> ## Documentation Index > Fetch the complete documentation index at: https://docs.pharussecurity.com/llms.txt > Use this file to discover all available pages before exploring further. # VEX from other tools > Bring verdicts from govulncheck, Trivy, Grype, Dependency-Track and your suppliers into Pharus, and use them as your own VEX statements. **Plans:** Every plan. On Free, VEX documents stay readable and downloadable, but new ones are refused. **Who:** any member uploads, retires and reactivates VEX documents and uses their statements; owners and admins create the API tokens that pipelines use. Your scanners and suppliers often already know whether a vulnerability affects a component: govulncheck sees that your code never calls the vulnerable function, Dependency-Track holds your team's analysis, and a supplier publishes CSAF advisories. A VEX document carries those verdicts. Pharus binds each statement to the components of one product family, shows it on the matches it is about, and lets you use it as your own [VEX status](/monitoring/vulnerabilities#set-a-vex-status). ## What Pharus applies and what stays evidence | Verdict in the document | What Pharus does | | - | - | | Fixed | The versions it names count as fixed, also in your advisories. When every active SBOM with the component is fixed, Pharus sets the match's VEX status to **Fixed** itself. | | Not affected | Shown on the match as evidence, with the justification. You decide whether to use it. | | Affected, under investigation | Shown on the match as evidence. | | A finding without a verdict | Shown on the match as "Found by" the tool. Where Pharus has no match of its own, it becomes a possible match to confirm. | A VEX status you set yourself always wins. Pharus never changes it because of a document. ## Supported formats | Format | Typical source | | - | - | | OpenVEX | `govulncheck -format openvex` | | CSAF 2.0 VEX | Your suppliers' advisories | | CycloneDX JSON 1.4–1.7 with a `vulnerabilities` section | A CycloneDX VEX document, Dependency-Track's VDR, Trivy or Grype output | XML and SPDX documents aren't read. The limits are 4 MB as sent, 50 MB uncompressed and 50 000 statements per document. Vulnerabilities inside an SBOM count too. When an SBOM from Trivy or Grype carries a `vulnerabilities` section, Pharus keeps it as a VEX document attached to that SBOM, and the SBOM's page says "VEX in this SBOM" with the counts. ## How statements bind to your components Pharus binds each statement to the family's components by purl or CPE, by a CycloneDX BOM-link, or to the product as a whole. A statement that names nothing Pharus can bind is counted as such on the document's page and changes nothing. * **Product version.** A document uploaded with a **Product version** holds for that version only. Without one, it holds for every version the family has. * **Newest wins.** The newest statement per component and product version counts. * **Replacement.** A later document from the same tool for the same version replaces the earlier one. govulncheck, Trivy, Grype, Dependency-Track and OSV-Scanner each count as one source; for other documents, the source is the document's own id. ## Upload a VEX document Go to **SBOMs** and select **Upload VEX**. Pick the **Product family**. Enter the **Product version** the document is about, or leave it empty when it holds for every version. Drop a `.json` file on **VEX file**, or select **Choose file**. **Use the sample** loads govulncheck-style statements for the sample SBOM. Select **Upload VEX**. Pharus confirms with the number of statements and findings, matches the family again and opens the document's page. If you send a file Pharus already has for that family, it says "This VEX document was already uploaded" and stores nothing new. ## Send VEX from CI Pipelines send VEX documents to [`POST /api/v1/vex`](/api-reference/vex) with the same API token as the family's SBOMs. The **VEX** tab of **Connect a pipeline** on the **SBOMs** page has ready-made steps with your endpoint filled in: * **govulncheck**: `govulncheck -format openvex` sent to `/api/v1/vex`. * **Trivy or Grype**: a CycloneDX SBOM with the findings inside, sent to `/api/v1/sboms` as usual. * **Dependency-Track**: the project's VDR, exported with `?variant=vdr&format=json` and sent to `/api/v1/vex`. It carries your analysis with the justification and details. Dependency-Track can also send each analysis decision as it is made. See [Dependency-Track](/api-reference/dependency-track#analysis-decisions). ## The VEX documents list Each family card on the **SBOMs** page has a **VEX documents** section with up to 10 documents, active ones first: | Column | What it shows | | - | - | | **Source** | The tool or the upload | | **Format** | CycloneDX, OpenVEX, CSAF, or Dependency-Track analysis | | **Applies to** | The product version, or "Every version" | | **Contents** | The number of statements and findings | | **Received** | When Pharus received it, in Oslo time | Retired documents are shown muted and marked "Retired". ## A VEX document's page Select a document to open it. * **Details**: **Product family**, **Applies to**, **Format**, **Tool**, **Author**, **Document ID**, **Document version**, **Issued**, **SHA-256** and size, **Source**, **Sent by** and **Received**. A document that came inside an SBOM names it under **Came in SBOM**. * **Contents**: how many statements have a verdict, how many are scanner findings without one, how many name nothing Pharus can bind, and how many current matches carry them. * **Statements**: each **Vulnerability**, **Component**, **Status** and **Why** (the justification, then the impact or action statement), up to 200 rows. **Download original** gives you the file exactly as Pharus received it, for example `gateway-g3-4.2.openvex.json`. Every member can download it, also while the workspace is read-only. ## Use the statements as your VEX To take over one statement, select **Use** on the match. See [use a statement as your own](/monitoring/vulnerabilities#use-a-statement-as-your-own). To take over every not-affected statement in a document at once: On **SBOMs**, select the document in the family's **VEX documents** section. Select **Use n not-affected statements**, read the confirmation and select **Use statements**. Every match still under investigation that the document says isn't affected becomes **Not affected**, with the document's justification and impact statement, as your statement. Matches you set yourself are left as they are. Statements without a justification are left for you to set one by one. Each change is recorded in the [audit trail](/reports/audit-trail) and shows in your advisories. ## Retire or reactivate a document Select **Retire** on the document's page, then **Retire document**. Its statements stop counting: the evidence leaves the matches, and a **Fixed** status Pharus set from it changes back. The document stays in the audit trail. **Reactivate** makes its statements count again. It is refused while a later document from the same source for the same version is active. ## Related This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.