Continuous Dynamic Help DocsContinuous Dynamic Portal Login (US)Continuous Dynamic Portal Login (EU)Customer Support
API Reference

Retrieve all vulnerabilities

get
https://sentinel.whitehatsec.com/api/vuln

This operation returns an object containing information about all vulnerabilities (vulns) that the requester has permission to view.

Query Params
int32

Indicates how many vulnerabilities to process per 'batch' before sending data to client; helps keep connection open for queries producing large numbers of vulnerabilities.

string

Retrieves vulns with the given threat value(s). Accepts one value or multiple comma-separated values. Range of values allowed: 1 to 5. Only meaningful to Legacy Scoring users.

string

Retrieves vulns with the given score(s). Accepts one value or multiple comma-separated values. Range of values allowed: 3 to 20. Only meaningful to Legacy Scoring users.

string

Retrieves vulns with the given severity value(s). Accepts one value or multiple comma-separated values. Range of values allowed: 1 to 5. Only meaningful to Legacy Scoring users.

string

Retrieves vulns with the given impact value(s). Accepts one value or multiple comma-separated values. Range of values allowed: 0 to 9. Only meaningful to Advanced Scoring users.

string

Retrieves vulns with the given likelihood value(s). Accepts one value or multiple comma-separated values. Range of values allowed: 0 to 9. Only meaningful to Advanced Scoring users.

string

Retrieves vulns with the given risk value(s). Accepts one value or multiple comma-separated values. Range of values allowed: 1 to 5. Only meaningful to Advanced Scoring users.

int32

Retrieves vulns that have a custom_risk value that matches what is given. Custom risk values range from 1 to 5. Only applies to Advanced Scoring.

int32

Retrieves vulns that have an 'effective risk' value matching what is given. If custom scoring is enabled and the retrieved vulnerability is customized, then the effective risk will match the custom risk; otherwise it will match the default risk. Only applies to Advanced Scoring.

string

Retrieves vulns that have the given status(es). Status may be 'open', 'closed', 'accepted', 'invalid', or 'all'. Comma-separated combinations may be used (with the exception of 'all', which must be used alone). EXAMPLE: "open,closed,accepted".

string

Retrieves vulns by their short or long vulnerability classification name. Comma-separated combinations may be used. EXAMPLE: 'XSS,Spoof' or 'Cross Site Scripting,Content Spoofing'.

string

Retrieves vulns by their long vulnerability classification name. Does NOT accept short names. Comma-separated combinations may be used. EXAMPLE: 'Cross Site Scripting,Content Spoofing'.

string

Retrieves vulns for the given site ID(s) or site label(s). Accepts one value or multiple comma-separated values.

string

Retrieves vulns for the given site label or part of a label. Only accepts a single value. EXAMPLE: Given you have a site named 'foo' and a site named 'foobar', if you enter 'foo' for this parameter, it will return vulns for both these sites. If you enter 'bar', it will only return vulns for 'foobar'.

string

Retrieves vulns for all sites EXCEPT for the given site label or part of a label. Only accepts a single value. EXAMPLE: Given you have a site named 'foo' and a site named 'foobar', if you enter 'bar' for this parameter, it will only return vulns for the 'foo' site.

string
enum
Defaults to active

Retrieves vulns for all sites with the asset status given. Sites with 'active' asset status are fully approved for scans. Sites with 'inactive' status are not currently approved for scans.

Allowed:
string

Provide some portion of a url to search for. EXAMPLE: Entering 'testsite' will return any vuln found associated with a url containing the string 'testsite'.

string

Retrieves vulns belonging to sites which are members of a particular group. Only one group may be specified. The format of the ID is {clientid}{group_id}. EXAMPLE: 1066_17

string

Retrieves vulns belonging to sites that are members of particular group(s), based on a group name that contains or matches what is given.

string

Retrieves vulns found since the given timestamp. Requires a valid ISO-8601 (UTC/GMT) date format string. EXAMPLE: 'YYYY-MM-DDThh:mm:ssZ' -> '2008-12-12T21:35:59Z'

string

Retrieves vulns opened (or reopened) since the given timestamp. Requires a valid ISO-8601 (UTC/GMT) date format string. EXAMPLE: 'YYYY-MM-DDThh:mm:ssZ' -> '2008-12-12T21:35:59Z'

string

Retrieves vulns closed since the given timestamp. Requires a valid ISO-8601 (UTC/GMT) date format string. EXAMPLE: 'YYYY-MM-DDThh:mm:ssZ' -> '2008-12-12T21:35:59Z'

