semgrep container is healthy. Returns: status. No required parameters.
- **list_all_semgrep_infra_config_bootstrap_sms_vpcs** — Get the Semgrep Managed Scans (SMS) VPC Bootstrap CloudFormation template in JSON format for cross-account infrastructure setup. Returns the CloudFormation template object with content-type-specific fields following the AWS CloudFormation template format. The template creates IAM roles and policies for SMS VPC automation, including the semgrep-sms-vpc-automation role and EC2 Image Builder…
- **list_all_semgrep_notification_webhooks_deployments** — List all notification webhooks for a Semgrep deployment. Returns: webhooks (array of webhook objects). Required: deployment_id.
- **create_a_semgrep_webhook_test** — Send a test payload to a Semgrep notification webhook endpoint to verify it is configured and delivering correctly. Returns the test webhook delivery result. Required: deployment_id, webhook_id.
- **list_all_semgrep_deployment_automations** — List all automations for a Semgrep deployment. Returns: id. Required: deployment_id.
- **create_a_semgrep_deployment_automation** — Create a new automation for a Semgrep deployment. Returns: id. Required: deployment_id.
- **update_a_semgrep_deployment_automation_by_id** — Update an existing automation in a Semgrep deployment. Returns: id. Required: deployment_id, id.
- **delete_a_semgrep_deployment_automation_by_id** — Delete an automation from a Semgrep deployment by id. Returns: id. Required: deployment_id, id.
- **semgrep_deployment_automations_list_v_1** — List all automations for a Semgrep deployment via the v1 notifications endpoint. Returns: id, attributes. Required: deployment_id.
- **list_all_semgrep_deployment_ticketings** — List external ticketing instances (e.g. Jira) linked to a Semgrep deployment. Returns ticketing instance records with their id. Required: deployment_id.
- **create_a_semgrep_tickets_link** — Link an existing external ticket to Semgrep findings by providing the ticket URL and finding IDs. If a finding is already linked, the existing link is replaced. Returns: id, url. Required: deployment_id, ticketing_instance_id, ticket_url, finding_ids.
- **semgrep_tickets_links_create_v_1** — Link an existing external ticket (e.g. Jira) to one or more Semgrep findings. Does not create a ticket — it only records the association in Semgrep, replacing any prior link on a finding. Returns the linked ticket object including id, url, and linked_issue_ids. Required: deployment_id, issue_ids, ticket_url.
- **create_a_semgrep_tickets_unlink** — Unlink a ticket from one or more Semgrep findings within a deployment and ticketing instance by providing a list of finding IDs. This only removes the association in Semgrep, not the ticket in your issue tracker. Returns: attributes. Required: deployment_id, ticketing_instance_id, finding_ids.
- **semgrep_tickets_unlinks_create_v_1** — Unlink a ticket from one or more Semgrep findings within a deployment by providing a list of finding IDs (v1 API). This only removes the association in Semgrep, not the ticket in your issue tracker. Returns: unlinked_issue_ids. Required: deployment_id, issue_ids.
- **delete_a_semgrep_ticket_by_id** — Delete an external ticket in Semgrep and unlink it from associated Semgrep findings. Returns: id. Required: deployment_id, ticketing_instance_id, id.
- **list_all_semgrep_deployment_wizes** — List Wiz notification credentials configured for a Semgrep deployment. Returns: id. Required: deployment_id.
- **create_a_semgrep_deployment_wize** — Create a Wiz notification credential for a Semgrep deployment. Returns: id. Required: deployment_id.
- **get_single_semgrep_deployment_wize_by_id** — Get a single Wiz notification credential in Semgrep by id. Returns: id. Required: deployment_id, id.
- **update_a_semgrep_deployment_wize_by_id** — Update a Wiz notification credential in Semgrep by id. Returns: id. Required: deployment_id, id.
- **delete_a_semgrep_deployment_wize_by_id** — Delete a Wiz notification credential in Semgrep by id. Returns: id. Required: deployment_id, id.
- **create_a_semgrep_wiz_validate** — Validate a Wiz integration credential for a Semgrep deployment. Returns a ValidateWizCredentialResponse object with schema-specific fields defined in the upstream protobuf. Required: deployment_id.
