Skip to main content
GET
List Vulnerabilities
reachability and exploitable are tri-state: a vulnerability for which the vendor gave no signal carries null, and null matches neither filter value, so filtering a vendor that never reports the field returns an empty page. Use the capabilities block on List Integration Details to see which integrations populate these filters, and severity, state, category, port, protocol and cve, and which values they emit. protocol is matched case-sensitively and vendors differ in case; the block’s notes say which each emits.

Authorizations

X-API-KEY
string
header
required
X-CONNECTION-ID
string
header
required

Query Parameters

sort
string | null

Sort by a field, written as field, field:asc or field:desc. Which fields can be sorted on differs per endpoint.

Pattern: ^severity$|^severity\:asc$|^severity\:desc$|^updated_at$|^updated_at\:asc$|^updated_at\:desc$|^state_updated_at$|^state_updated_at\:asc$|^state_updated_at\:desc$
stateUpdatedSince
string<date-time> | null

Datetime filter, only return vulnerabilities where the state was updated since this datetime. Example format: 2021-01-01T00:00:00+00:00

Example:

"2021-01-01T00:00:00+00:00"

firstSeenSince
string<date-time> | null

Datetime filter, only return vulnerabilities where the first seen since this datetime. Example format: 2021-01-01T00:00:00+00:00

Example:

"2021-01-01T00:00:00+00:00"

lastSeenSince
string<date-time> | null

Datetime filter, only return vulnerabilities where the last seen since this datetime. Example format: 2021-01-01T00:00:00+00:00

Example:

"2021-01-01T00:00:00+00:00"

deviceId
string | null

Device ID Filter, comma separated

Example:

"123e4567-e89b-12d3-a456-426614174000, 123e4567-e89b-12d3-a456-426614174001"

resourceId
string | null

Resource ID Filter, comma separated

Example:

"123e4567-e89b-12d3-a456-426614174000, 123e4567-e89b-12d3-a456-426614174001"

severity
string | null

Vulnerability severity filter, comma separated

Example:

"critical,high"

state
string | null

Vulnerability state filter, comma separated

Example:

"open,closed"

exploitable
boolean | null

Filter by whether the vendor asserts the vulnerability is exploitable — a known exploit exists, or it is actively exploited. Vulnerabilities where the vendor reported no signal match neither true nor false.

Example:

true

reachability
string | null

Reachability filter, comma separated. One or more of reachable, potentially_reachable, unreachable, unknown -- matching the values this endpoint returns; either case is accepted. unknown means the vendor analyzed the vulnerability without reaching a conclusion; vulnerabilities from vendors with no reachability analysis at all are excluded by any value.

Example:

"reachable,potentially_reachable"

port
string | null

Port number filter, comma separated

Example:

"80,443"

protocol
string | null

Protocol filter, comma separated

Example:

"tcp,udp"

category
string | null

Vulnerability category filter, comma separated

Example:

"web,network"

cve
string | null

CVE ID filter, comma separated

Example:

"CVE-2021-1234,CVE-2021-5678"

includeDeviceGroups
boolean
default:false

Include device groups in the devices attached to the vulnerability

deviceGroupId
string | null

Device group ID filter, comma separated

Example:

"123e4567-e89b-12d3-a456-426614174002, 123e4567-e89b-12d3-a456-426614174003"

ids
string | null

Vulnerability ID filter, comma separated. Need to be valid UUIDs. Max 100 IDs

Example:

"123e4567-e89b-12d3-a456-426614174004,123e4567-e89b-12d3-a456-426614174005"

enableCursor
boolean
default:false

Enable cursor based pagination instead of default offset-based pagination

updatedSince
string<date-time> | null

Only records whose updated_at is at or after this time. Leen bumps updated_at whenever any field on a record changes, so this is the filter for an incremental sync: it returns records that are new and records that changed, and nothing that has stood still. Example: 2021-01-01T00:00:00+00:00.

Example:

"2021-01-01T00:00:00+00:00"

limit
integer
default:100

How many records to return per page. The walk is the same either way; a larger page means fewer round trips and more memory per response.

Required range: 1 <= x <= 500
offset
integer
default:0

Where to start, counted in records. Offset paging is stable only while the underlying data is; prefer the cursor for anything long-running.

Required range: x >= 0
excludeTotal
boolean
default:false

Skip counting the total. Counting is the expensive half of a large query, so set this when you are walking every page anyway and never read total. total comes back null.

cursor
string | null

Opaque position of the next page, taken from the previous response. Ignore its contents; it encodes where the walk had reached.

Response

Successful Response

count
integer
required

Number of items return in the response

items
Vulnerability · object[]
required

The records on this page.

total
integer | null

Total number of items that can be returned