Output schemas

A step with saveToDb: true can turn JSON or JSONL output into structured rows by naming an approved outputTable. The name is a physical ingestion contract; the resulting records belong to the logical Inventory domain model.

Inventory-facing catalog

Output table	Writes or enriches
`programs`	Program definitions from trusted crawler workflows.
`scopes`	Scope definitions linked to an existing program.
`domains`	Globally de-duplicated domains.
`ip_addresses`	Globally de-duplicated IPv4 or IPv6 addresses.
`domain_ip_addresses`	A resolved domain-to-IP relationship.
`ports`	Open ports on IP addresses.
`http_ports`	Ports confirmed to speak HTTP or HTTPS.
`http_paths`	Discovered paths on a domain and literal port.
`verify_http_paths`	Status and length enrichment for an existing path.
`technologies`	Technology catalog entries.
`http_path_technologies`	Technology bindings to HTTP paths.
`port_technologies`	Technology bindings to network ports.
`mobiles`	Mobile application package records.

These table names are not an alternative domain hierarchy. For example, http_ports and verify_http_paths isolate write behavior so one producer cannot erase fields owned by another; operators still reason about ports and HTTP paths as Inventory assets.

Discover the live shape

Do not copy a field list from an old workflow or infer database column names. Before authoring a writer, read the current guide through one of these bounded interfaces:

GET /api/output-tables/guides; or
the Sonar MCP get_asset_schemas tool when the active profile exposes asset-write support.

The response describes the accepted input field names, required fields, alternatives, and example rows from the same schema registry used by ingestion. Internal workflow-result schemas may also be present; use only the contract intended for the workflow you are authoring.

Example

{
  "name": "store domains",
  "command": "transform --input {INPUT_FILE_UPSTREAM} --output {OUTPUT_FILE}",
  "variables": {
    "OUTPUT_FILE": "/scan-results/{scanId}/{taskId}/domains.jsonl"
  },
  "saveToDb": true,
  "outputTable": "domains"
}

The output for domains is a JSON array or JSONL stream of objects such as:

{ "value": "api.example.com" }

Ingestion behavior

The result processor streams rows into a temporary table, resolves declared parent relationships, deduplicates rows within the batch, and inserts or updates by each schema's conflict key. Repeating the same accepted observation therefore refreshes or preserves its canonical record instead of creating a duplicate.

Some child rows require an existing parent and are dropped when the relationship cannot be resolved. Producers must respect parent-before-child ordering and compare produced rows with accepted effects. Successful asset upserts refresh updated_at, which is how re-observation participates in the Inventory recency phase.

The external asset synchronization interface exposes a narrower allow-list than workflow output: it cannot create programs or scopes. See Asset acquisition for that ownership boundary.

Inventory-facing catalog

Discover the live shape

Example

Ingestion behavior

On this page