{
  "$schema": "https://json-schema.org/draft-06/schema#",
  "additionalProperties": {
    "$ref": "#/definitions/vexdata"
  },
  "definitions": {
    "Detail": {
      "title": "Detail",
      "type": "string"
    },
    "Justification": {
      "description": "The rationale of why the impact analysis state was asserted. \n\n* __code\\_not\\_present__ = the code has been removed or tree-shaked. \n* __code\\_not\\_reachable__ = the vulnerable code is not invoked at runtime. \n* __requires\\_configuration__ = exploitability requires a configurable option to be set/unset. \n* __requires\\_dependency__ = exploitability requires a dependency that is not present. \n* __requires\\_environment__ = exploitability requires a certain environment which is not present. \n* __protected\\_by\\_compiler__ = exploitability requires a compiler flag to be set/unset. \n* __protected\\_at\\_runtime__ = exploits are prevented at runtime. \n* __protected\\_at\\_perimeter__ = attacks are blocked at physical, logical, or network perimeter. \n* __protected\\_by\\_mitigating\\_control__ = preventative measures have been implemented that reduce the likelihood and/or impact of the vulnerability.",
      "enum": [
        "code_not_present",
        "code_not_reachable",
        "requires_configuration",
        "requires_dependency",
        "requires_environment",
        "protected_by_compiler",
        "protected_at_runtime",
        "protected_at_perimeter",
        "protected_by_mitigating_control"
      ],
      "title": "Impact justification",
      "type": "string"
    },
    "Response": {
      "description": "A response to the vulnerability by the manufacturer, supplier, or project responsible for the affected component or service. More than one response is allowed. Responses are strongly encouraged for vulnerabilities where the analysis state is exploitable.",
      "enum": [
        "",
        "can_not_fix",
        "will_not_fix",
        "update",
        "rollback",
        "workaround_available"
      ],
      "title": "Response",
      "type": "string"
    },
    "State": {
      "description": "Declares the current state of an occurrence of a vulnerability, after automated or manual analysis. \n\n* __resolved__ = the vulnerability has been remediated. \n* __resolved\\_with\\_pedigree__ = the vulnerability has been remediated and evidence of the changes are provided in the affected components pedigree containing verifiable commit history and/or diff(s). \n* __exploitable__ = the vulnerability may be directly or indirectly exploitable. \n* __in\\_triage__ = the vulnerability is being investigated. \n* __false\\_positive__ = the vulnerability is not specific to the component or service and was falsely identified or associated. \n* __not\\_affected__ = the component or service is not affected by the vulnerability. Justification should be specified for all not_affected cases.",
      "enum": [
        "resolved",
        "resolved_with_pedigree",
        "exploitable",
        "in_triage",
        "false_positive",
        "not_affected"
      ],
      "title": "State",
      "type": "string"
    },
    "vexdata": {
      "additionalProperties": false,
      "properties": {
        "detail": {
          "$ref": "#/definitions/Detail"
        },
        "justification": {
          "$ref": "#/definitions/Justification"
        },
        "response": {
          "items": {
            "$ref": "#/definitions/Response"
          },
          "type": "array"
        },
        "state": {
          "$ref": "#/definitions/State"
        }
      },
      "required": [
        "detail",
        "response",
        "state"
      ],
      "title": "vexdata",
      "type": "object"
    }
  },
  "type": "object"
}