---
updatedAt: 2026-05-12T10:00:50.000Z
---
# Retrieve all vulnerabilities
This operation returns an object containing information about all vulnerabilities (vulns) that the requester has permission to view.
# OpenAPI definition
```json
{
"openapi": "3.0.0",
"x-explorer-enabled": false,
"info": {
"title": "Vuln API (Legacy)",
"license": {
"name": "(c) Copyright 2020 WhiteHat Security"
},
"version": "1.0.0"
},
"servers": [
{
"url": "https://sentinel.whitehatsec.com"
}
],
"paths": {
"/api/vuln": {
"get": {
"tags": [
"Vuln API v1.0"
],
"summary": "Retrieve all vulnerabilities",
"description": "This operation returns an object containing information about all vulnerabilities (vulns) that the requester has permission to view.",
"operationId": "getAllAccessibleVulns",
"parameters": [
{
"name": "batch_size",
"in": "query",
"description": "Indicates how many vulnerabilities to process per 'batch' before sending data to client; helps keep connection open for queries producing large numbers of vulnerabilities.",
"style": "form",
"explode": true,
"schema": {
"type": "integer",
"format": "int32"
}
},
{
"name": "query_threat",
"in": "query",
"description": "Retrieves vulns with the given threat value(s). Accepts one value or multiple comma-separated values. Range of values allowed: 1 to 5. Only meaningful to Legacy Scoring users.",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_score",
"in": "query",
"description": "Retrieves vulns with the given score(s). Accepts one value or multiple comma-separated values. Range of values allowed: 3 to 20. Only meaningful to Legacy Scoring users.",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_severity",
"in": "query",
"description": "Retrieves vulns with the given severity value(s). Accepts one value or multiple comma-separated values. Range of values allowed: 1 to 5. Only meaningful to Legacy Scoring users.",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_impact",
"in": "query",
"description": "Retrieves vulns with the given impact value(s). Accepts one value or multiple comma-separated values. Range of values allowed: 0 to 9. Only meaningful to Advanced Scoring users.",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_likelihood",
"in": "query",
"description": "Retrieves vulns with the given likelihood value(s). Accepts one value or multiple comma-separated values. Range of values allowed: 0 to 9. Only meaningful to Advanced Scoring users.",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_risk",
"in": "query",
"description": "Retrieves vulns with the given risk value(s). Accepts one value or multiple comma-separated values. Range of values allowed: 1 to 5. Only meaningful to Advanced Scoring users.",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_custom_risk",
"in": "query",
"description": "Retrieves vulns that have a custom_risk value that matches what is given. Custom risk values range from 1 to 5. Only applies to Advanced Scoring.",
"style": "form",
"explode": true,
"schema": {
"type": "integer",
"format": "int32"
}
},
{
"name": "query_effective_risk",
"in": "query",
"description": "Retrieves vulns that have an 'effective risk' value matching what is given. If custom scoring is enabled and the retrieved vulnerability is customized, then the effective risk will match the custom risk; otherwise it will match the default risk. Only applies to Advanced Scoring.",
"style": "form",
"explode": true,
"schema": {
"type": "integer",
"format": "int32"
}
},
{
"name": "query_status",
"in": "query",
"description": "Retrieves vulns that have the given status(es). Status may be 'open', 'closed', 'accepted', 'invalid', or 'all'. Comma-separated combinations may be used (with the exception of 'all', which must be used alone). EXAMPLE: \"open,closed,accepted\".",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_class",
"in": "query",
"description": "Retrieves vulns by their short or long vulnerability classification name. Comma-separated combinations may be used. EXAMPLE: 'XSS,Spoof' or 'Cross Site Scripting,Content Spoofing'.",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_class_name",
"in": "query",
"description": "Retrieves vulns by their long vulnerability classification name. Does NOT accept short names. Comma-separated combinations may be used. EXAMPLE: 'Cross Site Scripting,Content Spoofing'.",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_site",
"in": "query",
"description": "Retrieves vulns for the given site ID(s) or site label(s). Accepts one value or multiple comma-separated values.",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_site_label",
"in": "query",
"description": "Retrieves vulns for the given site label or part of a label. Only accepts a single value. EXAMPLE: Given you have a site named 'foo' and a site named 'foobar', if you enter 'foo' for this parameter, it will return vulns for both these sites. If you enter 'bar', it will only return vulns for 'foobar'.",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_site_label_not_like",