- **get_single_semgrep_in_app_deployment_by_id** — List unread in-app notifications for a Semgrep deployment by id. Returns a paginated list of notification objects, each including its id. Required: id (deploymentId).
- **semgrep_deployment_mark_as_seens_bulk_update** — Mark a list of in-app notifications as seen for a Semgrep deployment in Semgrep. Accepts a MarkNotificationsAsSeenRequest JSON body identifying the notifications to mark, and returns a MarkNotificationsAsSeenResponse confirmation object. Required: deployment_id.
- **list_all_semgrep_deployment_checklists** — Get the onboarding checklist status for a Semgrep deployment. Returns the checklist status response object whose fields are defined in the upstream Semgrep onboarding protobuf schema. Required: deployment_id.
- **semgrep_deployment_checklists_bulk_update** — Update the onboarding checklist for a Semgrep deployment by submitting a patch request body. Returns the updated checklist response object whose fields are defined in the upstream Semgrep onboarding protobuf schema. Required: deployment_id.
- **create_a_semgrep_deployment_invite_member** — Invite members to a Semgrep deployment during onboarding by sending an InviteMembersRequest body. Returns an InviteMembersResponse object confirming the invitations. Required: deployment_id.
- **list_all_semgrep_deployment_status** — Check whether a Semgrep deployment has Role-Based Access Control (RBAC) enabled. Returns: rbac_enabled. Required: deployment_id.
- **create_a_semgrep_deployment_team** — Create a new Role-Based Access Control team for a Semgrep deployment. Returns the created team including its id and name. Required: deployment_id, name.
- **update_a_semgrep_deployment_team_by_id** — Update a Semgrep deployment RBAC team's name, users, and repositories. Returns the updated team including its id and name. Required: deployment_id, id.
- **delete_a_semgrep_deployment_team_by_id** — Delete a Semgrep deployment's Role-Based Access Control team. Returns the deleted team including its id and name. Required: deployment_id, id.
- **semgrep_deployment_teams_list_members** — List the users assigned to a Semgrep Role-Based Access Control team. Returns each user record with id and additional attributes defined by the upstream schema. Required: deployment_id, team_id.
- **get_single_semgrep_deployment_team_by_id** — Get a single Semgrep deployment RBAC team by id. Returns the team record with id and additional attributes defined by the upstream schema. Required: deployment_id, id.
- **list_all_semgrep_team_repos** — List the repositories assigned to a Semgrep Role-Based Access Control team. Returns: repos. Required: deployment_id, team_id.
- **list_all_semgrep_teams** — List the child teams assigned to a Role-Based Access Control team in Semgrep. Returns: id, name. Required: deployment_id, team_id.
- **get_single_semgrep_policies_deployment_by_id** — List all policies for a given Semgrep deployment. Returns: a policies array where each policy includes id, name, and slug. Required: id (the numerical deployment identifier).
- **list_all_semgrep_rules** — List the rules for a given Semgrep policy. Returns: rule_path, attributes. Required: deployment_id, policy_id. Default page size is 500; maximum is 2000.
- **update_a_semgrep_rule_by_id** — Update a specific rule within a Semgrep policy. Returns: rule_path, attributes. Required: deployment_id, policy_id, id.
- **list_all_semgrep_deployment_detection_policies** — Get the detection policy summary for a Semgrep deployment. Returns: state_version, bundle. Required: deployment_id.
- **get_single_semgrep_deployment_detection_policy_by_id** — Get a Semgrep detection policy for one product in a deployment. Returns the detection policy bundle including its exceptions, plus the state_version required to apply changes. Required: deployment_id, product.
- **semgrep_deployment_detection_policies_dry_run** — Preview a Semgrep detection policy apply by validating a candidate bundle and returning the diff a strict apply would produce, without changing anything. Returns: state_version, diff. Required: deployment_id, product, bundle.
