Skip to main content
GET
List Issues

Authorizations

X-API-KEY
string
header
required
X-CONNECTION-ID
string
header
required

Query Parameters

sort
string | null

Sort by a field, written as field, field:asc or field:desc. Which fields can be sorted on differs per endpoint.

Pattern: ^severity$|^severity\:asc$|^severity\:desc$|^updated_at$|^updated_at\:asc$|^updated_at\:desc$|^state_updated_at$|^state_updated_at\:asc$|^state_updated_at\:desc$
stateUpdatedSince
string<date-time> | null

Only issues whose state changed at or after this time. Use it to poll for newly closed or reopened issues without re-reading everything.

Example:

"2021-01-01T00:00:00+00:00"

firstSeenSince
string<date-time> | null

Only issues the vendor first recorded at or after this time. This is the vendor's own timestamp, not when Leen synced the issue.

Example:

"2021-01-01T00:00:00+00:00"

lastSeenSince
string<date-time> | null

Only issues last observed at or after this time. Issues the vendor has stopped returning fall out of this window, so it is the filter for "what is still there".

Example:

"2021-01-01T00:00:00+00:00"

severity
string | null

Severity filter, comma separated. One or more of CRITICAL, HIGH, MEDIUM, LOW, INFO. Severities are normalised, so this means the same thing whichever vendor found the issue.

Example:

"critical,high"

state
string | null

State filter, comma separated. One or more of OPEN, CLOSED, IGNORED, DELETED. DELETED means the vendor stopped returning the issue, which is not the same as it being fixed.

Example:

"open,closed"

type
string | null

Type filter, comma separated. One or more of VULNERABILITY, LICENSE, CLOUD, CODE, CUSTOM, CONFIG. Prefix the whole value with ! to exclude those types instead.

Example:

"vulnerability,license"

ids
string | null

Fetch specific issues by Leen id, comma separated. At most 100 per request; ids that do not exist are skipped rather than erroring.

Example:

"123e4567-e89b-12d3-a456-426614174000,123e4567-e89b-12d3-a456-426614174001"

exploitable
boolean | null

Filter by whether the vendor asserts the issue is exploitable — a known exploit exists, or it is actively exploited. Issues where the vendor reported no signal match neither true nor false.

Example:

true

reachability
string | null

Reachability filter, comma separated. One or more of REACHABLE, POTENTIALLY_REACHABLE, UNREACHABLE, UNKNOWN. UNKNOWN means the vendor analyzed the issue without reaching a conclusion; issues from vendors with no reachability analysis at all are excluded by any value.

Example:

"REACHABLE,POTENTIALLY_REACHABLE"

enableCursor
boolean
default:false

Enable cursor based pagination instead of default offset-based pagination

updatedSince
string<date-time> | null

Only records whose updated_at is at or after this time. Leen bumps updated_at whenever any field on a record changes, so this is the filter for an incremental sync: it returns records that are new and records that changed, and nothing that has stood still. Example: 2021-01-01T00:00:00+00:00.

Example:

"2021-01-01T00:00:00+00:00"

limit
integer
default:100

How many records to return per page. The walk is the same either way; a larger page means fewer round trips and more memory per response.

Required range: 1 <= x <= 500
offset
integer
default:0

Where to start, counted in records. Offset paging is stable only while the underlying data is; prefer the cursor for anything long-running.

Required range: x >= 0
excludeTotal
boolean
default:false

Skip counting the total. Counting is the expensive half of a large query, so set this when you are walking every page anyway and never read total. total comes back null.

cursor
string | null

Opaque position of the next page, taken from the previous response. Ignore its contents; it encodes where the walk had reached.

Response

Successful Response

count
integer
required

Number of items return in the response

items
AppSecIssue · object[]
required

The records on this page.

total
integer | null

Total number of items that can be returned