"in": "query",
"description": "Retrieves vulns for all sites EXCEPT for the given site label or part of a label. Only accepts a single value. EXAMPLE: Given you have a site named 'foo' and a site named 'foobar', if you enter 'bar' for this parameter, it will only return vulns for the 'foo' site.",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_asset_status",
"in": "query",
"description": "Retrieves vulns for all sites with the asset status given. Sites with 'active' asset status are fully approved for scans. Sites with 'inactive' status are not currently approved for scans.",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "active",
"example": "active",
"enum": [
"active",
"inactive"
]
}
},
{
"name": "query_url",
"in": "query",
"description": "Provide some portion of a url to search for. EXAMPLE: Entering 'testsite' will return any vuln found associated with a url containing the string 'testsite'.",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_group_id",
"in": "query",
"description": "Retrieves vulns belonging to sites which are members of a particular group. Only one group may be specified. The format of the ID is {client_id}_{group_id}. EXAMPLE: 1066_17",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_group_name_like",
"in": "query",
"description": "Retrieves vulns belonging to sites that are members of particular group(s), based on a group name that contains or matches what is given.",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_found",
"in": "query",
"description": "Retrieves vulns found since the given timestamp. Requires a valid ISO-8601 (UTC/GMT) date format string. EXAMPLE: 'YYYY-MM-DDThh:mm:ssZ' -> '2008-12-12T21:35:59Z'",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_opened",
"in": "query",
"description": "Retrieves vulns opened (or reopened) since the given timestamp. Requires a valid ISO-8601 (UTC/GMT) date format string. EXAMPLE: 'YYYY-MM-DDThh:mm:ssZ' -> '2008-12-12T21:35:59Z'",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_closed",
"in": "query",
"description": "Retrieves vulns closed since the given timestamp. Requires a valid ISO-8601 (UTC/GMT) date format string. EXAMPLE: 'YYYY-MM-DDThh:mm:ssZ' -> '2008-12-12T21:35:59Z'",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_modified",
"in": "query",
"description": "Retrieves vulns modified since the given timestamp. Requires a valid ISO-8601 (UTC/GMT) date format string. EXAMPLE: 'YYYY-MM-DDThh:mm:ssZ' -> '2008-12-12T21:35:59Z'",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_opened_before",
"in": "query",
"description": "Retrieves vulns opened (or reopened) prior to the given timestamp. Requires a valid ISO-8601 (UTC/GMT) date format string. EXAMPLE: 'YYYY-MM-DDThh:mm:ssZ' -> '2008-12-12T21:35:59Z'",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_opened_after",
"in": "query",
"description": "Retrieves vulns opened (or reopened) since the given timestamp. Equivalent to 'query_opened'. Requires a valid ISO-8601 (UTC/GMT) date format string. EXAMPLE: 'YYYY-MM-DDThh:mm:ssZ' -> '2008-12-12T21:35:59Z'",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_closed_before",
"in": "query",
"description": "Retrieves vulns closed prior to the given timestamp. Requires a valid ISO-8601 (UTC/GMT) date format string. EXAMPLE: 'YYYY-MM-DDThh:mm:ssZ' -> '2008-12-12T21:35:59Z'",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_closed_after",
"in": "query",
"description": "Retrieves vulns closed since the given timestamp. Equivalent to 'query_closed'. Requires a valid ISO-8601 (UTC/GMT) date format string. EXAMPLE: 'YYYY-MM-DDThh:mm:ssZ' -> '2008-12-12T21:35:59Z'",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_modified_before",
"in": "query",
"description": "Retrieves vulns modified prior to the given timestamp. Requires a valid ISO-8601 (UTC/GMT) date format string. EXAMPLE: 'YYYY-MM-DDThh:mm:ssZ' -> '2008-12-12T21:35:59Z'",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_modified_after",
"in": "query",
"description": "Retrieves vulns modified after the given timestamp. Equivalent to 'query_modified'. Requires a valid ISO-8601 (UTC/GMT) date format string. EXAMPLE: 'YYYY-MM-DDThh:mm:ssZ' -> '2008-12-12T21:35:59Z'",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_start_date",
"in": "query",
"description": "Retrieves vulns opened (or reopened) AFTER the given date. Requires a valid ISO-8601 (UTC/GMT) date format string. EXAMPLE: 'YYYY-MM-DDThh:mm:ssZ' -> '2008-12-12T21:35:59Z'",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_end_date",
"in": "query",
