DependencyTrack / DependencyTrack/dependency-track
API response from GET /api/v1/team/{id} is missing data
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Currently the API response from `GET /api/v1/team/{id}` appears to be missing at least the fields for `apiKeys` and `mappedOidcGroups`. These fields should be present according to the Swagger docs at `/api/swagger.json`. There might be additional fields missing that I cannot quickly test.
An example team returned in the list of all teams from `GET /api/v1/team` is as follows (prettified for readability, surrounding array skipped):
```
{
"uuid": "27cf681a-b839-490b-b1a0-bc8b096bb72c",
"name": "TestAPI",
"apiKeys": [
{
"key": "",
"comment": null,
"created": 1721886442251,
"lastUsed": null,
"maskedKey": "odt_****************************0UsC"
}
],
"ldapUsers": [],
"managedUsers": [],
"oidcUsers": [],
"mappedLdapGroups": [],
"mappedOidcGroups": [
{
"group": {
"uuid": "82ddcd52-9df5-4aaa-9467-e681452c6945",
"name": "Test"
},
"uuid": "d40807d0-31aa-4374-915f-0e86590fcc10"
}
],
"permissions": [
{
"name": "ACCESS_MANAGEMENT",
"description": "Allows the management of users, teams, and API keys"
},
{
"name": "BOM_UPLOAD",
"description": "Allows the ability to upload CycloneDX Software Bill of Materials (SBOM)"
}
]
},
```
The same team returned from a call to `GET /api/v1/team/27cf681a-b839-490b-b1a0-bc8b096bb72c`:
```
{
"uuid": "27cf681a-b839-490b-b1a0-bc8b096bb72c",
"name": "TestAPI",
"permissions": [
{
"name": "ACCESS_MANAGEMENT",
"description": "Allows the management of users, teams, and API keys"
},
{
"name": "BOM_UPLOAD",
"description": "Allows the ability to upload CycloneDX Software Bill of Materials (SBOM)"
}
]
}
```
(appears to be missing most fields, even those that would be non-empty, like `apiKeys` and `mappedOidcGroups`)
According to the Swagger docs those two calls should generate equivalent JSON for a single team.
### Steps to Reproduce
Nothing special appears to be needed. In case of trouble with replicating the effect I will try to come up with a test case.
This was tested on a dockerized DT started from a docker compose file consistent with https://dependencytrack.org/docker-compose.yml (no changes to the configuration of those two containers).
### Expected Behavior
Optimally: the `GET /api/v1/team/{id}` endpoint returns all the data of the team, and at least as much as `GET /api/v1/team` returns.
Alternatively: the Swagger docs reflect the actual, limited output of `GET /api/v1/team/{id}` endpoint.
Workaround is currently to get a team by getting them all via `GET /api/v1/team`, but this is not great with many teams and also given the fact that all the API keys of all teams are returned in the response and unnecessarily end up in caller's memory.
### Dependency-Track Version
4.11.5
### Dependency-Track Distribution
Container Image
### Database Server
N/A
### Database Server Version
_No response_
### Browser
N/A
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.