- **semgrep_deployment_detection_policies_bulk_update** — Apply a detection policy bundle for one product in a Semgrep deployment. The submitted bundle replaces the current state and exceptions absent from it are deleted. Returns: state_version, bundle. Required: deployment_id, product. Requires the current state_version via the If-Match header; returns 428 if missing or 409 if stale.
- **list_all_semgrep_deployment_remediation_policies** — Get remediation policies for a Semgrep deployment. Returns the remediation policies bundle and the state_version required to apply changes; system-managed policies are excluded. Required: deployment_id.
- **semgrep_deployment_remediation_policies_dry_run** — Preview a remediation policies apply for a Semgrep deployment without changing anything. Validates a candidate bundle and returns the diff a strict apply would produce, plus the state_version to send as If-Match on the follow-up PUT. Returns: state_version, diff. Required: deployment_id.
- **semgrep_deployment_remediation_policies_bulk_update** — Apply remediation policies for a Semgrep deployment. The submitted list strictly replaces the current state; policies absent from it are deleted. Requires the current state_version via the If-Match header. Returns: remediation_policies, state_version. Required: deployment_id.
- **list_all_semgrep_deployment_vocabs** — Get the Semgrep policy vocabulary for a deployment, returning condition_types, action_types, value_enums, and detection_bundle_constraints for client-side policy bundle validation. Required: deployment_id.
- **list_all_semgrep_readiness_checks** — Check whether the Semgrep container started up correctly using the readiness probe endpoint. Returns: attributes.
- **create_a_semgrep_run** — Execute a Semgrep pattern against target code and return the match results in Semgrep. Returns the pattern match results as defined by the RunPatternResponse schema. Requires a JSON request body conforming to the RunPatternRequest schema with the pattern and target code to scan.
- **list_all_semgrep_deployment_dependencies** — List all SCA dependencies for a Semgrep deployment with optional filtering by name, version, ecosystem, transitivity, license, lockfile path, and repository. Returns paginated dependency records including name, version, ecosystem, and transitivity. Required: deployment_id.
- **create_a_semgrep_deployment_dependency** — List all or filtered dependencies for a Semgrep SCA deployment using a POST request body with pagination. Returns a paginated list of dependencies for the deployment. Required: deployment_id.
- **create_a_semgrep_deployment_sbom_async** — Start an asynchronous job to generate a Software Bill of Materials (SBOM) for a Semgrep deployment. Returns: task_token_jwt. Required: deployment_id. The endpoint does not return the SBOM itself; use the task JWT with the Tasks Service to poll for job status and results.
- **create_a_semgrep_scm_ado_app** — Create an Azure DevOps SCM App in Semgrep using Entra ID Service Principal credentials. Returns the created app response with proto-schema-specific fields including a generated public certificate for upload to the customer's Entra app registration. CompleteAdoScmAppInstall must be called separately to finish the install. A request body with Service Principal credentials is required.
- **semgrep_scm_ado_app_installs_bulk_update** — Complete an Azure DevOps SCM App install in Semgrep. After the certificate is uploaded, verifies the Service Principal can authenticate to ADO, creates webhook subscriptions required for the integration, and marks the install as ready. Returns the completion response object.
- **create_a_semgrep_scm_app_request** — Create a new SCM app request in Semgrep. Returns the created SCM app request response object. A JSON request body is required; the upstream schema is defined by protos.scm.v1.CreateScmAppRequestRequest.
- **semgrep_scm_app_request_completes_bulk_update** — Complete an SCM app request in Semgrep by submitting the completion details. Returns a completion response object. Requires a JSON request body. The request and response schemas are referenced in the Semgrep v2 OpenAPI spec as protos.scm.v1.CompleteScmAppRequestRequest and protos.scm.v1.CompleteScmAppRequestResponse but their field-level structure is not documented in the available source.
