---
title: "List vulnerable assets"
method: GET
path: "/api/v2/security/vulnerable-assets"
tags: ["Security Monitoring"]
---

# List vulnerable assets

`GET /api/v2/security/vulnerable-assets`

Get a list of vulnerable assets.

### Pagination

Please review the [Pagination section for the "List Vulnerabilities"](#pagination) endpoint.

### Filtering

Please review the [Filtering section for the "List Vulnerabilities"](#filtering) endpoint.

### Metadata

Please review the [Metadata section for the "List Vulnerabilities"](#metadata) endpoint.

## Query parameters

- `page[token]` string
- `page[number]` integer
- `filter[name]` string
- `filter[type]` 'Repository' | 'Service' | 'Host' | 'HostImage' | 'Image' | 'ServerlessFunction' — The asset type
- `filter[version.first]` string
- `filter[version.last]` string
- `filter[repository_url]` string
- `filter[risks.in_production]` boolean
- `filter[risks.under_attack]` boolean
- `filter[risks.is_publicly_accessible]` boolean
- `filter[risks.has_privileged_access]` boolean
- `filter[risks.has_access_to_sensitive_data]` boolean
- `filter[environments]` string
- `filter[teams]` string
- `filter[arch]` string
- `filter[operating_system.name]` string
- `filter[operating_system.version]` string

## Response `200`

OK

- ListVulnerableAssetsResponse — The expected response schema when listing vulnerable assets.
  - `data` Asset[], required — List of vulnerable assets.
    - `attributes` AssetAttributes, required — The JSON:API attributes of the asset.
      - `arch` string — Asset architecture.
      - `environments` string[], required — List of environments where the asset is deployed.
      - `name` string, required — Asset name.
      - `operating_system` AssetOperatingSystem — Asset operating system.
        - `description` string — Operating system version.
        - `name` string, required — Operating system name.
      - `risks` AssetRisks, required — Asset risks.
        - `has_access_to_sensitive_data` boolean — Whether the asset has access to sensitive data or not.
        - `has_privileged_access` boolean — Whether the asset has privileged access or not.
        - `in_production` boolean, required — Whether the asset is in production or not.
        - `is_publicly_accessible` boolean — Whether the asset is publicly accessible or not.
        - `under_attack` boolean — Whether the asset is under attack or not.
      - `teams` string[] — List of teams that own the asset.
      - `type` 'Repository' | 'Service' | 'Host' | 'HostImage' | 'Image' | 'ServerlessFunction', required — The asset type
      - `version` AssetVersion — Asset version.
        - `first` string — Asset first version.
        - `last` string — Asset last version.
    - `id` string, required — The unique ID for this asset.
    - `type` 'assets', required — The JSON:API type.
  - `links` Links — The JSON:API links related to pagination.
    - `first` string, required — First page link.
    - `last` string, required — Last page link.
    - `next` string — Next page link.
    - `previous` string — Previous page link.
    - `self` string, required — Request link.
  - `meta` Metadata — The metadata related to this request.
    - `count` integer, required — Number of entities included in the response.
    - `token` string, required — The token that identifies the request.
    - `total` integer, required — Total number of entities across all pages.

## Other responses

- `400` — Bad request: The server cannot process the request due to invalid syntax in the request.
- `403` — Forbidden: Access denied
- `404` — Not found: There is no request associated with the provided token.
- `429` — Too many requests

---

[API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/versions/da68bf029e4c/schema)