string

Retrieves vulns modified since the given timestamp. Requires a valid ISO-8601 (UTC/GMT) date format string. EXAMPLE: 'YYYY-MM-DDThh:mm:ssZ' -> '2008-12-12T21:35:59Z'

string

Retrieves vulns opened (or reopened) prior to the given timestamp. Requires a valid ISO-8601 (UTC/GMT) date format string. EXAMPLE: 'YYYY-MM-DDThh:mm:ssZ' -> '2008-12-12T21:35:59Z'

string

Retrieves vulns opened (or reopened) since the given timestamp. Equivalent to 'query_opened'. Requires a valid ISO-8601 (UTC/GMT) date format string. EXAMPLE: 'YYYY-MM-DDThh:mm:ssZ' -> '2008-12-12T21:35:59Z'

string

Retrieves vulns closed prior to the given timestamp. Requires a valid ISO-8601 (UTC/GMT) date format string. EXAMPLE: 'YYYY-MM-DDThh:mm:ssZ' -> '2008-12-12T21:35:59Z'

string

Retrieves vulns closed since the given timestamp. Equivalent to 'query_closed'. Requires a valid ISO-8601 (UTC/GMT) date format string. EXAMPLE: 'YYYY-MM-DDThh:mm:ssZ' -> '2008-12-12T21:35:59Z'

string

Retrieves vulns modified prior to the given timestamp. Requires a valid ISO-8601 (UTC/GMT) date format string. EXAMPLE: 'YYYY-MM-DDThh:mm:ssZ' -> '2008-12-12T21:35:59Z'

string

Retrieves vulns modified after the given timestamp. Equivalent to 'query_modified'. Requires a valid ISO-8601 (UTC/GMT) date format string. EXAMPLE: 'YYYY-MM-DDThh:mm:ssZ' -> '2008-12-12T21:35:59Z'

string

Retrieves vulns opened (or reopened) AFTER the given date. Requires a valid ISO-8601 (UTC/GMT) date format string. EXAMPLE: 'YYYY-MM-DDThh:mm:ssZ' -> '2008-12-12T21:35:59Z'

string

Retrieves vulns opened (or reopened) BEFORE the given date. Requires a valid ISO-8601 (UTC/GMT) date format string. EXAMPLE: 'YYYY-MM-DDThh:mm:ssZ' -> '2008-12-12T21:35:59Z'

string

Retrieves vulns that have one or more given tags associated with them. Multiple tags must be comma-separated.

string
enum
Defaults to all

Changes the behavior of query_tags when more than one tag is specified. If the value is 'all' then ALL tags must be present to match. If it is 'none', NO tags must match. If the value is 'any', ANY tag may match (default behavior).

Allowed:
string
enum
Defaults to 0

Retrieves vulns that have the given ''unreachable'' status. If a vuln has this flag set to TRUE (1), a retest on the vuln returned a response that was significantly different from the original response, indicating a very different page is now associated with the vulnerability path.

Allowed:
string
enum
Defaults to 1

Display vulnerability data if value is 1. This is also the default behavior if this parameter is omitted from the request. If the value is 0, vulnerability data is NOT displayed.

Allowed:
string
enum
Defaults to 0

Display general information about each vulnerability. The 'custom' option will display custom descriptions.

Allowed:
string
enum
Defaults to 0

Display the default general information about each vulnerability (no custom description).

Allowed:
string
enum
Defaults to 0

Display general vulnerability solution information. The 'custom' option will display custom solutions.

Allowed:
string
enum
Defaults to 0

Display the default solution for each vulnerability (no custom solution).

Allowed:
string
enum
Defaults to 0

Display all questions and answers (Q and A) that exist for each vulnerability.

Allowed:
string
enum
Defaults to 0

Display the Common Vulnerability Scoring System (CVSS) score and vector for each vulnerability.

Allowed:
string
enum
Defaults to 0

Display all tags for each vulnerability.

Allowed:
string
enum
Defaults to 0

Display risk value for each vulnerability. Only meaningful to Advanced Scoring users.

Allowed:
string
enum
Defaults to 0

Display impact value for each vulnerability. Only meaningful to Advanced Scoring users.

Allowed:
string
enum
Defaults to 0

Display likelihood value for each vulnerability. Only meaningful to Advanced Scoring users.

Allowed:
string
enum
Defaults to 0

Display the date each vulnerability was first opened.

Allowed:
string
enum
Defaults to 0

Display each vulnerability's custom risk, if it is defined. Only meaningful to Advanced Scoring users who make use of custom scoring features.

