Skip to main content
GET
/
vulnerabilities
Get vulnerabilities
curl --request GET \
  --url https://api.vanta.com/v1/vulnerabilities \
  --header 'Authorization: Bearer <token>'
{
  "results": {
    "pageInfo": {
      "hasNextPage": true,
      "hasPreviousPage": false,
      "startCursor": "YXJyYXljb25uZWN0aW9uOjA=",
      "endCursor": "YXJyYXljb25uZWN0aW9uOjE="
    },
    "data": [
      {
        "id": "a2f7e1b9d0c3f4e5a6c7b8d9",
        "name": "CVE-2021-12345",
        "description": "MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE clause.",
        "integrationId": "Inspector",
        "packageIdentifier": "package",
        "vulnerabilityType": "COMMON",
        "targetId": "targetId",
        "firstDetectedDate": "2021-01-01T00:00:00.000Z",
        "sourceDetectedDate": "2021-01-01T00:00:00.000Z",
        "lastDetectedDate": "2021-01-01T00:00:00.000Z",
        "severity": "CRITICAL",
        "cvssSeverityScore": 9.8,
        "scannerScore": 100,
        "isFixable": true,
        "fixedVersion": "10.6.2",
        "remediateByDate": "2021-01-01T00:00:00.000Z",
        "relatedVulns": [
          "CVE-2021-12345"
        ],
        "relatedUrls": [
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-12345"
        ],
        "externalURL": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-12345",
        "scanSource": "Not provided",
        "deactivateMetadata": {
          "deactivatedBy": "b2f7e1b9d0c3f4e5a6c7b123",
          "deactivatedOnDate": "2021-01-01T00:00:00.000Z",
          "deactivationReason": "fix is too hard to carry out",
          "deactivatedUntilDate": null,
          "isVulnDeactivatedIndefinitely": true
        }
      }
    ]
  }
}

Documentation Index

Fetch the complete documentation index at: https://vanta.mintlify.app/llms.txt

Use this file to discover all available pages before exploring further.

Authorizations

​
Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Query Parameters

​
q
string

Filter vulnerabilities by search query

​
pageSize
integer<int32>
default:10

Controls the maximum number of items returned in one response from the API.

Required range: 1 <= x <= 100
​
pageCursor
string

A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset. Note that the requested page will not include the item that corresponds to this cursor but will start from the one immediately after this cursor.

​
isDeactivated
boolean

Filter vulnerabilities by deactivation status.

​
externalVulnerabilityId
string

Filter vulnerabilities based on a specific external ID.

​
isFixAvailable
boolean

Filter vulnerabilities that have an available fix.

​
packageIdentifier
string

Filter vulnerabilities that are from a specific package.

​
slaDeadlineAfterDate
string<date-time>

Filter vulnerabilities with a fix due after a specific timestamp

​
slaDeadlineBeforeDate
string<date-time>

Filter vulnerabilities with a fix due before a specific timestamp

​
severity
enum<string>

Filter vulnerabilities by severity. Possible values: CRITICAL, HIGH, MEDIUM, LOW. ExternalFindingSeverity describes the severity of an external finding (Vulnerability or Security Alert)

Available options:
CRITICAL,
HIGH,
LOW,
MEDIUM
​
integrationId
string

Filter vulnerabilities by the vulnerability scanner that detected them.

​
includeVulnerabilitiesWithoutSlas
boolean

Filter vulnerabilities without an SLA due date.

​
vulnerableAssetId
string

Filter vulnerabilities by a specific asset ID.

Response

200 - application/json

Ok

​
results
object
required