---
title: "POST /vulnerabilities/search"
method: POST
path: "/vulnerabilities/search"
---

# POST /vulnerabilities/search

`POST /vulnerabilities/search`

Lists Amazon Inspector coverage details for a specific vulnerability.

## Request body

- object
  - `filterCriteria` object, required — Details on the criteria used to define the filter for a vulnerability search.
    - `vulnerabilityIds` VulnId[] — The IDs for specific vulnerabilities.
  - `nextToken` string — A token to use for paginating results that are returned in the response. Set the value of this parameter to null for the first request to a list action. For subsequent calls, use the <code>NextToken</code> value returned from the previous request to continue listing results after the first page.

## Response `200`

Success

- SearchVulnerabilitiesResponse
  - `vulnerabilities` Vulnerability[], required — Details about the listed vulnerability.
    - `id` string, required — The ID for the specific vulnerability.
    - `cwes` Cwe[] — The Common Weakness Enumeration (CWE) associated with the vulnerability.
    - `cisaData` object — An object that contains the Cybersecurity and Infrastructure Security Agency (CISA) details for the vulnerability.
      - `dateAdded` string, date-time — The date and time CISA added this vulnerability to their catalogue.
      - `dateDue` string, date-time — The date and time CISA expects a fix to have been provided vulnerability.
      - `action` string — The remediation action recommended by CISA for this vulnerability.
    - `source` 'NVD' — The source of the vulnerability information. Possible results are <code>RHEL</code>, <code>AMAZON_CVE</code>, <code>DEBIAN</code> or <code>NVD</code>.
    - `description` string — A description of the vulnerability.
    - `atigData` object — An object that contains information about the Amazon Web Services Threat Intel Group (ATIG) details for the vulnerability.
      - `firstSeen` string, date-time — The date and time this vulnerability was first observed.
      - `lastSeen` string, date-time — The date and time this vulnerability was last observed.
      - `targets` Target[] — The commercial sectors this vulnerability targets.
      - `ttps` Ttp[] — The <a href="https://attack.mitre.org/">MITRE ATT&amp;CK</a> tactics, techniques, and procedures (TTPs) associated with vulnerability.
    - `vendorSeverity` string — The severity assigned by the vendor.
    - `cvss4` object — An object that contains the Common Vulnerability Scoring System (CVSS) Version 4 details for the vulnerability.
      - `baseScore` number, double — The base CVSS v4 score for the vulnerability finding, which rates the severity of the vulnerability on a scale from 0 to 10.
      - `scoringVector` string — The CVSS v4 scoring vector, which contains the metrics and measurements that were used to calculate the base score.
    - `cvss3` object — An object that contains the Common Vulnerability Scoring System (CVSS) Version 3 details for the vulnerability.
      - `baseScore` number, double — The CVSS v3 base score for the vulnerability.
      - `scoringVector` string — The scoring vector associated with the CVSS v3 score.
    - `relatedVulnerabilities` RelatedVulnerability[] — A list of related vulnerabilities.
    - `cvss2` object — An object that contains the Common Vulnerability Scoring System (CVSS) Version 2 details for the vulnerability.
      - `baseScore` number, double — The CVSS v2 base score for the vulnerability.
      - `scoringVector` string — The scoring vector associated with the CVSS v2 score.
    - `vendorCreatedAt` string, date-time — The date and time when the vendor created this vulnerability.
    - `vendorUpdatedAt` string, date-time — The date and time when the vendor last updated this vulnerability.
    - `sourceUrl` string — A link to the official source material for this vulnerability.
    - `referenceUrls` VulnerabilityReferenceUrl[] — Links to various resources with more information on this vulnerability.
    - `exploitObserved` object — An object that contains details on when the exploit was observed.
      - `lastSeen` string, date-time — The date an time when the exploit was last seen.
      - `firstSeen` string, date-time — The date an time when the exploit was first seen.
    - `detectionPlatforms` NonEmptyString[] — Platforms that the vulnerability can be detected on.
    - `epss` object — An object that contains the Exploit Prediction Scoring System (EPSS) score for a vulnerability.
      - `score` number, double — The Exploit Prediction Scoring System (EPSS) score.
  - `nextToken` string — The pagination parameter to be used on the next list operation to retrieve more items.

## Other responses

- `480` — ValidationException
- `481` — AccessDeniedException
- `482` — ThrottlingException
- `483` — InternalServerException

---

[API](https://skmtc.net/aws/apis/inspector2.md) · [All operations](https://skmtc.net/aws/apis/inspector2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/inspector2/versions/c51110c7cd43/schema)