Skip to main content
Root provides a suite of reports and dashboards that give AppSec and Security Leadership continuous visibility into the state of your supply chain - what’s been patched, what’s still exposed, and how your posture has changed over time.

​
Available Reports

​
Accessing Reports

Root platform UI: The dashboard and all report views are accessible from the Root platform at app.root.io. Log in with your organization credentials. The left sidebar provides navigation to:
  • Dashboard - fleet-wide metrics at a glance
  • Vulnerabilities - full CVE table with filtering and export
  • Reports - vulnerability reduction graphs and per-artifact views
  • Subscriptions - per-image and per-package patch status
Root API: Every report is accessible programmatically via the Root REST API at https://api.root.io/v1. Authenticate with a Bearer token:
See the API Reference for the full endpoint list. Export formats: Webhook notifications: Root can deliver patch events to a webhook endpoint in real time - when a patch is applied to a subscribed artifact, Root sends a notification to your endpoint. Integrate with Slack, PagerDuty, Jira, or your SIEM. Contact Root to configure webhooks.

​
Integrating with Your Security Stack

Root reports are designed to integrate with existing security tooling: Vulnerability scanners (Grype, Trivy): Import Root SBOM and VEX files into your scanner to suppress findings for patched CVEs. See VEX Reports for scanner-specific instructions. ASPM platforms (Wiz, Orca, Snyk): Use VEX statements to update finding status in your ASPM. Root’s VEX marks patched CVEs as fixed, suppressing them from active alert queues. SIEM (Splunk, Elastic): Poll the Root API on a schedule to ingest patch events. Use the /patches endpoint filtered by updated_at to get incremental updates. Dependency-Track: Import Root SBOMs (CycloneDX format) directly into Dependency-Track projects for continuous monitoring and policy evaluation. Ticketing (Jira, ServiceNow): Use webhooks or API polling to automatically close vulnerability tickets when Root delivers a patch.