Snyk/groups

@webframp/snyk/groupsv2026.10.21.1· Apache-2.0· 5d agoBEHAVIORS

01README

Snyk Groups — group management, orgs, members, and audit

02Release Notes

2026.10.21.1

Changed: The README now shows the Snyk API token stored in a swamp vault (swamp vault put snyk API_TOKEN) and wired with --global-arg 'apiToken=${{ vault.get("snyk", "API_TOKEN") }}', replacing the literal-token example. The apiToken argument description says the same.

Documentation only: nothing behavioral changed. This API returns no secrets.

03Behaviors1

@webframp/snyk/groupsv2026.10.21.1snyk/groups.ts

Global Arguments

Argument	Type	Required	Description
apiToken	string	yes	Snyk API token. Store it in a vault and wire it with ${{ vault.get("snyk", "API_TOKEN") }}; never pass the literal token.
groupId	string	yes	Snyk group ID
version?	string	no	Snyk API version date

fn list_groups()

Get all groups (Early Access)

fn get_group()

Get Group (Early Access)

fn list_group_audit_logs(cursor?: string, from?: string, to?: string, size?: number, sort_order?: enum, user_id?: string, project_id?: string, events?: union, exclude_events?: union)

Search Group audit logs.

Argument	Type	Required	Description
cursor?	string	no	The ID for the next page of results.
from?	string	no	The start date (inclusive) of the audit logs search.
to?	string	no	The end date (exclusive) of the audit logs search.
size?	number	no	Number of results to return per page.
sort_order?	enum	no	Order in which results are returned.
user_id?	string	no	Filter logs by user ID.
project_id?	string	no	Filter logs by project ID.
events?	union	no	Filter logs by event types, cannot be used in conjunction with exclude_events...
exclude_events?	union	no	Exclude event types from results, cannot be used in conjunctions with events...

fn create_group_export(include_deleted?: string, include_deactivated?: string)

Start an export

Argument	Type	Required	Description
include_deleted?	string	no	Optional parameter to include deleted issues in results
include_deactivated?	string	no	Optional parameter to include disabled issues in results

fn get_group_export(export_id: string)

Get export results

Argument	Type	Required	Description
export_id	string	yes	Unique export identifier

fn get_group_export_job_status(export_id: string)

Get export status

Argument	Type	Required	Description
export_id	string	yes	Unique export identifier

fn list_group_user_org_memberships(user_id?: string, org_name?: string, role_name?: string)

Get list of org memberships of a group user

Argument	Type	Required	Description
user_id?	string	no	The ID of the User
org_name?	string	no	The Name of the org
role_name?	string	no	Filter the response for results only with the specified role.

fn list_orgs_in_group(name?: string, slug?: string, expand?: enum)

List all organizations in group

Argument	Type	Required	Description
name?	string	no	Only return organizations whose name contains this value. Case insensitive.
slug?	string	no	Only return organizations whose slug exactly matches this value. Case sensitive.
expand?	enum	no	Expand the response with additional fields.

fn list_group_policies()

Get group level policies (Early Access)

fn create_group_policy(data: object)

Create a new group level policy (Early Access)

Argument	Type	Required	Description
data	object	yes

fn update_group_policy(policy_id: string, data: object)

Update a group-level policy (Early Access)

Argument	Type	Required	Description
policy_id	string	yes	Policy ID
data	object	yes

fn delete_group_policy(policy_id: string)

Delete an group-level policy (Early Access)

Argument	Type	Required	Description
policy_id	string	yes	Policy ID

fn list_assignments(rule_extension_id?: union, org_id?: string, group_id?: string)

List all assignments for a group

Argument	Type	Required	Description
rule_extension_id?	union	no	Filter by rule extension IDs
org_id?	string	no	Filter by organization ID
group_id?	string	no	Filter by group ID

fn create_assignments(data: unknown)

Create bulk assignments for rule extensions

Argument	Type	Required	Description
data	unknown	yes

fn delete_assignments(id?: union, rule_extension_id?: string)

Delete assignments for rule extensions

Argument	Type	Required	Description
id?	union	no	Filter by IDs
rule_extension_id?	string	no	Filter by rule extension ID

fn list_secrets_rule_extensions()

Get a list of all secrets rule extensions for the requested Group

fn create_secrets_rule_extension(data: unknown)

Create a secrets rule extension

Argument	Type	Required	Description
data	unknown	yes

fn get_secrets_rule_extension(rule_extension_id: string)

Get a secrets rule extension by rule extension ID

Argument	Type	Required	Description
rule_extension_id	string	yes	Unique identifier for a rule extension in request path

fn update_secrets_rule_extension(rule_extension_id: string, data: unknown)

Update a secrets rule extension by rule extension ID

Argument	Type	Required	Description
rule_extension_id	string	yes	Unique identifier for a rule extension in request path
data	unknown	yes

fn delete_secrets_rule_extension(rule_extension_id: string)

Delete a secrets rule extension by rule extension ID

Argument	Type	Required	Description
rule_extension_id	string	yes	Unique identifier for a rule extension in request path

fn update_user(id: string, data?: unknown)

Update a user's role in a group (Early Access)

Argument	Type	Required	Description
id	string	yes	The id of the user
data?	unknown	no

Resources

groups(infinite)— Get all groups (Early Access)

group(infinite)— Get Group (Early Access)

list_group_audit_logs(infinite)— Search Group audit logs.

group_export(infinite)— Start an export

group_export_job_status(infinite)— Get export status

group_user_org_memberships(infinite)— Get list of org memberships of a group user

orgs_in_group(infinite)— List all organizations in group

group_policies(infinite)— Get group level policies (Early Access)

group_policy(infinite)— Create a new group level policy (Early Access)

assignments(infinite)— List all assignments for a group

secrets_rule_extensions(infinite)— Get a list of all secrets rule extensions for the requested Group

secrets_rule_extension(infinite)— Create a secrets rule extension

user(infinite)— Update a user's role in a group (Early Access)

04Previous Versions15

2026.10.14.1Apache-2.0(was none)Oct 14, 2026

2026.10.14.1

Fixed: Methods that write a singleton resource failed on current swamp with Data name 'latest' is reserved for internal use.