- **list_all_semgrep_deployment_configs** — List all SCM configs for a Semgrep deployment. Returns: id, name. Required: deployment_id.
- **create_a_semgrep_deployment_config** — Create a new SCM config in a Semgrep deployment. Returns: id, name. Required: deployment_id.
- **semgrep_deployment_configs_search** — Search for SCM configs in a Semgrep deployment. Returns: id, name. Required: deployment_id.
- **update_a_semgrep_deployment_config_by_id** — Update an existing SCM config in a Semgrep deployment. Returns: id, name. Required: deployment_id, id.
- **delete_a_semgrep_deployment_config_by_id** — Delete an SCM config by its ID in a Semgrep deployment. Returns an empty 204 response on success. Required: deployment_id, id.
- **create_a_semgrep_config_sync** — Sync an SCM config in Semgrep by deployment and config id. Returns the SyncScmConfigResponse object with schema-specific fields defined in the Semgrep protobuf API. Required: deployment_id, config_id.
- **list_all_semgrep_config_checks** — Check the status of an SCM config in Semgrep. Returns the check status response with fields defined by the protobuf schema protos.scm.v1.CheckScmConfigResponse. Required: deployment_id, config_id.
- **list_all_semgrep_deployment_scm_apps** — List all SCM apps for a Semgrep deployment. Returns SCM app records with id and provider-specific attributes. Required: deployment_id.
- **delete_a_semgrep_deployment_scm_app_by_id** — Delete an SCM app by its ID in Semgrep. Returns a 200 OK confirmation response. Required: deployment_id, id.
- **get_single_semgrep_deployment_scm_app_by_id** — Get a single SCM app in Semgrep by id. Returns: id, attributes.scm.v1.ScmApp definition in the upstream OpenAPI specification). Required: deployment_id, id.
- **list_all_semgrep_scm_apps_public_ghas** — Get the status of a public GitHub App for a Semgrep deployment. Returns the GitHub App status response object. Required: deployment_id.
- **create_a_semgrep_scm_app_add_ado_project** — Add a new Azure DevOps project to an existing Entra App install in Semgrep. The service principal must already have permissions on the ADO project. Returns an AddAdoScmProjectResponse object confirming the addition. Required: deployment_id, scm_app_id.
- **create_a_semgrep_scm_app_rotate_webhook_secret** — Rotate the webhook secret for an SCM app in Semgrep — generates a new secret, updates it on the SCM provider, and persists it. Returns the response object with proto-schema-specific fields. Required: deployment_id, scm_app_id.
- **list_all_semgrep_deployment_subscriptions** — List all SCM webhook subscriptions for a Semgrep deployment. Returns: subscriptions (array of webhook subscription objects). Required: deployment_id, config_id.
- **update_a_semgrep_deployment_subscription_by_id** — Subscribe to SCM webhook events in Semgrep for a specific deployment and SCM configuration. Returns the subscription confirmation response. Required: deployment_id, id.
- **delete_a_semgrep_deployment_subscription_by_id** — Delete an SCM webhook subscription for a Semgrep deployment, unsubscribing it from webhook events. Returns an opaque 200 OK response whose fields are not enumerated in the available source. Required: deployment_id, id.
- **create_a_semgrep_subscription_rotate_secret** — Rotate the webhook secret for an SCM webhook subscription in Semgrep. Generates a new secret, updates it on the SCM provider, and persists it. Returns: webhook_secret. Required: deployment_id, config_id.
- **list_all_semgrep_project_settings** — Get a project's managed scan settings in Semgrep. Returns the settings object including id and attributes, or an empty result if the project does not have managed scanning set up. Required: deployment_id, project_id.
- **create_a_semgrep_support_case** — Create a new support case in Semgrep by submitting a support case request. Returns the created support case response object. Requires a JSON request body with support case details.
- **list_all_semgrep_support_cases** — List support cases for a Semgrep organization. Returns the support cases response object for the specified organization. Required: orgid.
