Enhance openapi.yaml by adding error response schemas for various endpoints by cx-ryan-wakeham · Pull Request #11 · cx-ryan-wakeham/ProjectHub

cx-ryan-wakeham · 2026-01-26T16:37:38Z

Included error response content sections for multiple endpoints to standardize error handling.
Each error response now references the Error schema, improving clarity and consistency in API documentation.

…points - Included error response content sections for multiple endpoints to standardize error handling. - Each error response now references the Error schema, improving clarity and consistency in API documentation.

cx-ryan-wakeham · 2026-01-26T16:40:58Z

Checkmarx One – Scan Summary & Details – aa8f245b-abe0-4900-9e19-ae4ec496b358

New Issues (155)

Checkmarx found the following issues in this Pull Request

#	Issue	Source File / Package	Checkmarx Insight
1	RDS DB Instance Publicly Accessible	/main.tf: 74	details RDS must not be defined with public interface, which means the field 'publicly_accessible' should not be set to 'true' (default is 'false').
2	S3 Bucket Access to Any Principal	/s3.tf: 22	details S3 Buckets must not allow Actions From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized data ...
3	S3 Bucket Allows Delete Action From All Principals	/s3.tf: 22	details S3 Buckets must not allow Delete Action From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized...
4	S3 Bucket Allows Put Action From All Principals	/s3.tf: 22	details S3 Buckets must not allow Put Action From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized da...
5	DB Instance Storage Not Encrypted	/main.tf: 76	details AWS DB Instance should have its storage encrypted by setting the parameter to 'true'. The storage_encrypted default value is 'false'.
6	Hardcoded AWS Access Key	/main.tf: 25	details AWS Access Key should not be hardcoded
7	IAM Policy Grants Full Permissions	/iam.tf: 22	details IAM policy should not grant full permissions to resources from the get-go, instead of granting permissions gradually as necessary.
8	IAM Policy Grants Full Permissions	/iam.tf: 55	details IAM policy should not grant full permissions to resources from the get-go, instead of granting permissions gradually as necessary.
9	Missing User Instruction	/Dockerfile: 1	details Always set a user in the runtime stage of your Dockerfile. Without it, the container defaults to root, even if earlier build stages define a user.
10	Missing User Instruction	/Dockerfile: 1	details Always set a user in the runtime stage of your Dockerfile. Without it, the container defaults to root, even if earlier build stages define a user.
11	Passwords And Secrets - AWS Access Key	/Dockerfile: 6	details Query to find passwords and secrets in infrastructure code.
12	Passwords And Secrets - AWS Access Key	/docker-compose.yml: 23	details Query to find passwords and secrets in infrastructure code.
13	Passwords And Secrets - AWS Access Key	/variables.tf: 8	details Query to find passwords and secrets in infrastructure code.
14	Passwords And Secrets - AWS Access Key	/ci.yml: 12	details Query to find passwords and secrets in infrastructure code.
15	Passwords And Secrets - AWS Secret Key	/ci.yml: 13	details Query to find passwords and secrets in infrastructure code.
16	Passwords And Secrets - AWS Secret Key	/Dockerfile: 7	details Query to find passwords and secrets in infrastructure code.
17	Passwords And Secrets - AWS Secret Key	/docker-compose.yml: 24	details Query to find passwords and secrets in infrastructure code.
18	Passwords And Secrets - Generic Password	/ci.yml: 17	details Query to find passwords and secrets in infrastructure code.
19	Passwords And Secrets - Generic Password	/docker-compose.yml: 6	details Query to find passwords and secrets in infrastructure code.
20	Passwords And Secrets - Generic Secret	/Dockerfile: 5	details Query to find passwords and secrets in infrastructure code.
21	Passwords And Secrets - Generic Secret	/ci.yml: 15	details Query to find passwords and secrets in infrastructure code.
22	Passwords And Secrets - Generic Secret	/docker-compose.yml: 22	details Query to find passwords and secrets in infrastructure code.
23	Passwords And Secrets - Password in URL	/Dockerfile: 4	details Query to find passwords and secrets in infrastructure code.
24	Passwords And Secrets - Password in URL	/ci.yml: 14	details Query to find passwords and secrets in infrastructure code.
25	Passwords And Secrets - Password in URL	/docker-compose.yml: 20	details Query to find passwords and secrets in infrastructure code.
26	Remote Desktop Port Open To Internet	/main.tf: 43	details The Remote Desktop port is open to the internet in a Security Group
27	S3 Bucket Allows Get Action From All Principals	/s3.tf: 29	details S3 Buckets must not allow Get Action From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized da...
28	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
29	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
30	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
31	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
32	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
33	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
34	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
35	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
36	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
37	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
38	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
39	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
40	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
41	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
42	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
