> For the complete documentation index, see [llms.txt](https://docs.konvu.com/konvu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.konvu.com/konvu/get-started/bring-in-findings/code-scanners/endor-labs.md).

# Endor Labs

Import Endor Labs SCA findings into Konvu for exploitability analysis.

The Endor Labs integration imports SCA vulnerability findings from Endor Labs into Konvu. When Endor Labs provides function-level reachability data, Konvu uses it alongside its own analysis to produce more accurate exploitability assessments.

## What this integration brings in

* Vulnerability identifiers (CVE/GHSA) from Endor Labs findings
* Affected dependency name, version, and ecosystem (Maven, npm, pip, Go, RubyGems, NuGet, Cargo, Composer, Swift, CocoaPods, Hex, Pub)
* Manifest and dependency file locations
* Reachability data -- function-level and dependency-level reachability status when available
* Direct vs. transitive dependency classification
* Finding state (open, snoozed/excepted, fixed)

{% hint style="info" %}
The Endor Labs integration is configured at the namespace level. Each namespace maps to one integration in Konvu.
{% endhint %}

## Prerequisites

* An Endor Labs account with API access
* An API key and API secret from Endor Labs (found in **Settings > API Keys** in the Endor Labs console)
* The namespace you want to import findings from

## Setup steps

1. In the Endor Labs console, go to **Settings > API Keys** and create an API key. Copy both the **API key** and the **API secret**.
2. Navigate to [**Integrations**](https://app.konvu.com/integrations) in Konvu.
3. Click **Endor Labs**.
4. Enter the following:
   * **API Key** -- the key from Endor Labs
   * **API Secret** -- the secret paired with the key
   * **Namespace** -- the Endor Labs namespace to import findings from
5. Click **Submit**. Konvu validates your credentials and namespace before creating the integration.

If validation fails, you will see one of two errors:

* **Invalid credentials** -- the API key or secret is wrong
* **Invalid namespace** -- the namespace does not exist or is not accessible with the provided credentials

## Verify findings are flowing

After connecting, Konvu runs an initial sync to import all SCA findings from the namespace. To confirm:

1. Go to **Integrations** in Konvu and check that the Endor Labs integration shows a successful sync status.
2. Click the integration to see the list of imported projects and their finding counts.
3. Navigate to the **Triage** page -- your Endor Labs findings should appear there.

If the sync shows an error, verify that:

* Your API key and secret are still valid
* The namespace has projects with SCA findings
* The API key has permission to read findings in the namespace

## Next steps

* [Connect your environment](/konvu/get-started/connect-your-environment.md) to give Konvu source code context for exploitability analysis
* [Triage findings](/konvu/triage-and-remediation/exploitability-assessment.md) to review Konvu's AI-driven assessments on your Endor Labs findings


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.konvu.com/konvu/get-started/bring-in-findings/code-scanners/endor-labs.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.