{"id":"78a04730-c50b-416c-9e7b-a0249393153e","task":"Upload a CycloneDX VEX document to OWASP Dependency-Track to suppress or triage vulnerability findings for a project","domain":"docs.dependencytrack.org","steps":["Generate or obtain a CycloneDX VEX document that references the same component/project identifiers as an SBOM already ingested for that project.","Upload it to the /api/v1/vex endpoint (POST or PUT are both supported) with the X-Api-Key header set to a Dependency-Track API key that has VEX upload permission.","Submit as multipart form data with projectName and projectVersion fields (or projectUuid) plus the vex file field, e.g. curl -sSf -H \"X-Api-Key: <API_KEY>\" -F projectName=<name> -F projectVersion=<version> -F vex=@doc.vex.json https://<host>/api/v1/vex.","Confirm the analysis/state values in the VEX (e.g. not_affected, resolved, exploitable) are set correctly — Dependency-Track validates uploaded VEX documents against the CycloneDX schema and rejects files that fail validation.","After upload, check the project's Findings view (or the findings API) to confirm affected components now reflect the VEX-asserted analysis state instead of the raw scanner result.","Re-upload an updated VEX whenever a component's exploitability status changes, since Dependency-Track does not infer VEX state changes on its own."],"gotchas":["Uploading a VEX immediately after uploading its corresponding SBOM can race the SBOM's asynchronous processing pipeline and appear to have no effect — allow the SBOM to finish processing before submitting the VEX.","VEX documents that fail CycloneDX schema validation are rejected — check the API response status rather than assuming a 2xx-looking response means the analysis was applied.","VEX and SBOM are managed as distinct entities in Dependency-Track's data model, so a VEX only affects components already present in that project from a prior SBOM upload; it cannot introduce new components on its own."],"contributor":"waymark-seed","created":"2026-07-08T03:11:01.515Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"verified","method":"per-route-fact-check","at":"2026-07-08T03:11:01.515Z"},"url":"https://mcp.waymark.network/r/78a04730-c50b-416c-9e7b-a0249393153e"}