43	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
44	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
45	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
46	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
47	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
48	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
49	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
50	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
51	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
52	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
53	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
54	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
55	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
56	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
57	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
58	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
59	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
60	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
61	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
62	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
63	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
64	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
65	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
66	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
67	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
68	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
69	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
70	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
71	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
72	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
73	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
74	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
75	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
76	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
77	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
78	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
79	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
80	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
81	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
82	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
83	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
84	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
85	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
86	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
87	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
88	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
89	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
90	Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
91	Unknown Port Exposed To Internet	/main.tf: 43	details AWS Security Group should not have an unknown port exposed to the entire Internet
92	Unrestricted Security Group Ingress	/main.tf: 47	details Security groups allow ingress from 0.0.0.0:0 and/or ::/0
93	Apt Get Install Pin Version Not Defined	/Dockerfile: 12	details When installing a package, its pin version should be defined
94	Apt Get Install Pin Version Not Defined	/Dockerfile: 12	details When installing a package, its pin version should be defined
95	Apt Get Install Pin Version Not Defined	/Dockerfile: 12	details When installing a package, its pin version should be defined
96	Apt Get Install Pin Version Not Defined	/Dockerfile: 12	details When installing a package, its pin version should be defined
97	Apt Get Install Pin Version Not Defined	/Dockerfile: 12	details When installing a package, its pin version should be defined
98	Apt Get Install Pin Version Not Defined	/Dockerfile: 12	details When installing a package, its pin version should be defined
99	Apt Get Install Pin Version Not Defined	/Dockerfile: 12	details When installing a package, its pin version should be defined
100	Apt Get Install Pin Version Not Defined	/Dockerfile: 12	details When installing a package, its pin version should be defined
101	Apt Get Install Pin Version Not Defined	/Dockerfile: 12	details When installing a package, its pin version should be defined
102	Container Capabilities Unrestricted	/docker-compose.yml: 15	details Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnec...
103	Container Capabilities Unrestricted	/docker-compose.yml: 64	details Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnec...
104	Container Capabilities Unrestricted	/docker-compose.yml: 2	details Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnec...
105	Container Capabilities Unrestricted	/docker-compose.yml: 39	details Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnec...
106	Container Traffic Not Bound To Host Interface	/docker-compose.yml: 10	details Incoming container traffic should be bound to a specific host interface
107	Container Traffic Not Bound To Host Interface	/docker-compose.yml: 66	details Incoming container traffic should be bound to a specific host interface
108	EC2 Instance Has Public IP	/main.tf: 17	details EC2 Instance should not have a public IP address.
109	EC2 Instance Monitoring Disabled	/main.tf: 17	details EC2 Instance should have detailed monitoring enabled. With detailed monitoring enabled data is available in 1-minute periods
110	HTTP Port Open To Internet	/main.tf: 43	details The HTTP port is open to the internet in a Security Group
111	Healthcheck Not Set	/docker-compose.yml: 64	details Check containers periodically to see if they are running properly.
112	Healthcheck Not Set	/docker-compose.yml: 2	details Check containers periodically to see if they are running properly.
