> ## Documentation Index
> Fetch the complete documentation index at: https://docs.leen.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# List Integration Details

> Filterable catalog of the vendors Leen can connect to, with each vendor's version, credential parameters, categories and data exports. A superset of the Connectors endpoint.

An integration is a vendor that Leen can connect to. This endpoint returns the full catalog of supported integrations with their details; the response is the same for every organization, so you can call it without first creating a connection. Use the `category` query parameter to narrow the list to one or more domains.

Each item's `integration_id` (for example `TENABLE`, `SNYK`, `WIZ_CODE`) is the exact value to pass as `vendor` when [creating a connection](/api-reference/creating-a-connection). `data_exports` lists the data types that integration produces, and `categories` maps to the domain sections of this documentation (AppSec, EDR, VMS, and so on). `parameters` describes the credential form fields for that integration — names and types only, never secret values.

## Filter capabilities

Some filters on the data export endpoints are tri-state. `reachability` and `exploitable` on [List Issues](/api-reference/appsec/get-issues), [List Vulnerabilities](/api-reference/vms/get-vulnerabilities) and [List Vulnerability Findings](/api-reference-v2/get-vulnerability-findings) are `null` on every record for which the vendor gave no signal, and a `null` matches no filter value. Filtering a vendor that never reports the field therefore returns an empty page that looks exactly like "no record matched". `capabilities` tells you, per integration and per data export, which of those filters the vendor actually populates and which values it emits, so a filter UI can be built per connection without guessing.

The block is keyed by data export and covers three today. Only filters whose population varies by vendor are declared; date windows, id lists and sort behave the same everywhere and are not listed. Every integration that exports one of these data exports declares the matching block.

| Data export | Endpoint | Filters declared |
| - | - | - |
| `vulnerability_findings_v2` | [List Vulnerability Findings](/api-reference-v2/get-vulnerability-findings) | `reachability`, `exploitable` |
| `issues` | [List Issues](/api-reference/appsec/get-issues) | `reachability`, `exploitable`, `severity`, `state`, `include_type`, `exclude_type` |
| `vulnerabilities` | [List Vulnerabilities](/api-reference/vms/get-vulnerabilities) | `reachability`, `exploitable`, `severity`, `state`, `category`, `port`, `protocol`, `cve` |

<Note>
  The contract, as stated in the `capabilities` field description in the reference below:

  Filter support declared by the integration, keyed by data export (for example `vulnerability_findings_v2`) and then by filter name. Absence is unknown, not unsupported: an integration without capabilities, or a data export or filter missing inside it, makes no claim; only `"supported": false` is an explicit negative. `"supported": true` means at least some records carry a non-null value for the filter, not all of them. `values_emitted` lists the normalized values the integration can produce and is present on every supported filter with a fixed set of values, enumerations and booleans alike; a free-form filter such as `cve` carries none. `notes` explains the scope, such as which record types carry the value.
</Note>

Socket's `vulnerability_findings_v2` block, which populates both filters:

```json theme={null}
"capabilities": {
  "vulnerability_findings_v2": {
    "filters": {
      "reachability": {
        "supported": true,
        "values_emitted": ["REACHABLE", "POTENTIALLY_REACHABLE", "UNREACHABLE", "UNKNOWN"],
        "notes": "Verdicts Socket could not determine, including analysis pending, errored or unsupported for the package ecosystem, are reported as UNKNOWN."
      },
      "exploitable": {
        "supported": true,
        "values_emitted": [true, false],
        "notes": "True when the CVE is in the CISA Known Exploited Vulnerabilities catalog and false when Socket reports it is not; findings without vulnerability data carry no value."
      }
    }
  }
}
```

Tenable's `vulnerabilities` block, abridged to five of its eight filters, shows the other shapes: an unsupported filter, a supported boolean, a supported enumeration and two supported free-form filters. Keys the integration does not declare are serialized as explicit `null`, so `values_emitted` and `notes` are always present on the wire: an unsupported filter carries `null` for both, and a supported free-form filter such as `port` or `cve` carries `notes` but no `values_emitted`.

```json theme={null}
"capabilities": {
  "vulnerabilities": {
    "filters": {
      "reachability": {
        "supported": false,
        "values_emitted": null,
        "notes": null
      },
      "exploitable": {
        "supported": true,
        "values_emitted": [true, false],
        "notes": "Tenable's own exploit_available flag on the plugin: true when Tenable's exploit sources hold an exploit for the plugin, false when Tenable has assessed the plugin and found none. Populated on every finding observed; a plugin without the flag carries no value."
      },
      "severity": {
        "supported": true,
        "values_emitted": ["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO", "NONE"],
        "notes": "Tenable severity 0 to 4 map to INFO, LOW, MEDIUM, HIGH and CRITICAL; any other value is NONE."
      },
      "port": {
        "supported": true,
        "values_emitted": null,
        "notes": "Populated on every finding; local checks that are not tied to a network service report port 0."
      },
      "cve": {
        "supported": true,
        "values_emitted": null,
        "notes": "Populated from the plugin's CVE list; plugins without a CVE carry no value."
      }
    }
  }
}
```