"description": "Retrieves vulns opened (or reopened) BEFORE the given date. Requires a valid ISO-8601 (UTC/GMT) date format string. EXAMPLE: 'YYYY-MM-DDThh:mm:ssZ' -> '2008-12-12T21:35:59Z'",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_tags",
"in": "query",
"description": "Retrieves vulns that have one or more given tags associated with them. Multiple tags must be comma-separated.",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "query_tag_search_type",
"in": "query",
"description": "Changes the behavior of query_tags when more than one tag is specified. If the value is 'all' then ALL tags must be present to match. If it is 'none', NO tags must match. If the value is 'any', ANY tag may match (default behavior).",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "all",
"example": "all",
"enum": [
"all",
"any",
"none"
]
}
},
{
"name": "query_unreachable",
"in": "query",
"description": "Retrieves vulns that have the given ''unreachable'' status. If a vuln has this flag set to TRUE (1), a retest on the vuln returned a response that was significantly different from the original response, indicating a very different page is now associated with the vulnerability path.",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_vulnerability",
"in": "query",
"description": "Display vulnerability data if value is 1. This is also the default behavior if this parameter is omitted from the request. If the value is 0, vulnerability data is NOT displayed.",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "1",
"example": "1",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_description",
"in": "query",
"description": "Display general information about each vulnerability. The 'custom' option will display custom descriptions.",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1",
"custom"
]
}
},
{
"name": "display_default_description",
"in": "query",
"description": "Display the default general information about each vulnerability (no custom description).",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_solution",
"in": "query",
"description": "Display general vulnerability solution information. The 'custom' option will display custom solutions.",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1",
"custom"
]
}
},
{
"name": "display_default_solution",
"in": "query",
"description": "Display the default solution for each vulnerability (no custom solution).",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_qanda",
"in": "query",
"description": "Display all questions and answers (Q and A) that exist for each vulnerability.",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_cvss",
"in": "query",
"description": "Display the Common Vulnerability Scoring System (CVSS) score and vector for each vulnerability.",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_tags",
"in": "query",
"description": "Display all tags for each vulnerability.",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_risk",
"in": "query",
"description": "Display risk value for each vulnerability. Only meaningful to Advanced Scoring users.",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_impact",
"in": "query",
"description": "Display impact value for each vulnerability. Only meaningful to Advanced Scoring users.",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_likelihood",
"in": "query",
"description": "Display likelihood value for each vulnerability. Only meaningful to Advanced Scoring users.",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_first_opened",
"in": "query",
"description": "Display the date each vulnerability was first opened.",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_custom_risk",
"in": "query",
"description": "Display each vulnerability's custom risk, if it is defined. Only meaningful to Advanced Scoring users who make use of custom scoring features.",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_custom_policy",
"in": "query",
"description": "If a custom policy is applied to any vuln retrieved, setting this parameter displays the custom policy name, description, who created the policy, and the date the policy was created. Only meaningful to Advanced Scoring users who make use of custom scoring features.",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_text",
"in": "query",
"description": "Display the text values of vulnerability scores instead of numeric. NOTE: Only available for CSV output at this time.",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_attack_vectors",
"in": "query",
"description": "Display attack vector (AV) data.
Values allowed: 0, 1, open, closed, accepted, invalid, all.
Specifying 0 displays minimal data on open, closed, and accepted AVs.
Specifying 1 displays details on open, closed, and accepted AVs.
Specifying 'all' displays details on AVs of all statuses.
Specifying 'open' displays details on open AVs.With the exception of 0, 1, and 'all', comma-separated combinations of these options are also allowed.