113	Healthcheck Not Set	/docker-compose.yml: 15	details Check containers periodically to see if they are running properly.
114	IAM Database Auth Not Enabled	/main.tf: 62	details IAM Database Auth Enabled should be configured to true when using compatible engine and version
115	IAM Policies Attached To User	/iam.tf: 53	details IAM policies should be attached only to groups or roles
116	IAM Policies With Full Privileges	/iam.tf: 22	details IAM policies shouldn't allow full administrative privileges (for all resources)
117	IAM Policies With Full Privileges	/iam.tf: 55	details IAM policies shouldn't allow full administrative privileges (for all resources)
118	IAM policy allows for data exfiltration	/iam.tf: 22	details This policy contains actions that can retrieve information unrestricted and could lead to data exfiltration
119	IAM policy allows for data exfiltration	/iam.tf: 55	details This policy contains actions that can retrieve information unrestricted and could lead to data exfiltration
120	Privileged Ports Mapped In Container	/docker-compose.yml: 66	details Privileged ports (1 to 1023) should not be mapped. Also you should drop net_bind_service linux capability from the container unless you absolu...
121	RDS With Backup Disabled	/main.tf: 78	details Make sure the AWS RDS configuration has automatic backup configured. If the retention period is equal to 0 there is no backup
122	RDS Without Logging	/main.tf: 62	details RDS does not have any kind of logger
123	S3 Bucket Allows Public ACL	/s3.tf: 13	details S3 bucket allows public ACL
124	S3 Bucket Allows Public Policy	/s3.tf: 14	details S3 bucket allows public policy
125	S3 Bucket Logging Disabled	/s3.tf: 40	details Server Access Logging should be enabled on S3 Buckets so that all changes are logged and trackable
126	S3 Bucket Logging Disabled	/s3.tf: 1	details Server Access Logging should be enabled on S3 Buckets so that all changes are logged and trackable
127	S3 Bucket Policy Accepts HTTP Requests	/s3.tf: 22	details S3 Bucket policy should not accept HTTP Requests
128	S3 Bucket Without Ignore Public ACL	/s3.tf: 15	details S3 bucket without ignore public ACL
129	S3 Bucket Without Versioning	/s3.tf: 1	details S3 bucket should have versioning enabled
130	S3 Bucket Without Versioning	/s3.tf: 40	details S3 bucket should have versioning enabled
131	S3 Bucket with Unsecured CORS Rule	/s3.tf: 51	details If the CORS (Cross-Origin Resource Sharing) rule is defined in an S3 bucket, it should be secure
132	SQL Analysis Services Port 2383 (TCP) Is Publicly Accessible	/main.tf: 43	details Check if port 2383 on TCP is publicly accessible by checking the CIDR block range that can access it.
133	Security Group With Unrestricted Access To SSH	/main.tf: 43	details 'SSH' (TCP:22) should not be public in AWS Security Group
134	Security Opt Not Set	/docker-compose.yml: 64	details Attribute 'security_opt' should be defined.
135	Security Opt Not Set	/docker-compose.yml: 2	details Attribute 'security_opt' should be defined.
136	Security Opt Not Set	/docker-compose.yml: 15	details Attribute 'security_opt' should be defined.
137	Security Opt Not Set	/docker-compose.yml: 39	details Attribute 'security_opt' should be defined.
138	Unpinned Package Version in Pip Install	/Dockerfile: 31	details Package version pinning reduces the range of versions that can be installed, reducing the chances of failure due to unanticipated changes
139	Authentication Without MFA	/iam.tf: 55	details Users should authenticate with MFA (Multi-factor Authentication) to ensure an extra layer of protection when authenticating
140	EC2 Instance Using API Keys	/main.tf: 17	details EC2 instances should use roles to be granted access to other AWS services
141	Healthcheck Instruction Missing	/Dockerfile: 1	details Ensure that HEALTHCHECK is being used. The HEALTHCHECK instruction tells Docker how to test a container to check that it is still working
142	Healthcheck Instruction Missing	/Dockerfile: 1	details Ensure that HEALTHCHECK is being used. The HEALTHCHECK instruction tells Docker how to test a container to check that it is still working
143	IAM Access Analyzer Not Enabled	/s3.tf: 1	details IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
144	IAM Access Analyzer Not Enabled	/iam.tf: 1	details IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
145	IAM Access Analyzer Not Enabled	/main.tf: 17	details IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
146	Instance Uses Metadata Service IMDSv1	/main.tf: 17	details Instance metadata can be accessed with both IMDSv1 or IMDSv2. Although, IMDSv2 service is a session-oriented service, granting additional protect...
147	Instance With No VPC	/main.tf: 17	details EC2 Instances should be configured under a VPC network. AWS VPCs provide the controls to facilitate a formal process for approving and testing all...

More results are available on the CxOne platform

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR

cx-ryan-wakeham merged commit 3c57147 into main Jan 26, 2026
1 check was pending

cx-ryan-wakeham deleted the restore-error-schemas branch January 26, 2026 16:40

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Enhance openapi.yaml by adding error response schemas for various endpoints#11

Enhance openapi.yaml by adding error response schemas for various endpoints#11
cx-ryan-wakeham merged 1 commit intomainfrom
restore-error-schemas

cx-ryan-wakeham commented Jan 26, 2026

Uh oh!

Uh oh!

cx-ryan-wakeham commented Jan 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

cx-ryan-wakeham commented Jan 26, 2026

Uh oh!

Uh oh!

cx-ryan-wakeham commented Jan 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant