> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tierity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Endor Labs

> Import dependency findings and reachability analysis from Endor Labs to track supply chain risk in Tierity.

## Overview

Endor Labs focuses on software supply chain security — specifically dependency lifecycle management and reachability analysis. Rather than surfacing every CVE in a dependency tree, Endor Labs identifies which vulnerabilities are actually reachable from your code's call paths. The Tierity integration imports these findings so teams can prioritize remediation based on real exploitability.

## Prerequisites

* An Endor Labs account with API access
* Manage access (or higher) in Tierity

## Credentials required

| Field | Description |
| - | - |
| **API Key** | API key from Endor Labs Settings → API Keys |
| **Namespace** | Your Endor Labs namespace (organization identifier) |

## Setup

**1. Create an Endor Labs API key**

1. In Endor Labs, go to **Settings → API Keys**.
2. Click **Create API Key**.
3. Give it a name like "Tierity" and assign **Read** permissions.
4. Copy the **API key** and note your **namespace**.

**2. Configure in Tierity**

1. Go to **Config → Integrations → Endor Labs**.
2. Enter your **API Key** and **Namespace**.
3. Click **Save & Test**.

## What gets synced

| Data | Description |
| - | - |
| **Dependency vulnerabilities** | CVEs in your direct and transitive dependencies |
| **Reachability** | Whether the vulnerable code path is reachable from your application |
| **Severity** | Critical, high, medium, low — adjusted by reachability |
| **Dependency versions** | Current version, fixed version, and upgrade path |
| **EPSS score** | Exploit Prediction Scoring System score for prioritization |
| **Package ecosystem** | npm, PyPI, Maven, Go modules, etc. |

## Reachability analysis

Endor Labs's key differentiator is call-graph-based reachability analysis. Tierity surfaces this:

* Findings are tagged **Reachable**, **Unreachable**, or **Unknown**
* Reachable findings are sorted to the top of the findings list
* Unreachable findings can be filtered out to reduce noise

This lets you focus remediation effort on the vulnerabilities that pose real risk rather than working through every CVE in your dependency graph.

## Viewing findings in Tierity

Endor Labs findings appear under **Security Findings → Endor Labs**. You can:

* Filter by reachability status, severity, and package ecosystem
* View CVE details, CVSS scores, and EPSS scores
* See the dependency chain from your application to the vulnerable package
* Assign findings to tasks

## Disconnecting

1. Go to **Config → Integrations → Endor Labs**.
2. Click **Disconnect**.
3. Confirm.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.