### Rendering a filter UI from the block

* A filter that is absent from the block, or has `"supported": false`, should be hidden or disabled for that integration.
* A filter with `"supported": true` and a `values_emitted` list should offer exactly that list as its options. Do not offer values the API accepts but the vendor never emits; selecting one returns an empty page.
* A supported free-form filter (`port`, `protocol`, `cve`) has no `values_emitted`; render it as a text input and read `notes` for the vendor's conventions. `protocol` is matched case-sensitively, and vendors differ: Tenable and Rapid7 InsightVM emit `TCP`, Qualys emits `tcp`.
* `notes` is tooltip text: scope caveats such as which record types carry the value.
* `"supported": true` means *some* records carry a value. A vendor can report `reachability` on dependency findings while its SAST findings stay `null`, so selecting every value in `values_emitted` is not the same as applying no filter.

<Warning>
  `null` is not a filter value. All three endpoints reject `?reachability=null` and `?exploitable=null` with a 422. Omitting the parameter means "no filter", not "match `null`". There is no way today to ask for the records a vendor did not assess.
</Warning>

### Reading the block

Absence is unknown, not unsupported: an integration without `capabilities`, or a data export or filter missing inside it, makes no claim either way. `"supported": true` is "some, not all", which is why `notes` matters. `values_emitted` is the list to offer and is always present on a supported filter with a fixed set of values, whether an enumeration or a boolean (booleans list `[true, false]`); a free-form filter such as `cve` never carries one. `values_emitted` uses the stored, uppercase vocabulary. [List Vulnerabilities](/api-reference/vms/get-vulnerabilities) renders its enumerated fields in lowercase on records (`"severity": "high"`, `"reachability": "reachable"`) and its `severity`, `state`, `category` and `reachability` filters accept either case; `protocol` does not.

The filters themselves are documented on [List Issues](/api-reference/appsec/get-issues), [List Vulnerabilities](/api-reference/vms/get-vulnerabilities) and [List Vulnerability Findings](/api-reference-v2/get-vulnerability-findings).


