Skip to main content
GET
List Integrations
An integration is a vendor that Leen can connect to. This endpoint returns the full catalog of supported integrations with their details; the response is the same for every organization, so you can call it without first creating a connection. Use the category query parameter to narrow the list to one or more domains. Each item’s integration_id (for example TENABLE, SNYK, WIZ_CODE) is the exact value to pass as vendor when creating a connection. data_exports lists the data types that integration produces, and categories maps to the domain sections of this documentation (AppSec, EDR, VMS, and so on). parameters describes the credential form fields for that integration — names and types only, never secret values.

Filter capabilities

Some filters on the data export endpoints are tri-state. reachability and exploitable on List Issues, List Vulnerabilities and List Vulnerability Findings are null on every record for which the vendor gave no signal, and a null matches no filter value. Filtering a vendor that never reports the field therefore returns an empty page that looks exactly like “no record matched”. capabilities tells you, per integration and per data export, which of those filters the vendor actually populates and which values it emits, so a filter UI can be built per connection without guessing. The block is keyed by data export and covers three today. Only filters whose population varies by vendor are declared; date windows, id lists and sort behave the same everywhere and are not listed. Every integration that exports one of these data exports declares the matching block.
The contract, as stated in the capabilities field description in the reference below:Filter support declared by the integration, keyed by data export (for example vulnerability_findings_v2) and then by filter name. Absence is unknown, not unsupported: an integration without capabilities, or a data export or filter missing inside it, makes no claim; only "supported": false is an explicit negative. "supported": true means at least some records carry a non-null value for the filter, not all of them. values_emitted lists the normalized values the integration can produce and is present on every supported filter with a fixed set of values, enumerations and booleans alike; a free-form filter such as cve carries none. notes explains the scope, such as which record types carry the value.
Socket’s vulnerability_findings_v2 block, which populates both filters:
Tenable’s vulnerabilities block, abridged to five of its eight filters, shows the other shapes: an unsupported filter, a supported boolean, a supported enumeration and two supported free-form filters. Keys the integration does not declare are serialized as explicit null, so values_emitted and notes are always present on the wire: an unsupported filter carries null for both, and a supported free-form filter such as port or cve carries notes but no values_emitted.

Rendering a filter UI from the block

  • A filter that is absent from the block, or has "supported": false, should be hidden or disabled for that integration.
  • A filter with "supported": true and a values_emitted list should offer exactly that list as its options. Do not offer values the API accepts but the vendor never emits; selecting one returns an empty page.
  • A supported free-form filter (port, protocol, cve) has no values_emitted; render it as a text input and read notes for the vendor’s conventions. protocol is matched case-sensitively, and vendors differ: Tenable and Rapid7 InsightVM emit TCP, Qualys emits tcp.
  • notes is tooltip text: scope caveats such as which record types carry the value.
  • "supported": true means some records carry a value. A vendor can report reachability on dependency findings while its SAST findings stay null, so selecting every value in values_emitted is not the same as applying no filter.
null is not a filter value. All three endpoints reject ?reachability=null and ?exploitable=null with a 422. Omitting the parameter means “no filter”, not “match null”. There is no way today to ask for the records a vendor did not assess.

Reading the block

Absence is unknown, not unsupported: an integration without capabilities, or a data export or filter missing inside it, makes no claim either way. "supported": true is “some, not all”, which is why notes matters. values_emitted is the list to offer and is always present on a supported filter with a fixed set of values, whether an enumeration or a boolean (booleans list [true, false]); a free-form filter such as cve never carries one. values_emitted uses the stored, uppercase vocabulary. List Vulnerabilities renders its enumerated fields in lowercase on records ("severity": "high", "reachability": "reachable") and its severity, state, category and reachability filters accept either case; protocol does not. The filters themselves are documented on List Issues, List Vulnerabilities and List Vulnerability Findings.

Authorizations

X-API-KEY
string
header
required

Query Parameters

offset
integer
default:0

Offset index of items (starting from 0)

Required range: x >= 0
limit
integer
default:100

Limit size (page size)

Required range: x >= 0
category
string | null

Filter by category, comma separated

Response

Successful Response

count
integer
required

Number of items return in the response

items
IntegrationRespModel · object[]
required

The records on this page.

total
integer | null

Total number of items that can be returned