- **list_all_semgrep_survey_names** — Get a company survey response in Semgrep by survey name. Returns the survey response object with content-type-specific fields defined upstream in the GetSurveyResponseResponse proto schema. Required: survey_name.
- **create_a_semgrep_survey_submit** — Submit a company survey response in Semgrep by providing a JSON request body with the survey answers. Returns a confirmation object from the survey service whose fields are defined by the upstream CreateSurveyResponseResponse proto schema. Required: a JSON request body.
- **list_all_semgrep_tasks** — Get the status and result of a Semgrep async task or task group by its task token JWT. Returns: status, result (present when the task is completed). Required: task_token_jwt.
- **semgrep_deployment_tokens_bulk_delete** — Delete all tokens matching the given filters in a Semgrep deployment. Only CLI and API tokens can be bulk-deleted. Returns an empty 204 response on success. Required: deployment_id, purpose. role_filter is required when purpose is TOKEN_PURPOSE_API and must not be set for TOKEN_PURPOSE_CLI.
- **create_a_semgrep_issue_autofix** — Trigger an Autofix workflow for a Semgrep issue. The workflow runs asynchronously — it analyzes the issue, generates a fix, and opens a pull request in the underlying repository. Supports SAST, AI SAST, and SCA issue types resolved server-side. Returns: success. Required: deployment_id, issue_id. This feature is currently in Public Beta.
- **list_all_semgrep_deployments** — List Semgrep deployments your auth token can access. Returns: id, name, slug, findings. Auth scope currently covers only the single deployment your token can access.
- **list_all_semgrep_deployment_projects** — List all projects scanned or onboarded to Managed Scans in a Semgrep deployment. Does not return archived repositories. Returns: created_at, default_branch, id, latest_scan_at, name, primary_branch, tags, url. Returns 100 projects per page by default. Required: deployment_slug.
- **delete_a_semgrep_deployment_project_by_id** — Delete a Semgrep project by id. Permanently deletes the project and all of its findings; this action cannot be reversed. Returns: id, name. Required: deployment_id, id.
- **semgrep_deployment_projects_update_tags** — Add tags to a Semgrep project within a deployment. Tags that do not already exist for the deployment are created automatically and associated with the project. Returns the API response object. Required: deployment_slug, project_name.
- **semgrep_deployment_projects_delete_tags** — Remove tags from a Semgrep project within a deployment. Tags are only removed from the specified project; other projects associated with the same tag remain unaffected. Returns the API response object. Required: deployment_slug, project_name.
- **get_single_semgrep_deployment_project_by_id** — Get a specific Semgrep deployment project by its ID. Returns the project object including its id. Required: deployment_id, id.
- **semgrep_deployment_projects_get_by_name** — Get project details. Returns: project. Required: deployment_slug, project_name.
- **semgrep_deployment_projects_delete_by_name** — Delete a Semgrep deployment project by deployment slug and project name. This also deletes all associated findings. Returns an empty 204 response on success. Required: deployment_slug, project_name.
- **semgrep_deployment_projects_bulk_update** — Update attributes for a Semgrep project using the request body. Returns the API response object. Required: deployment_slug, project_name.
- **get_single_semgrep_project_branch_by_id** — Get a single project branch in Semgrep by its ID. Returns the branch object including its id and branch-specific attributes. Required: deployment_id, project_id, id. The v2 API is under active development; expect potential breaking changes.
- **create_a_semgrep_scans_retry** — Retry one or more failed Semgrep Managed Scans (SMS) in a deployment. Only scans that are SMS and have failed or never finished can be retried. Returns: tasks (one per successful retry) and errors (one per failed retry). Required: deployment_id.
- **list_all_semgrep_deployment_scans** — Get details of a specific Semgrep scan by ID. Returns the scan details including associated deployment, repository, and commit information. Required: deployment_id, scan_id.