EXAMPLE: 'open,accepted'
",
"style": "form",
"explode": true,
"schema": {
"type": "string"
}
},
{
"name": "display_attack_vectors_limit",
"in": "query",
"description": "Specify the maximum number of attack vectors to display per vulnerability. PREREQUISITE: display_attack_vectors=1",
"style": "form",
"explode": true,
"schema": {
"type": "integer",
"format": "int32"
}
},
{
"name": "display_attack_vector_notes",
"in": "query",
"description": "Display all attack vector notes for each vulnerability attack vector. PREREQUISITE: display_attack_vectors=1",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_attack_vector_flagged",
"in": "query",
"description": "Display whether or not an attack vector is 'flagged'. PREREQUISITE: display_attack_vectors=1",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_attack_vector_scanner_tags",
"in": "query",
"description": "Display scanner tags for each attack vector. PREREQUISITE: display_attack_vectors=1",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_attack_vector_unreachable",
"in": "query",
"description": "Displays attack vectors that have the given ''unreachable'' status. If a vector has this flag set to TRUE (1), a retest on the vector returned a response that was significantly different from the original response, indicating a very different page is now associated with the attack vector path. PREREQUISITE: display_attack_vectors=1",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_request",
"in": "query",
"description": "Display attack vector request information. Basic request data is already shown if display_attack_vectors=1, but this parameter may be useful if the user wishes to omit this information. PREREQUISITE: display_attack_vectors=1",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "1",
"example": "1",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_response",
"in": "query",
"description": "Display attack vector response information. Basic response data is already shown if display_attack_vectors=1, but this parameter may be useful if the user wishes to omit this information. PREREQUISITE: display_attack_vectors=1",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "1",
"example": "1",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_body",
"in": "query",
"description": "Display the attack vector response body (can be quite large). PREREQUISITE: display_attack_vectors=1",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_body_match",
"in": "query",
"description": "Display the attack vector response body match in full (can be quite large). Highlights where the vuln was found. PREREQUISITE: display_attack_vectors=1",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_abbr",
"in": "query",
"description": "Display a smaller (abbreviated) response body match as part of the response content. Highlights where the vuln was found. PREREQUISITE: display_attack_vectors=1, display_body=1",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_headers",
"in": "query",
"description": "Display attack vector HTTP request and response headers. PREREQUISITE: display_attack_vectors=1",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_param",
"in": "query",
"description": "Display attack vector request parameter(s). This data is already shown if display_attack_vectors=1, but this parameter may be useful if the user wishes to omit this information. PREREQUISITE: display_attack_vectors=1",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "1",
"example": "1",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_has_notes",
"in": "query",
"description": "Display whether or not notes exist for vulnerabilities and attack vectors (result value will be 1 if notes exist, 0 if not).",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_stats",
"in": "query",
"description": "Display vulnerability statistics for all sites accessible to the requester.",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_errors",
"in": "query",
