Find vulnerabilities approaching SLAs

Query vulnerabilities approaching their remediation deadline so you can prioritize fixes before they breach SLA, using the Manage Vanta API.

Before you begin

This guide is for Vanta admins managing data inside their own Vanta account.

You’ll need:

• A Manage Vanta API token.
• The token must have scope vanta-api.all:read.
• At least one vulnerability scanner integration connected to Vanta (e.g. Snyk, Qualys, Inspector).

Vanta consolidates scan results from multiple tools into a single view and tracks remediation against the SLAs you’ve configured. The vulnerabilities endpoint lets you slice that view by SLA window so you can act on what’s actually about to breach.

Wiring this into a daily nudge or ticketing automation? Re-mint your token at the top of each run, query slaDeadlineBeforeDate set to “today + 14 days”, and feed the response into your downstream system.

1. Pick the SLA window

   Decide which vulnerabilities to surface. Most teams use one of:

   • Approaching breach — slaDeadlineAfterDate = now, slaDeadlineBeforeDate = now + 7–14 days.
   • Already breached — slaDeadlineBeforeDate = now (with no slaDeadlineAfterDate).
   • All vulnerabilities with an SLA — both params omitted, but includeVulnerabilitiesWithoutSlas=false.

   Layer in severity=CRITICAL (or HIGH), isFixAvailable=true, and integrationId=<scanner> to narrow further.

   Terminal

   # Two-week window: due after today, before today + 14 days
   AFTER=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
   BEFORE=$(date -u -v+14d +"%Y-%m-%dT%H:%M:%SZ")  # GNU date: date -u -d '+14 days' +%Y-%m-%dT%H:%M:%SZ
   
   echo "from $AFTER to $BEFORE"
   

   What other filters can I combine?

   severity (CRITICAL/HIGH/MEDIUM/LOW), isFixAvailable, integrationId, packageIdentifier, vulnerableAssetId, externalVulnerabilityId, q (free-text search), and includeVulnerabilitiesWithoutSlas.

   Vulnerabilities without SLAs?

   By default the endpoint excludes vulnerabilities that have no remediateByDate. Set includeVulnerabilitiesWithoutSlas=true to include them — useful if a scanner doesn’t emit severities Vanta can map to an SLA.

2. Query vulnerabilities by SLA window

   Your terminal — call GET /v1/vulnerabilities with the SLA window and any extra filters.

   Node.js

   const after = new Date().toISOString();
   const before = new Date(Date.now() + 14 * 24 * 60 * 60 * 1000).toISOString();
   
   const url = new URL("https://api.vanta.com/v1/vulnerabilities");
   url.searchParams.set("pageSize", "50");
   url.searchParams.set("slaDeadlineAfterDate", after);
   url.searchParams.set("slaDeadlineBeforeDate", before);
   url.searchParams.set("severity", "CRITICAL");
   url.searchParams.set("isFixAvailable", "true");
   
   const res = await fetch(url, {
     headers: { Authorization: "Bearer YOUR_TOKEN" },
   });
   const body = await res.json();
   for (const vuln of body.results.data) {
     console.log(vuln.severity, vuln.name, "due", vuln.remediateByDate);
   }
   

   Expected response (200) — paginated vulnerabilities, sorted by remediateByDate ascending (most urgent first):

   {
     "results": {
       "data": [
         {
           "id": "65f05b5def4a9f04c44e5748",
           "name": "CVE-2021-3711",
           "description": "Alpine Linux Security Update for OpenSSL",
           "integrationId": "qualys",
           "packageIdentifier": "libssl1.1:1.1.1g-r0",
           "vulnerabilityType": "COMMON",
           "targetId": "65f05b57f37f4ffbd87dc20c",
           "severity": "CRITICAL",
           "cvssSeverityScore": 9.8,
           "isFixable": true,
           "fixedVersion": "1.1.1n-r0",
           "remediateByDate": "2024-04-16T17:14:26.718Z",
           "externalURL": "https://qualysguard.qg4.apps.qualys.com/cs/#/...",
           "deactivateMetadata": null
         }
       ],
       "pageInfo": { "hasNextPage": true, "endCursor": "..." }
     }
   }
   

   Use targetId to join back to the affected asset, externalURL to deep-link to your scanner, and remediateByDate to drive your countdown.

   Got a 401?

   Token is expired (one-hour lifetime), missing, or lacks vanta-api.all:read. Mint a fresh one — see Authentication → Tokens expire after one hour.

   Got a 400 on the date params?

   slaDeadlineAfterDate and slaDeadlineBeforeDate must be ISO 8601 timestamps with timezone (e.g. 2024-04-16T17:14:26.718Z). Plain dates without time-of-day will be rejected.

   Need to paginate?

   Read results.pageInfo.endCursor and hasNextPage. Re-call with pageCursor=<endCursor> until hasNextPage is false. Don’t try to fetch all vulnerabilities in one call — pageSize caps at 100.

   Result includes a `deactivateMetadata` object?

   That vulnerability has been deactivated (suppressed). It still appears in the list but won’t impact tests. Filter client-side on deactivateMetadata == null if you only want active items.

Suppressing a known false positive? Use POST /v1/vulnerabilities/deactivate with a reason. Reactivate later with the matching /reactivate endpoint.

Congratulations

You’ve pulled the canonical list of vulnerabilities approaching their SLA deadline. Wire this into a Slack channel, Jira ticket creator, or PagerDuty schedule so your remediation work happens against actual deadlines instead of a static dashboard.

---

Next steps

Query failing tests

See which tests are failing because of overdue vulnerabilities.

Subscribe to webhooks

React in real time when a vulnerability is detected, deactivated, or remediated.

Try it in Postman

Import the collection and run the vulnerability query against a sandbox in seconds.

Manage Vanta API reference

Browse every Manage Vanta endpoint — vulnerabilities, tests, controls, documents, people.