Allowed:
string
enum
Defaults to 0

If a custom policy is applied to any vuln retrieved, setting this parameter displays the custom policy name, description, who created the policy, and the date the policy was created. Only meaningful to Advanced Scoring users who make use of custom scoring features.

Allowed:
string
enum
Defaults to 0

Display the text values of vulnerability scores instead of numeric. NOTE: Only available for CSV output at this time.

Allowed:
string

Display attack vector (AV) data.
Values allowed: 0, 1, open, closed, accepted, invalid, all.
Specifying 0 displays minimal data on open, closed, and accepted AVs.
Specifying 1 displays details on open, closed, and accepted AVs.
Specifying 'all' displays details on AVs of all statuses.
Specifying 'open' displays details on open AVs.

With the exception of 0, 1, and 'all', comma-separated combinations of these options are also allowed.
EXAMPLE: 'open,accepted'

int32

Specify the maximum number of attack vectors to display per vulnerability. PREREQUISITE: display_attack_vectors=1

string
enum
Defaults to 0

Display all attack vector notes for each vulnerability attack vector. PREREQUISITE: display_attack_vectors=1

Allowed:
string
enum
Defaults to 0

Display whether or not an attack vector is 'flagged'. PREREQUISITE: display_attack_vectors=1

Allowed:
string
enum
Defaults to 0

Display scanner tags for each attack vector. PREREQUISITE: display_attack_vectors=1

Allowed:
string
enum
Defaults to 0

Displays attack vectors that have the given ''unreachable'' status. If a vector has this flag set to TRUE (1), a retest on the vector returned a response that was significantly different from the original response, indicating a very different page is now associated with the attack vector path. PREREQUISITE: display_attack_vectors=1

Allowed:
string
enum
Defaults to 1

Display attack vector request information. Basic request data is already shown if display_attack_vectors=1, but this parameter may be useful if the user wishes to omit this information. PREREQUISITE: display_attack_vectors=1

Allowed:
string
enum
Defaults to 1

Display attack vector response information. Basic response data is already shown if display_attack_vectors=1, but this parameter may be useful if the user wishes to omit this information. PREREQUISITE: display_attack_vectors=1

Allowed:
string
enum
Defaults to 0

Display the attack vector response body (can be quite large). PREREQUISITE: display_attack_vectors=1

Allowed:
string
enum
Defaults to 0

Display the attack vector response body match in full (can be quite large). Highlights where the vuln was found. PREREQUISITE: display_attack_vectors=1

Allowed:
string
enum
Defaults to 0

Display a smaller (abbreviated) response body match as part of the response content. Highlights where the vuln was found. PREREQUISITE: display_attack_vectors=1, display_body=1

Allowed:
string
enum
Defaults to 0

Display attack vector HTTP request and response headers. PREREQUISITE: display_attack_vectors=1

Allowed:
string
enum
Defaults to 1

Display attack vector request parameter(s). This data is already shown if display_attack_vectors=1, but this parameter may be useful if the user wishes to omit this information. PREREQUISITE: display_attack_vectors=1

Allowed:
string
enum
Defaults to 0

Display whether or not notes exist for vulnerabilities and attack vectors (result value will be 1 if notes exist, 0 if not).

Allowed:
string
enum
Defaults to 0

Display vulnerability statistics for all sites accessible to the requester.

Allowed:
string
enum
Defaults to 0

Reports vulnerabilities that encountered errors attempting to retrieve attack vector response data. In most cases, issuing a retest on these vulns will fix the issue. PREREQUISITE: display_attack_vectors=1

Allowed:
string
enum
Defaults to 0

Displays the CVSS v3 vector information for each vulnerability. Only applies to CSV format. PREREQUISITE: display_cvss=1

Allowed:
string
enum
Defaults to 0

Displays the Business Logic Assessment (BLA) ID, if any, associated with each vulnerability.

Allowed:
int32

Limit results to n number of pages.

int32

Begin showing results from page number n.

string
enum
Defaults to id

Order the results.

string
enum
Defaults to xml

Requested resource format for the response.

Allowed:
Headers
string
enum
Defaults to application/json

Generated from available response content types

Allowed:
Responses

400

BadRequestResponse indicates a request with invalid parameters.

401

UnauthorizedResponse signals an unauthorized API access.

403

ForbiddenResponse signals a request for a resource that does not exist or is not authorized.

500

GenericError generic error.

Updated over 5 years ago

Language
Response 
 Choose an example:
application/json
text/xml
text/csv, text/comma-separated-values
Updated over 5 years ago