--- title: "List vulnerabilities" method: GET path: "/api/v2/security/vulnerabilities" tags: ["Security Monitoring"] deprecated: true --- # List vulnerabilities `GET /api/v2/security/vulnerabilities` > **Deprecated.** Get a list of vulnerabilities. ### Pagination Pagination is enabled by default in both `vulnerabilities` and `assets`. The size of the page varies depending on the endpoint and cannot be modified. To automate the request of the next page, you can use the links section in the response. This endpoint will return paginated responses. The pages are stored in the links section of the response: ```JSON { "data": [...], "meta": {...}, "links": { "self": "https://.../api/v2/security/vulnerabilities", "first": "https://.../api/v2/security/vulnerabilities?page[number]=1&page[token]=abc", "last": "https://.../api/v2/security/vulnerabilities?page[number]=43&page[token]=abc", "next": "https://.../api/v2/security/vulnerabilities?page[number]=2&page[token]=abc" } } ``` - `links.previous` is empty if the first page is requested. - `links.next` is empty if the last page is requested. #### Token Vulnerabilities can be created, updated or deleted at any point in time. Upon the first request, a token is created to ensure consistency across subsequent paginated requests. A token is valid only for 24 hours. #### First request We consider a request to be the first request when there is no `page[token]` parameter. The response of this first request contains the newly created token in the `links` section. This token can then be used in the subsequent paginated requests. *Note: The first request may take longer to complete than subsequent requests.* #### Subsequent requests Any request containing valid `page[token]` and `page[number]` parameters will be considered a subsequent request. If the `token` is invalid, a `404` response will be returned. If the page `number` is invalid, a `400` response will be returned. The returned `token` is valid for all requests in the pagination sequence. To send paginated requests in parallel, reuse the same `token` and change only the `page[number]` parameter. ### Filtering The request can include some filter parameters to filter the data to be retrieved. The format of the filter parameters follows the [JSON:API format](https://jsonapi.org/format/#fetching-filtering): `filter[$prop_name]`, where `prop_name` is the property name in the entity being filtered by. All filters can include multiple values, where data will be filtered with an OR clause: `filter[title]=Title1,Title2` will filter all vulnerabilities where title is equal to `Title1` OR `Title2`. String filters are case sensitive. Boolean filters accept `true` or `false` as values. Number filters must include an operator as a second filter input: `filter[$prop_name][$operator]`. For example, for the vulnerabilities endpoint: `filter[cvss.base.score][lte]=8`. Available operators are: `eq` (==), `lt` (<), `lte` (<=), `gt` (>) and `gte` (>=). ### Metadata Following [JSON:API format](https://jsonapi.org/format/#document-meta), object including non-standard meta-information. This endpoint includes the meta member in the response. For more details on each of the properties included in this section, check the endpoints response tables. ```JSON { "data": [...], "meta": { "total": 1500, "count": 18732, "token": "some_token" }, "links": {...} } ``` ### Extensions Requests may include extensions to modify the behavior of the requested endpoint. The filter parameters follow the [JSON:API format](https://jsonapi.org/extensions/#extensions) format: `ext:$extension_name`, where `extension_name` is the name of the modifier that is being applied. Extensions can only include one value: `ext:modifier=value`. ## Query parameters - `page[token]` string - `page[number]` integer - `filter[type]` 'AdminConsoleActive' | 'CodeInjection' | 'CommandInjection' | 'ComponentWithKnownVulnerability' | 'DangerousWorkflows' | 'DefaultAppDeployed' | 'DefaultHtmlEscapeInvalid' | 'DirectoryListingLeak' | 'EmailHtmlInjection' | 'EndOfLife' | 'HardcodedPassword' | 'HardcodedSecret' | 'HeaderInjection' | 'HstsHeaderMissing' | 'InsecureAuthProtocol' | 'InsecureCookie' | 'InsecureJspLayout' | 'LdapInjection' | 'MaliciousPackage' | 'MandatoryRemediation' | 'NoHttpOnlyCookie' | 'NoSameSiteCookie' | 'NoSqlMongoDbInjection' | 'PathTraversal' | 'ReflectionInjection' | 'RiskyLicense' | 'SessionRewriting' | 'SessionTimeout' | 'SqlInjection' | 'Ssrf' | 'StackTraceLeak' | 'TrustBoundaryViolation' | 'Unmaintained' | 'UntrustedDeserialization' | 'UnvalidatedRedirect' | 'VerbTampering' | 'WeakCipher' | 'WeakHash' | 'WeakRandomness' | 'XContentTypeHeaderMissing' | 'XPathInjection' | 'Xss' — The vulnerability type. - `filter[cvss.base.score][`$op`]` number, double - `filter[cvss.base.severity]` 'Unknown' | 'None' | 'Low' | 'Medium' | 'High' | 'Critical' — The vulnerability severity. - `filter[cvss.base.vector]` string - `filter[cvss.datadog.score][`$op`]` number, double - `filter[cvss.datadog.severity]` 'Unknown' | 'None' | 'Low' | 'Medium' | 'High' | 'Critical' — The vulnerability severity. - `filter[cvss.datadog.vector]` string - `filter[status]` 