"description": "Reports vulnerabilities that encountered errors attempting to retrieve attack vector response data. In most cases, issuing a retest on these vulns will fix the issue. PREREQUISITE: display_attack_vectors=1",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_cvss_vector",
"in": "query",
"description": "Displays the CVSS v3 vector information for each vulnerability. Only applies to CSV format. PREREQUISITE: display_cvss=1",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "display_bla_id",
"in": "query",
"description": "Displays the Business Logic Assessment (BLA) ID, if any, associated with each vulnerability.",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "0",
"example": "0",
"enum": [
"0",
"1"
]
}
},
{
"name": "page:limit",
"in": "query",
"description": "Limit results to n number of pages.",
"style": "form",
"explode": true,
"schema": {
"type": "integer",
"format": "int32"
}
},
{
"name": "page:offset",
"in": "query",
"description": "Begin showing results from page number n.",
"style": "form",
"explode": true,
"schema": {
"type": "integer",
"format": "int32"
}
},
{
"name": "page:order_by",
"in": "query",
"description": "Order the results.",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "id",
"example": "id",
"enum": [
"id",
"id_asc",
"id_desc",
"site",
"site_asc",
"site_desc",
"site_label",
"site_label_asc",
"site_label_desc",
"class",
"class_asc",
"class_desc",
"class_name",
"class_name_asc",
"class_name_desc",
"cvss",
"cvss_asc",
"cvss_desc",
"retest_state",
"retest_state_asc",
"retest_state_desc",
"severity",
"severity_asc",
"severity_desc",
"threat",
"threat_asc",
"threat_desc",
"score",
"score_asc",
"score_desc",
"risk",
"risk_asc",
"risk_desc",
"impact",
"impact_asc",
"impact_desc",
"likelihood",
"likelihood_asc",
"likelihood_desc",
"effective_risk",
"effective_risk_asc",
"effective_risk_desc",
"status",
"status_asc",
"status_desc",
"date",
"date_asc",
"date_desc",
"opened_date",
"opened_date_asc",
"opened_date_desc",
"closed_date",
"closed_date_asc",
"closed_date_desc",
"modified",
"modified_asc",
"modified_desc"
]
}
},
{
"name": "format",
"in": "query",
"description": "Requested resource format for the response.",
"style": "form",
"explode": true,
"schema": {
"type": "string",
"default": "xml",
"example": "json",
"enum": [
"json",
"xml",
"csv"
]
}
}
],
"responses": {
"200": {
"description": "Provides all vulnerabilities (vulns) the requester has permission to view.",
"headers": {},
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/VulnerabilityCollectionJSON"
}
},
"text/xml": {
"example": "XML preview is currently not supported."
},
"text/csv, text/comma-separated-values": {
"examples": {
"no added parameters": {
"description": "Column headers for data that may be returned using this format.",
"value": "Vuln ID,Vuln Status,Score,Rating,Retest Vuln Status,Last Retest,Last Opened,Last Closed,Class,Site Name,Service Level"
},
"display_cvss=1": {
"description": "Column headers for data that may be returned using this format.",
"value": "Vuln ID,Vuln Status,Score,Rating,CVSS Score,Retest Vuln Status,Last Retest,Last Opened,Last Closed,Class,Site Name,Service Level"
},
"display_cvss=1&display_cvss_vector=1": {
"description": "Column headers for data that may be returned using this format.",
"value": "Vuln ID,Vuln Status,Score,Rating,CVSS Vector,CVSS Score,Retest Vuln Status,Last Retest,Last Opened,Last Closed,Class,Site Name,Service Level"
},
"display_bla_id=1": {
"description": "Column headers for data that may be returned using this format.",
"value": "Vuln ID,Vuln Status,Score,Rating,Retest Vuln Status,Last Retest,Last Opened,Last Closed,Class,Site Name,Service Level,BLA ID"
},
"display_tags=1": {
"description": "Column headers for data that may be returned using this format.",
"value": "Vuln ID,Vuln Status,Score,Rating,Retest Vuln Status,Last Retest,Last Opened,Last Closed,Class,Site Name,Service Level,Tags"
},
"display_risk=1": {
"description": "Column headers for data that may be returned using this format.",
"value": "Vuln ID,Vuln Status,Rating,Retest Vuln Status,Last Retest,Last Opened,Last Closed,Class,Site Name,Service Level"
