Skip to main content
GET
List Vulnerabilities

Authorizations

X-API-KEY
string
header
required
X-CONNECTION-ID
string
header
required

Query Parameters

sort
string | null

Sort by a field, written as field, field:asc or field:desc. Which fields can be sorted on differs per endpoint.

Pattern: ^severity$|^severity\:asc$|^severity\:desc$|^updated_at$|^updated_at\:asc$|^updated_at\:desc$|^state_updated_at$|^state_updated_at\:asc$|^state_updated_at\:desc$
stateUpdatedSince
string<date-time> | null

Datetime filter, only return vulnerabilities where the state was updated since this datetime. Example format: 2021-01-01T00:00:00+00:00

Example:

"2021-01-01T00:00:00+00:00"

firstSeenSince
string<date-time> | null

Datetime filter, only return vulnerabilities where the first seen since this datetime. Example format: 2021-01-01T00:00:00+00:00

Example:

"2021-01-01T00:00:00+00:00"

lastSeenSince
string<date-time> | null

Datetime filter, only return vulnerabilities where the last seen since this datetime. Example format: 2021-01-01T00:00:00+00:00

Example:

"2021-01-01T00:00:00+00:00"

deviceId
string | null

Device ID Filter, comma separated

Example:

"123e4567-e89b-12d3-a456-426614174000, 123e4567-e89b-12d3-a456-426614174001"

resourceId
string | null

Resource ID Filter, comma separated

Example:

"123e4567-e89b-12d3-a456-426614174000, 123e4567-e89b-12d3-a456-426614174001"

severity
string | null

Vulnerability severity filter, comma separated

Example:

"critical,high"

state
string | null

Vulnerability state filter, comma separated

Example:

"open,closed"

port
string | null

Port number filter, comma separated

Example:

"80,443"

protocol
string | null

Protocol filter, comma separated

Example:

"tcp,udp"

category
string | null

Vulnerability category filter, comma separated

Example:

"web,network"

cve
string | null

CVE ID filter, comma separated

Example:

"CVE-2021-1234,CVE-2021-5678"

includeDeviceGroups
boolean
default:false

Include device groups in the devices attached to the vulnerability

deviceGroupId
string | null

Device group ID filter, comma separated

Example:

"123e4567-e89b-12d3-a456-426614174002, 123e4567-e89b-12d3-a456-426614174003"

ids
string | null

Vulnerability ID filter, comma separated. Need to be valid UUIDs. Max 100 IDs

Example:

"123e4567-e89b-12d3-a456-426614174004,123e4567-e89b-12d3-a456-426614174005"

enableCursor
boolean
default:false

Enable cursor based pagination instead of default offset-based pagination

updatedSince
string<date-time> | null

Only records whose updated_at is at or after this time. Leen bumps updated_at whenever any field on a record changes, so this is the filter for an incremental sync: it returns records that are new and records that changed, and nothing that has stood still. Example: 2021-01-01T00:00:00+00:00.

Example:

"2021-01-01T00:00:00+00:00"

limit
integer
default:100

How many records to return per page. The walk is the same either way; a larger page means fewer round trips and more memory per response.

Required range: 1 <= x <= 500
offset
integer
default:0

Where to start, counted in records. Offset paging is stable only while the underlying data is; prefer the cursor for anything long-running.

Required range: x >= 0
excludeTotal
boolean
default:false

Skip counting the total. Counting is the expensive half of a large query, so set this when you are walking every page anyway and never read total. total comes back null.

cursor
string | null

Opaque position of the next page, taken from the previous response. Ignore its contents; it encodes where the walk had reached.

Response

Successful Response

count
integer
required

Number of items return in the response

items
Vulnerability · object[]
required

The records on this page.

total
integer | null

Total number of items that can be returned