<commit_before>---
title: File Formats
category: Integrations
chapter: 5
order: 6
---

Dependency-Track has an *API-first design*. API's are simply at the heart of the platform. However, there are 
occasions when a file-based format is desired for integration with other systems, especially legacy systems or
systems that are not API-aware or compatible.

Dependency-Track has a native format that can be used to share findings with other systems. The findings contain 
identical information as presented while auditing, but also include information about the project and the system 
that created the file. The file type is called **Finding Packaging Format** (FPF) and is available in 
Dependency-Track v3.4 and higher.

FPF's are json files and have the following sections:

| Name     | Type   | Description |
| ---------|--------|-----|
| version  | string | The Finding Packaging Format document version |
| meta     | object | Describes the Dependency-Track instance that created the file |
| project  | object | The project the findings are associated with |
| findings | array  | An array of zero or more findings |

#### Example

```json
{
  "version": "1.0",
  "meta" : {
    "application": "Dependency-Track",
    "version": "3.4.0",
    "timestamp": "2018-11-18T23:31:42Z",
    "baseUrl": "http://dtrack.example.org"
  },
  "project" : {
    "uuid": "ca4f2da9-0fad-4a13-92d7-f627f3168a56",
    "name": "<NAME>",
    "version": "1.0",
    "description": "A sample application"
  },
  "findings" : [
  {<commit_msg>word swap<commit_after>---
title: File Formats
category: Integrations
chapter: 5
order: 6
---

Dependency-Track has an *API-first design*. API's are simply at the heart of the platform. However, there are 
occasions when a file-based format is desired for integration with other systems, especially legacy systems or
systems that are not API-aware or compatible.

Dependency-Track has a native format that can be used to share findings with other systems. The findings contain 
identical information as presented while auditing, but also include information about the project and the system 
that created the file. The file type is called **Finding Packaging Format** (FPF) and is available in 
Dependency-Track v3.4 and later.

FPF's are json files and have the following sections:

| Name     | Type   | Description |
| ---------|--------|-----|
| version  | string | The Finding Packaging Format document version |
| meta     | object | Describes the Dependency-Track instance that created the file |
| project  | object | The project the findings are associated with |
| findings | array  | An array of zero or more findings |

#### Example

```json
{
  "version": "1.0",
  "meta" : {
    "application": "Dependency-Track",
    "version": "3.4.0",
    "timestamp": "2018-11-18T23:31:42Z",
    "baseUrl": "http://dtrack.example.org"
  },
  "project" : {
    "uuid": "ca4f2da9-0fad-4a13-92d7-f627f3168a56",
    "name": "Acme Example",
    "version": "1.0",
    "description": "A sample application"
  },
  "findings" : [
  {
{'fraction_non_alphanumeric': 0.119960668633235, 'fraction_numerical': 0.028843002294329727, 'mean_word_length': 3.5081240768094535, 'pattern_counts': {'":': 18, '<': 4, '<?xml version=': 0, '>': 4, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6014809', 'n_tokens_mistral': 940, 'n_tokens_neox': 887, 'n_words': 358}