}
}
}
}
},
"400": {
"description": "BadRequestResponse indicates a request with invalid parameters.",
"content": {}
},
"401": {
"description": "UnauthorizedResponse signals an unauthorized API access.",
"content": {}
},
"403": {
"description": "ForbiddenResponse signals a request for a resource that does not exist or is not authorized.",
"content": {}
},
"500": {
"description": "GenericError generic error.",
"content": {}
}
},
"deprecated": false
}
}
},
"components": {
"schemas": {
"Headers": {
"type": "object",
"properties": {
"name": {
"type": "string"
},
"value": {
"type": "string"
}
}
},
"Response": {
"type": "object",
"properties": {
"status": {
"type": "number"
},
"error": {
"type": "number"
},
"body": {
"properties": {
"content": {
"type": "string"
}
},
"type": "object"
},
"body_match": {
"properties": {
"content": {
"type": "string"
}
},
"type": "object"
},
"headers": {
"type": "array",
"nullable": true,
"items": {
"$ref": "#/components/schemas/Headers"
}
}
}
},
"Request": {
"type": "object",
"properties": {
"method": {
"type": "string",
"nullable": true
},
"param_value": {
"type": "string",
"nullable": true
},
"param_name": {
"type": "string",
"nullable": true
},
"url": {
"type": "string",
"nullable": true
},
"headers": {
"type": "array",
"nullable": true,
"items": {
"$ref": "#/components/schemas/Headers"
}
}
}
},
"Note": {
"type": "object",
"nullable": true,
"properties": {
"id": {
"type": "string"
},
"author": {
"type": "string"
},
"created": {
"type": "string",
"format": "date-time"
},
"content": {
"type": "string"
}
}
},
"VulnTags": {
"type": "array",
"description": "A list of replacement tags to be submitted.",
"items": {
"type": "string"
}
},
"AttackVector": {
"type": "object",
"properties": {
"tested": {
"type": "string"
},
"flagged": {
"type": "number"
},
"request": {
"$ref": "#/components/schemas/Request"
},
"has_notes": {
"type": "number"
},
"state": {
"type": "string"
},
"found": {
"type": "string"
},
"response": {
"$ref": "#/components/schemas/Response"
},
"id": {
"type": "string"
},
"opened": {
"type": "string"
},
"notes": {
"$ref": "#/components/schemas/Notes"
},
"scanner_tags": {
"$ref": "#/components/schemas/VulnTags"
},
"auth_details": {
"type": "string"
},
"unreachable": {
"type": "number",
"nullable": true
}
}
},
"Vulnerability": {
"type": "object",
"properties": {
"auth_details": {
"type": "string"
},
"opened": {
"type": "string",
"format": "date-time"
},
"severity": {
"type": "string"
},
"risk": {
"type": "number"
},
"site": {
"type": "string"
},
"has_notes": {
"type": "string"
},
"found": {
"type": "string"
},
"attack_vectors": {
"$ref": "#/components/schemas/AttackVectors"
},
"reason": {
"type": "string",
"nullable": true
},
"accepted": {
"type": "number"
},
"impact": {
"type": "number"
},
"default_description": {
"type": "string"
},
"first_opened": {
"type": "string"
},
"bla_id": {
"type": "string"
},
"service_level_abbr": {
"type": "string"
},
"out_of_scope_reasons": {
"type": "string"
},
"id": {
"type": "string"
},
"qanda": {
"$ref": "#/components/schemas/Qandas"
},
"class": {
"type": "string"
},
"threat": {
"type": "string"
},
"score": {
"anyOf": [
{
"type": "string"
},
{
"type": "number"
}
]
},
"modified": {
"type": "string",
"format": "date-time"
},
"retest_state": {
"type": "string"
},
"site_name": {
"type": "string"
},
"custom_risk": {
"type": "number",
"nullable": true
},
"cvss_v3_score": {
"type": "string",
"nullable": true
},
"cvss_v3_score_rating": {
"type": "string",
"nullable": true
},
"cvss_v3_vector": {
"type": "string",
"nullable": true
},
"cvss_v3_environmental_score": {
"type": "string",
"nullable": true
},
"cvss_v3_environmental_score_rating": {
"type": "string",
"nullable": true
},
"cvss_v3_environmental_vector": {
"type": "string",
"nullable": true
},
"is_manual": {
"type": "number"
},
"url": {
"type": "string"
},
"likelihood": {
"type": "number"
},
"status": {
"type": "string"
},
"href": {
"type": "string"
},
"tags": {
"$ref": "#/components/schemas/VulnTags"
},
"customized_on": {
"type": "string",