- **semgrep_deployment_scans_search** — List scans (beta). Returns: cursor, scans. Required: deployment_id.
- **get_single_semgrep_deployment_scan_by_id** — Get a Semgrep scan by its ID within a deployment. Returns: id, attributes. Required: deployment_id, id.
- **list_all_semgrep_bootstrap_sms_vpcs** — Get the Semgrep Managed Scans (SMS) VPC Bootstrap CloudFormation template. Returns the cross-account infrastructure template in JSON format with AWSTemplateFormatVersion, Description, and Resources including IAM roles, policies, and EC2 Image Builder distribution roles for SMS VPC automation. This is a beta feature.
- **list_all_semgrep_deployment_policies** — List policies for a Semgrep deployment. Returns each policy with id, name, and slug. Required: deployment_id.
- **update_a_semgrep_deployment_policy_by_id** — Update a specific policy in a Semgrep deployment. Returns the updated policy with id, name, and slug. Required: id, deployment_id.
- **get_single_semgrep_deployment_policy_by_id** — Get the rules of a specific Semgrep deployment policy by policy id. Returns: cursor, policy, rules. Required: id, deployment_id.
- **create_a_semgrep_sbom_export** — Create a new SBOM export job in Semgrep for a deployment. Returns a JSON response from the SBOM export service that can be used to track the export job status via the sibling status endpoint. Required: deployment_id.
- **get_single_semgrep_sbom_export_by_id** — Get the status of a Semgrep SBOM export job by deployment and task token. Returns the SBOM export job status response. Required: id, deployment_id.
- **list_all_semgrep_deployment_secrets** — List secret findings for a Semgrep deployment, filterable by severity, status, validation state, repository, and detection time. Returns: cursor, findings, previous. Required: deployment_id.
- **delete_a_semgrep_ticketing_ticket_by_id** — Unlink a Jira ticket from a Semgrep deployment by its external ticket ID. Returns an empty 204 response on success. Required: id, deployment_id.
- **semgrep_project_managed_scans_bulk_update** — Toggle Managed Scans for a project. Returns: project. Required: deployment_slug, project_name.
- **create_a_semgrep_deployment_ticket** — Create Jira tickets for Semgrep findings by passing issue_ids or filter parameters to dynamically select findings. Returns the response with a failed array listing issues that were not ticketed. Synchronous; defaults to 20 tickets per request; groups findings by repo and rule into a single ticket (up to 50 issues per ticket). Required: deployment_slug, issue_type.
- **create_a_semgrep_deployment_triage** — Bulk triage findings in a Semgrep deployment, selecting targets by finding IDs (issue_ids) or filter query parameters. Returns a BulkTriageResponse with the results of the triage operation. If specifying new_triage_reason, new_triage_state must be set to ignored. Required: deployment_slug, issue_type.
- **list_all_semgrep_pings** — Ping the Semgrep server to assert liveness. Returns a PingResponse confirming the server is reachable. No required parameters.
- **create_a_semgrep_notification_webhook** — Create a new notification webhook endpoint for a Semgrep deployment. Returns the created webhook object including its id. Required: deployment_id. A JSON request body is required but its field definitions are defined by the upstream CreateNotificationWebhookRequest schema.
- **get_single_semgrep_notification_webhook_by_id** — Get a specific notification webhook by id within a Semgrep deployment. Returns the webhook object including its id. Required: deployment_id, id.
- **update_a_semgrep_notification_webhook_by_id** — Update a notification webhook in Semgrep by replacement. Returns the updated webhook object including its id. Required: deployment_id, id.
- **delete_a_semgrep_notification_webhook_by_id** — Delete a notification webhook in Semgrep by its id. Returns an empty 204 response on success. Required: deployment_id, id.
- **list_all_semgrep_users_lists** — Retrieves a paginated list of users associated with a specific deployment, accepting pagination details in the request body. Experimental endpoint requiring deployment_id.