'Open' | 'Muted' | 'Remediated' | 'InProgress' | 'AutoClosed' — The vulnerability status. - `filter[tool]` 'IAST' | 'SCA' | 'Infra' | 'SAST' — The vulnerability tool. - `filter[library.name]` string - `filter[library.version]` string - `filter[advisory.id]` string - `filter[risks.exploitation_probability]` boolean - `filter[risks.poc_exploit_available]` boolean - `filter[risks.exploit_available]` boolean - `filter[risks.epss.score][`$op`]` number, double - `filter[risks.epss.severity]` 'Unknown' | 'None' | 'Low' | 'Medium' | 'High' | 'Critical' — The vulnerability severity. - `filter[language]` string - `filter[ecosystem]` 'PyPI' | 'Maven' | 'NuGet' | 'Npm' | 'RubyGems' | 'Go' | 'Packagist' | 'Deb' | 'Rpm' | 'Apk' | 'Windows' | 'Generic' | 'MacOs' | 'Oci' | 'BottleRocket' | 'None' — The related vulnerability asset ecosystem. - `filter[code_location.location]` string - `filter[code_location.file_path]` string - `filter[code_location.method]` string - `filter[fix_available]` boolean - `filter[repo_digests]` string - `filter[origin]` string - `filter[running_kernel]` boolean - `filter[asset.name]` string - `filter[asset.type]` 'Repository' | 'Service' | 'Host' | 'HostImage' | 'Image' | 'ServerlessFunction' — The asset type - `filter[asset.version.first]` string - `filter[asset.version.last]` string - `filter[asset.repository_url]` string - `filter[asset.risks.in_production]` boolean - `filter[asset.risks.under_attack]` boolean - `filter[asset.risks.is_publicly_accessible]` boolean - `filter[asset.risks.has_privileged_access]` boolean - `filter[asset.risks.has_access_to_sensitive_data]` boolean - `filter[asset.environments]` string - `filter[asset.teams]` string - `filter[asset.arch]` string - `filter[asset.operating_system.name]` string - `filter[asset.operating_system.version]` string ## Response `200` OK - ListVulnerabilitiesResponse — The expected response schema when listing vulnerabilities. - `data` Vulnerability[], required — List of vulnerabilities. - `attributes` VulnerabilityAttributes, required — The JSON:API attributes of the vulnerability. - `advisory` VulnerabilityAdvisory — Advisory associated with the vulnerability. - `id` string, required — Vulnerability advisory ID. - `last_modification_date` string — Vulnerability advisory last modification date. - `publish_date` string — Vulnerability advisory publish date. - `advisory_id` string — Vulnerability advisory ID. - `code_location` CodeLocation — Code vulnerability location. - `file_path` string — Vulnerability location file path. - `location` string, required — Vulnerability extracted location. - `method` string — Vulnerability location method. - `cve_list` string[], required — Vulnerability CVE list. - `cvss` VulnerabilityCvss, required — Vulnerability severities. - `base` CVSS, required — Vulnerability severity. - `score` number, double, required — Vulnerability severity score. - `severity` 'Unknown' | 'None' | 'Low' | 'Medium' | 'High' | 'Critical', required — The vulnerability severity. - `vector` string, required — Vulnerability CVSS vector. - `datadog` CVSS, required — Vulnerability severity. - `score` number, double, required — Vulnerability severity score. - `severity` 'Unknown' | 'None' | 'Low' | 'Medium' | 'High' | 'Critical', required — The vulnerability severity. - `vector` string, required — Vulnerability CVSS vector. - `dependency_locations` VulnerabilityDependencyLocations — Static library vulnerability location. - `block` DependencyLocation, required — Static library vulnerability location. - `column_end` integer, required — Location column end. - `column_start` integer, required — Location column start. - `file_name` string, required — Location file name. - `line_end` integer, required — Location line end. - `line_start` integer, required — Location line start. - `name` DependencyLocation — Static library vulnerability location. - `column_end` integer, required — Location column end. - `column_start` integer, required — Location column start. - `file_name` string, required — Location file name. - `line_end` integer, required — Location line end. - `line_start` integer, required — Location line start. - `version` DependencyLocation — Static library vulnerability location. - `column_end` integer, required — Location column end. - `column_start` integer, required — Location column start. - `file_name` string, required — Location file name. - `line_end` integer, required — Location line end. - `line_start` integer, required — Location line start. - `description` string, required — Vulnerability description. - `ecosystem` 'PyPI' | 'Maven' | 'NuGet' | 'Npm' | 'RubyGems' | 'Go' | 'Packagist' | 'Deb' | 'Rpm' | 'Apk' | 'Windows' | 'Generic' | 'MacOs' | 'Oci' | 'BottleRocket' | 'None' — The related vulnerability asset ecosystem. - `exposure_time` integer, required — Vulnerability exposure time in seconds. - `first_detection` string, required — First detection of the vulnerability in [RFC 3339](https://datatracker.ietf.org/doc/html/rfc3339) format - `fix_available` boolean, required — Whether the vulnerability has a remediation or not. - `language` string, required — Vulnerability language. - `last_detection` string, required — Last detection of the vulnerability in [RFC 3339](https://datatracker.ietf.org/doc/html/rfc3339) format - `library` Library — Vulnerability library. - `additional_names` string[] — Related library or package names (such as child packages or affected binary paths). - `name` string, required — Vulnerability library name. - `version` string — Vulnerability library version. - `origin` string[], required — Vulnerability origin. - `remediations` Remediation[], required — List of remediations. - `auto_solvable` boolean, required — Whether the vulnerability can be resolved when recompiling the package or not. - `avoided_advisories` Advisory[], required — Avoided advisories. - `base_severity` string, required — Advisory base severity. - `id` string, required — Advisory id. - `severity` string — Advisory Datadog severity. - `fixed_advisories` Advisory[], required — Remediation fixed advisories. - `base_severity` string, required — Advisory base severity. - `id` string, required — Advisory id. - `severity` string — Advisory Datadog severity. - `library_name` string, required — Library name remediating the vulnerability. - `library_version` string, required — Library version remediating the vulnerability. - `new_advisories` Advisory[], required — New advisories. - `base_severity` string, required — Advisory base severity. - `id` string, required — Advisory id. - `severity` string — Advisory Datadog severity. - `remaining_advisories` Advisory[], required — Remaining advisories. - `base_severity` string, required — Advisory base severity. - `id` string, required — Advisory id. - `severity` string — Advisory Datadog severity. - `type` string, required — Remediation type. - `repo_digests` string[] — Vulnerability `repo_digest` list (when the vulnerability is related to `Image` asset). - `risks` VulnerabilityRisks, required — Vulnerability risks. - `epss` EPSS — Vulnerability EPSS severity. - `score` number, double, required — Vulnerability EPSS severity score. - `severity` 'Unknown' | 'None' | 'Low' | 'Medium' | 'High' | 'Critical', required — The vulnerability severity. - `exploit_available` boolean, required — Vulnerability public exploit availability. - `exploit_sources` string[], required — Vulnerability exploit sources. - `exploitation_probability` boolean, required — Vulnerability exploitation probability. - `poc_exploit_available` boolean, required — Vulnerability POC exploit availability. - `running_kernel` boolean — True if the vulnerability affects a package in the host’s running kernel, false if it affects a non-running kernel, and omit if it is not kernel-related. - `status` 'Open' | 'Muted' | 'Remediated' | 'InProgress' | 'AutoClosed', required — The vulnerability status. - `title` string, required — Vulnerability title. - `tool` 'IAST' | 'SCA' | 'Infra' | 'SAST', required — The vulnerability tool. - `type` 'AdminConsoleActive' | 'CodeInjection' | 'CommandInjection' | 'ComponentWithKnownVulnerability' | 'DangerousWorkflows' | 'DefaultAppDeployed' | 'DefaultHtmlEscapeInvalid' | 'DirectoryListingLeak' | 'EmailHtmlInjection' | 'EndOfLife' | 'HardcodedPassword' | 'HardcodedSecret' | 'HeaderInjection' | 'HstsHeaderMissing' | 'InsecureAuthProtocol' | 'InsecureCookie' | 'InsecureJspLayout' | 'LdapInjection' | 'MaliciousPackage' | 'MandatoryRemediation' | 'NoHttpOnlyCookie' | 'NoSameSiteCookie' | 'NoSqlMongoDbInjection' | 'PathTraversal' | 'ReflectionInjection' | 'RiskyLicense' | 'SessionRewriting' | 'SessionTimeout' | 'SqlInjection' | 'Ssrf' | 'StackTraceLeak' | 'TrustBoundaryViolation' | 'Unmaintained' | 'UntrustedDeserialization' | 'UnvalidatedRedirect' | 'VerbTampering' | 'WeakCipher' | 'WeakHash' | 'WeakRandomness' | 'XContentTypeHeaderMissing' | 'XPathInjection' | 'Xss', required — The vulnerability type. - `id` string, required — The unique ID for this vulnerability. - `relationships` VulnerabilityRelationships, required — Related entities object. - `affects` VulnerabilityRelationshipsAffects, required — Relationship type. - `data` VulnerabilityRelationshipsAffectsData, required — Asset affected by this vulnerability. - `id` string, required — The unique ID for this related asset. - `type` 'assets', required — The JSON:API type. - `type` 'vulnerabilities', required — The JSON:API type. - `links` Links — The JSON:API links related to pagination. - `first` string, required — First page link. - `last` string, required — Last page link. - `next` string — Next page link. - `previous` string — Previous page link. - `self` string, required — Request link. - `meta` Metadata — The metadata related to this request. - `count` integer, required — Number of entities included in the response. - `token` string, required — The token that identifies the request. - `total` integer, required — Total number of entities across all pages. ## Other responses - `400` — Bad request: The server cannot process the request due to invalid syntax in the request. - `403` — Forbidden: Access denied - `404` — Not found: There is no request associated with the provided token. - `429` — Too many requests --- [API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/versions/da68bf029e4c/schema)