"format": "date-time"
},
"default_solution": {
"type": "string"
},
"custom_policy_name": {
"type": "string"
},
"customized_by": {
"type": "string"
},
"custom_policy_reason": {
"type": "string"
},
"custom_policy_description": {
"type": "string"
},
"unreachable": {
"type": "number",
"nullable": true
}
}
},
"SolutionJSON": {
"properties": {
"solution": {
"type": "object",
"properties": {
"omit_default_solution": {
"type": "number",
"nullable": true
},
"solution": {
"type": "string"
},
"solution_prepend": {
"type": "string",
"nullable": true
}
}
}
}
},
"DescriptionJSON": {
"properties": {
"description": {
"type": "object",
"properties": {
"description": {
"type": "string"
},
"omit_default_description": {
"type": "number",
"nullable": true
},
"description_prepend": {
"type": "string",
"nullable": true
}
}
}
}
},
"VulnerabilityJSON": {
"allOf": [
{
"$ref": "#/components/schemas/Vulnerability"
},
{
"$ref": "#/components/schemas/SolutionJSON"
},
{
"$ref": "#/components/schemas/DescriptionJSON"
}
]
},
"VulnSeverity": {
"type": "object",
"properties": {
"severity": {
"type": "object",
"properties": {
"informational": {
"type": "number"
},
"medium": {
"type": "number"
},
"low": {
"type": "number"
},
"urgent": {
"type": "number"
},
"critical": {
"type": "number"
},
"high": {
"type": "number"
}
}
}
}
},
"Risk": {
"type": "object",
"properties": {
"risk": {
"type": "object",
"properties": {
"medium": {
"type": "number"
},
"critical": {
"type": "number"
},
"low": {
"type": "number"
},
"high": {
"type": "number"
},
"note": {
"type": "number"
}
}
}
}
},
"LegacyOrAdvancedStats": {
"anyOf": [
{
"$ref": "#/components/schemas/VulnSeverity"
},
{
"$ref": "#/components/schemas/Risk"
}
]
},
"StatsCommonProps": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"label": {
"type": "string"
},
"service_level": {
"type": "string"
},
"weight": {
"type": "string"
}
}
},
"DisplayStatsOpenClosed": {
"properties": {
"closed": {
"type": "object",
"properties": {
"count": {
"type": "number"
}
}
},
"open": {
"type": "object",
"properties": {
"count": {
"type": "number"
}
}
}
}
},
"StatsTotalsJSON": {
"type": "object",
"properties": {
"open": {
"type": "number"
},
"closed": {
"type": "number"
},
"accepted": {
"type": "number"
},
"out_of_scope": {
"type": "number"
}
}
},
"DisplayStatsJSON": {
"allOf": [
{
"$ref": "#/components/schemas/StatsCommonProps"
},
{
"$ref": "#/components/schemas/DisplayStatsOpenClosed"
},
{
"$ref": "#/components/schemas/LegacyOrAdvancedStats"
}
]
},
"DisplayStatsObjJSON": {
"type": "object",
"properties": {
"site_stats": {
"type": "object",
"properties": {
"4": {
"$ref": "#/components/schemas/DisplayStatsJSON"
}
}
},
"totals": {
"$ref": "#/components/schemas/StatsTotalsJSON"
}
}
},
"Errors": {
"properties": {
"102": {
"type": "object",
"properties": {
"client_id": {
"type": "string"
},
"site_id": {
"type": "string"
},
"error": {
"type": "string"
}
}
}
}
},
"VulnerabilityCollectionJSON": {
"type": "object",
"properties": {
"collection": {
"type": "array",
"items": {
"$ref": "#/components/schemas/VulnerabilityJSON"
}
},
"stats": {
"$ref": "#/components/schemas/DisplayStatsObjJSON"
},
"errors": {
"$ref": "#/components/schemas/Errors"
}
}
},
"AttackVectors": {
"type": "array",
"default": [],
"items": {
"$ref": "#/components/schemas/AttackVector"
}
},
"Notes": {
"type": "array",
"nullable": true,
"default": [],
"items": {
"$ref": "#/components/schemas/Note"
}
},
"Answer": {
"type": "object",
"nullable": true,
"properties": {
"time": {
"type": "string",
"format": "date-time"
},
"answer": {
"type": "string"
},
"id": {
"type": "string"
},
"author": {
"type": "string"
}
}
},
"Qanda": {
"type": "object",
"nullable": true,
"properties": {
"time": {
"type": "string",
"format": "date-time"
},
"question": {
"type": "string"
},
"id": {
"type": "string"
},
"author": {
"type": "string"
},
"answer": {
"$ref": "#/components/schemas/Answer"
}
}
},
"Qandas": {
"type": "array",
"nullable": true,
"default": [],
"items": {
"$ref": "#/components/schemas/Qanda"
}
}
}
},
"x-readme": {
"proxy-enabled": true
}
}
```