Changed: Singleton get and action methods now write their data under group-current, group_export-current, list_group_audit_logs-current instead of latest. Anything that read data.latest("<model>", "latest") or queried name == "latest" must use the new name.

Upgrade note: Data previously stored under latest is not migrated; re-run the method to populate the new name. No attribute schemas changed.

Added: The manifest now declares license: Apache-2.0 (SPDX). The registry quality rubric scores a declared license separately from the bundled LICENSE.md.

2026.10.07.1Oct 7, 2026

2026.10.07.1

Fixed: A request that never answers no longer hangs the method. Each attempt now has a 30-second deadline, and a timeout names the method and path. Rate limiting (HTTP 429) retries up to three times, waits at most 30 seconds between tries, and then reports the rate limit instead of failing with a consumed-body TypeError. An empty 2xx body (202, 204, or an empty 200) no longer fails JSON parsing. A malformed JSON body now reports the HTTP status and the request instead of a bare SyntaxError, and HTTP errors name the request too. Pagination follows a relative next link with or without the /rest prefix, and refuses a next link that leaves the Snyk API origin or the /rest path instead of sending the API token to it.

Changed: Response schemas now accept what the API returns. Enumerated response fields accept any value of their type, value constraints (min, max, pattern) are dropped, response properties may be missing or null, and nested objects keep fields the spec does not list, so one unexpected value no longer fails a whole page. Methods that read or create a single resource now fail when the API answers with an empty body where the spec promises content, instead of storing an empty resource. Operations the spec documents as returning no content (204) still succeed. Argument and field descriptions now end at a word boundary. Request arguments are unchanged, except the array-valued query parameters (events, exclude_events, rule_extension_id, id), which now accept a string or a list of strings. A list joins with commas or repeats the key, as the API specifies for that parameter, and a plain string is sent unchanged. The assignments resource is written by both a list and a get or create method. Its schema now accepts what each writes, where the list wrapper schema rejected the flat data. create_group_export (202) now declares the fields of its 202 response instead of an empty object.

Upgrade note: The loosened response schemas change validation behavior. Stored resources remain valid, and no data migration is needed. Anything that relied on a resource schema to reject an out-of-enum value or a missing field must now check the data itself.

2026.09.27.1Sep 27, 2026

2026.09.27.1

Added: Initial code-generated release of @webframp/snyk/groups with 21 methods covering the Snyk groups API surface.

2026.09.18.1Sep 20, 2026

2026.09.18.1

Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the repo. No behavioral changes in this extension.

2026.09.15.1Sep 15, 2026

2026.09.15.1

Changed: Bump zod 4.4.3 → 4.6.5

2026.09.08.1

Added: Initial code-generated release of @webframp/snyk/groups with 21 methods covering the Snyk groups API surface.

2026.09.08.1Sep 9, 2026

2026.09.08.1

Added: Initial code-generated release of @webframp/snyk/groups with 21 methods covering the Snyk groups API surface.

2026.08.28.2Aug 28, 2026

2026.08.28.2

Hardened codegen: instance names sanitized against path traversal; 429 rate-limit retry with Retry-After; string schema patterns emit regex validation; output schemas passthrough unknown fields.

updated labels

2026.08.28.1Aug 28, 2026

2026.08.28.1

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.26.2

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.26.2Aug 27, 2026

2026.08.26.2

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.25.1Aug 26, 2026

2026.08.25.1

Changed: Updated labels for improved extension discoverability. Added cross-cutting category labels (security, observability, finops, infrastructure, networking, compliance, devops, ai, incident-response) where applicable.

updated labels

2026.08.24.1Aug 24, 2026

2026.08.24.1

Added: Output metadata attributes for observability.

durationMs: Method execution duration in milliseconds.
collectedBy: Extension name that produced the data.
fetchedAt: ISO 8601 timestamp when data was fetched (added to resources that previously lacked it).

2026.08.21.2Aug 22, 2026

2026.08.21.2

Changed: Snyk API request failures now name the HTTP method and path that was attempted (e.g. Snyk API GET /groups/{groupId}/orgs failed with HTTP 403: ...) instead of surfacing only the raw status and body. Network-level failures (DNS, timeout, connection reset) are also caught and re-raised with the same method/path context and the original error preserved as cause, rather than propagating an unlabeled fetch error.

Upgrade note: No changes to stored resource schemas. Existing instances need no migration.

2026.08.21.1Aug 21, 2026

2026.08.21.1

Changed: Schema tightening sweep — no behavioral changes.

Added .min(1) to apiToken, groupId, and the group/organization name fields (they cannot legitimately be empty).
Added .describe(...) to previously undocumented fields on the group policy schemas: action, action_type, conditions_group (and its logical_operator), created_at, created_by, name, and updated_at.

2026.07.20.2Jul 20, 2026

2026.07.20.2

Fixed: The create_group_export method wrote its resource under the spec name create_group_export, but the resource schema is registered under the noun-only key group_export. The write therefore targeted an undeclared resource spec. The method now writes to the declared group_export spec.

Upgrade note: Data from create_group_export is now written under the group_export resource spec instead of create_group_export. Queries or stored resources keyed on the old spec name should be updated.

2026.07.19.1Jul 20, 2026