## OpenAPI

````yaml get /integrations/
openapi: 3.1.0
info:
  title: Leen Security API
  version: 0.0.1
servers:
  - description: Production API (US)
    url: https://api.leen.dev/v1
  - description: Production API (EU)
    url: https://api.eu-c1.leen.dev/v1
  - description: Production API (APAC)
    url: https://api.ap-se2.leen.dev/v1
security: []
paths:
  /integrations/:
    get:
      tags:
        - integration
      summary: List Integrations
      description: List all integrations with optional filters.
      operationId: list_integrations
      parameters:
        - description: Offset index of items (starting from 0)
          in: query
          name: offset
          required: false
          schema:
            default: 0
            description: Offset index of items (starting from 0)
            minimum: 0
            title: Offset
            type: integer
        - description: Limit size (page size)
          in: query
          name: limit
          required: false
          schema:
            default: 100
            description: Limit size (page size)
            minimum: 0
            title: Limit
            type: integer
        - description: Filter by category, comma separated
          in: query
          name: category
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            description: Filter by category, comma separated
            title: Category
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/OffsetPaginatedResponse_IntegrationRespModel_
          description: Successful Response
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
          description: Validation Error
      security:
        - API-Key: []
components:
  schemas:
    OffsetPaginatedResponse_IntegrationRespModel_:
      properties:
        count:
          description: Number of items return in the response
          title: Count
          type: integer
        items:
          description: The records on this page.
          items:
            $ref: '#/components/schemas/IntegrationRespModel'
          title: Items
          type: array
        total:
          anyOf:
            - type: integer
            - type: 'null'
          description: Total number of items that can be returned
          title: Total
      required:
        - count
        - items
      title: OffsetPaginatedResponse[IntegrationRespModel]
      type: object
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          title: Detail
          type: array
      title: HTTPValidationError
      type: object
    IntegrationRespModel:
      properties:
        capabilities:
          anyOf:
            - additionalProperties:
                $ref: '#/components/schemas/IntegrationDataExportCapabilities'
              type: object
            - type: 'null'
          description: >-
            Filter support declared by the integration, keyed by data export
            (for example vulnerability_findings_v2) and then by filter name.
            Absence is unknown, not unsupported: an integration without
            capabilities, or a data export or filter missing inside it, makes no
            claim; only "supported": false is an explicit negative. "supported":
            true means at least some records carry a non-null value for the
            filter, not all of them. values_emitted lists the normalized values
            the integration can produce and is present on every supported filter
            with a fixed set of values, enumerations and booleans alike; a
            free-form filter such as cve carries none. notes explains the scope,
            such as which record types carry the value.
          title: Capabilities
        categories:
          description: Category of the integration
          items:
            $ref: '#/components/schemas/ConnectionCategoriesEnum'
          title: Categories
          type: array
        data_exports:
          description: Supported data exports by Integration
          items:
            $ref: '#/components/schemas/DataExportTypesEnum'
          title: Data Exports
          type: array
        deprecated:
          default: false
          description: Status of the Integration
          title: Deprecated
          type: boolean
        description:
          description: Description of the integration
          title: Description
          type: string
        icon:
          contentMediaType: application/octet-stream
          description: Icon of the integration
          title: Icon
          type: string
        id:
          description: Unique ID of the Integration
          format: uuid
          title: Id
          type: string
        integration_id:
          description: Integration ID
          title: Integration Id
          type: string
        name:
          description: Name of the integration
          title: Name
          type: string
        parameters:
          description: Configuration parameters of the integration
          items:
            additionalProperties: true
            type: object
          title: Parameters
          type: array
        version:
          description: Version of the integration
          title: Version
          type: string
      required:
        - id
        - name
        - integration_id
        - version
        - description
        - parameters
        - icon
        - categories
        - data_exports
      title: IntegrationRespModel
      type: object
    ValidationError:
      properties:
        ctx:
          title: Context
          type: object
        input:
          title: Input
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          title: Location
          type: array
        msg:
          title: Message
          type: string
        type:
          title: Error Type
          type: string
      required:
        - loc
        - msg
        - type
      title: ValidationError
      type: object
    IntegrationDataExportCapabilities:
      properties:
        filters:
          additionalProperties:
            $ref: '#/components/schemas/IntegrationFilterCapability'
          description: Filter support keyed by the data export endpoint's filter name.
          title: Filters
          type: object
      title: IntegrationDataExportCapabilities
      type: object
    ConnectionCategoriesEnum:
      enum:
        - VMS
        - APPSEC
        - EDR
        - CSPM
        - IDP
        - IDS
        - ITSM
        - TPRM
        - GRC
        - MDM
        - EMAIL_SECURITY
      title: ConnectionCategoriesEnum
      type: string
    DataExportTypesEnum:
      enum:
        - alerts
        - compliances
        - compliance_findings
        - config_users
        - cspm_alerts
        - device_groups
        - device_policies
        - devices
        - idp
        - idp_alerts
        - idp_audit_logs
        - idp_policies
        - issues
        - organization_identities
        - sast_issues
        - sca_issues
        - vms_scan_configs
        - vulnerabilities
        - resources
        - vulnerability_findings_v2
        - grc_entity
        - grc_control
        - grc_evidence
        - grc_assessment_question
        - grc_assessment
        - tprm
        - tprm_company
        - tprm_finding
        - findings
        - itsm_users
        - itsm_groups
        - itsm_projects
        - itsm_tickets
        - itsm_attachments
        - itsm_comments
        - applications
        - siem_events
      title: DataExportTypesEnum
      type: string
    IntegrationFilterCapability:
      properties:
        notes:
          anyOf:
            - type: string
            - type: 'null'
          description: Scope of the value, such as which record types carry it.
          title: Notes
        supported:
          description: >-
            Whether at least some records from this integration carry a non-null
            value for the filter. false is an explicit negative.
          title: Supported
          type: boolean
        values_emitted:
          anyOf:
            - items:
                anyOf:
                  - type: string
                  - type: boolean
              type: array
            - type: 'null'
          description: >-
            The normalized values the integration can produce for the filter,
            enum members or true/false. Present whenever supported is true and
            the filter has a fixed set of values; null for free-form filters and
            when supported is false.
          title: Values Emitted
      required:
        - supported
      title: IntegrationFilterCapability
      type: object
  securitySchemes:
    API-Key:
      in: header
      name: X-API-KEY
      type: apiKey

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.