## How it works

1. **Link your customer's Semgrep account.** Use Truto's frontend SDK; we handle every OAuth and API key flow so you don't need to create the OAuth app.
2. **Authentication is automatic.** Truto refreshes tokens, stores credentials securely, and injects them into every API request.
3. **Call Truto's API to reach Semgrep.** The Proxy API is a 1-to-1 mapping of the Semgrep API.
4. **Get a unified response format.** Every response uses a single shape, with cursor-based pagination and data in the `result` field.

## Use cases

- **Aggregate Semgrep findings into an ASPM platform** — Security posture management SaaS companies can pull SAST, SCA, and secrets findings from Semgrep to correlate them with data from other scanners, giving mutual customers a unified view of application risk without building direct API plumbing.
- **Embed security scorecards in an Internal Developer Portal** — IDPs can surface per-repository issue counts, scan status, and policy coverage from Semgrep directly on service catalog pages, so developers see security health alongside deployment and ownership metadata.
- **Automate compliance evidence collection** — Compliance automation platforms can programmatically fetch SBOMs, detection policies, and scan history from Semgrep to auto-generate SOC2 and ISO 27001 evidence, replacing manual screenshots and CSV exports from mutual customers.
- **Two-way sync between Semgrep issues and external tickets** — Ticketing and workflow SaaS platforms can link Jira, Linear, or ServiceNow tickets to Semgrep issues and reflect triage decisions like 'Risk Accepted' or 'Fixed' back into Semgrep, keeping both systems in lockstep.
- **Trigger Semgrep Autofix from an AI code assistant** — Developer productivity and AI coding tools can offer a one-click remediation experience by calling Semgrep's Autofix jobs from their own UI, generating a PR with the vulnerability fix without the developer leaving the tool.

## What you can build

- **Unified findings ingestion** — Continuously pull SAST, SCA, and secrets findings across all connected Semgrep deployments and normalize them into your product's issue model.
- **Bi-directional triage sync** — Reflect ignore, accept-risk, and reopen actions from your product back into Semgrep using bulk triage and ignore endpoints so state never drifts.
- **One-click Autofix from your UI** — Let end users trigger Semgrep's AI-powered fix job on a finding and track the resulting PR without ever opening Semgrep.
- **SBOM export for compliance** — Kick off asynchronous SBOM generation per deployment and retrieve the completed export to feed audit workflows or dependency inventories.
- **Ticket linking to prevent duplicates** — Link external ticket IDs to Semgrep issues so repeat scans don't spawn duplicate Jira, Linear, or ServiceNow tickets for the same vulnerability.
- **Policy and coverage dashboards** — Fetch detection and remediation policies, project settings, and repo lists to show mutual customers which services are actively protected and which are not.

## FAQs

### How do end users authenticate their Semgrep account?

Truto handles the Semgrep connection flow for you — your users authenticate once and Truto stores and refreshes credentials, so you don't manage tokens or auth state yourself.

### Can we trigger Semgrep's automated remediation from our product?

Yes. Truto exposes Semgrep's Autofix and issue fix job endpoints, so you can trigger AI-generated fixes and PR creation from your own UI on behalf of the connected user.

### Is triage state bi-directional?

Yes. You can read findings and issues from Semgrep and push triage decisions back — including bulk updates, ignores, and creating deployment-level triage actions — to keep your product and Semgrep in sync.

### How do we avoid creating duplicate tickets for the same finding?

Semgrep supports linking external tickets to issues. Truto exposes the ticket link and unlink endpoints so you can associate your internal ticket IDs with Semgrep issue IDs and reconcile on subsequent scans.

### Can we generate SBOMs on demand?

Yes. Truto supports Semgrep's asynchronous SBOM generation and export endpoints, so you can request an SBOM for a deployment and retrieve it once ready for compliance or supply-chain workflows.

### What Semgrep data types are accessible through Truto?

You can access deployments, projects, repos, findings, issues, dependencies, SBOMs, detection and remediation policies, rules, ruleboards, tickets, users, teams, and webhooks — covering the surface needed for ASPM, IDP, compliance, and ticketing use cases.

## Related reading

- [Connect Semgrep to Claude: Audit Policies & Manage Deployments](https://truto.one/blog/connect-semgrep-to-claude-audit-policies-manage-deployments/) — Learn how to build a managed MCP server for Semgrep, connect it to Claude, and orchestrate automated security scans, triage workflows, and policy management.
- [Connect Semgrep to ChatGPT: Triage Findings & Generate Fixes](https://truto.one/blog/connect-semgrep-to-chatgpt-triage-findings-generate-fixes/) — Learn how to connect Semgrep to ChatGPT using Truto's managed MCP server. Automate vulnerability triage, trigger AI fixes, and audit your software supply chain.
- [Connect Semgrep to AI Agents: Automate SCA and SCM Syncs](https://truto.one/blog/connect-semgrep-to-ai-agents-automate-sca-and-scm-syncs/) — Learn how to connect Semgrep to AI Agents to automate SCA vulnerability triage, SCM syncs, and SBOM generation using Truto's auto-generated tool layer.