--- title: "ListVulnerabilities" method: GET path: "/v1/namespaces/{tenant_meta.namespace}/vulnerabilities" tags: ["VulnerabilityService"] --- # ListVulnerabilities `GET /v1/namespaces/{tenant_meta.namespace}/vulnerabilities` List all vulnerabilities in the namespace. ## Path parameters - `tenant_meta.namespace` string, required ## Query parameters - `list_parameters.filter` string - `list_parameters.page_token` integer - `list_parameters.page_size` integer - `list_parameters.action` string - `list_parameters.mask` string - `list_parameters.traverse` boolean - `list_parameters.sort.path` string - `list_parameters.sort.order` 'SORT_ENTRY_ORDER_UNSPECIFIED' | 'SORT_ENTRY_ORDER_ASC' | 'SORT_ENTRY_ORDER_DESC' - `list_parameters.count` boolean - `list_parameters.group.aggregation_paths` string - `list_parameters.group.show_aggregation_uuids` boolean - `list_parameters.group.unique_count_paths` string - `list_parameters.group.unique_value_paths` string - `list_parameters.ci_run_uuid` string - `list_parameters.page_id` string - `list_parameters.group_by_time.aggregation_paths` string - `list_parameters.group_by_time.show_aggregation_uuids` boolean - `list_parameters.group_by_time.interval` 'GROUP_BY_TIME_INTERVAL_UNSPECIFIED' | 'GROUP_BY_TIME_INTERVAL_YEAR' | 'GROUP_BY_TIME_INTERVAL_QUARTER' | 'GROUP_BY_TIME_INTERVAL_MONTH' | 'GROUP_BY_TIME_INTERVAL_WEEK' | 'GROUP_BY_TIME_INTERVAL_DAY' | 'GROUP_BY_TIME_INTERVAL_HOUR' | 'GROUP_BY_TIME_INTERVAL_MINUTE' | 'GROUP_BY_TIME_INTERVAL_SECOND' - `list_parameters.group_by_time.group_size` integer - `list_parameters.group_by_time.start_time` string, date-time - `list_parameters.group_by_time.end_time` string, date-time - `list_parameters.group_by_time.mode` string - `list_parameters.group_by_time.aggregation_value_field` string - `list_parameters.group_by_time.aggregation_operator` string - `list_parameters.disable_pagination` boolean ## Response `200` A successful response. - V1ListVulnerabilitiesResponse — Response to the request to list vulnerabilities. - `count_response` V1CountResponse — Response to a list count request. - `count` integer — Number of objects matching the given list parameters. - `group_response` V1GroupResponse — Response to a list group request. - `groups` object — Map indexed by values of the fields specified in aggregation_paths, for example, {"[{"key":"meta.kind","value":"Project"}]": { "aggregation_count": { "count": 1649 } } }. - `list` V1ListVulnerabilitiesResponseList - `objects` V1Vuln[] - `meta` V1Meta, required — Common fields for all Endor Labs resources. - `annotations` object — Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time — Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string — Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string — Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData — IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float — search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time — Time that the resource will be deleted. - `kind` string — Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required — Resource name. Must be 63 characters or less. - `parent_kind` string — Parent object resource kind, for example, Project. - `parent_uuid` string — Parent object UUID. - `references` object — Map of objects referenced in a query API. - `tags` string[] — List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time — Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string — Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time — Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string — Message version. - `spec` V1VulnSpec - `additional_endor_notes` string[] — Notes from the Endor Labs analysis of the vulnerability. - `additional_notes` string[] — Notes by the person that processed the CVE. - `affected` VulnSpecAffected[] - `affected_callpath_uris` string[] — Affected function URIs in FastenURI format. For example, "/com.atlassian.connect.spring.internal.lifecycle/LifecycleController.installed(%2Fcom.atlassian.connect.spring.internal.lifecycle%2FLifecycleEvent,%2Fcom.atlassian.connect.spring%2FAtlassianHostUser)%2Forg.springframework.http%2FResponseEntity". - `affected_filepaths` string[] — Class name that this vulnerability affects in JVM notation. For example, "com/atlassian/connect/spring/internal/lifecycle/LifecycleController.class". - `database_specific` object — Optional. JSON object holding additional information about the vulnerability as defined by the database for which the record applies. - `ecosystem_specific` object — Optional. JSON object holding additional information about the vulnerability as defined by the ecosystem for which the record applies. - `fix_commits` string[] - `has_been_fixed` boolean - `maintainer_cvss_level` 'CVSS_SEVERITY_LEVEL_UNSPECIFIED' | 'CVSS_SEVERITY_LEVEL_NONE' | 'CVSS_SEVERITY_LEVEL_LOW' | 'CVSS_SEVERITY_LEVEL_MEDIUM' | 'CVSS_SEVERITY_LEVEL_HIGH' | 'CVSS_SEVERITY_LEVEL_CRITICAL' — Common severity level enum used across different CVSS versions. - `maintainer_severity` 'LEVEL_UNSPECIFIED' | 'LEVEL_NONE' | 'LEVEL_LOW' | 'LEVEL_MEDIUM' | 'LEVEL_HIGH' | 'LEVEL_CRITICAL' - `package` SpecAffectedPackage — Package information and version. - `cpe` string - `cpes` string[] — List of CPEs associated with the affected package. - `ecosystem` 'ECOSYSTEM_UNSPECIFIED' | 'ECOSYSTEM_GO' | 'ECOSYSTEM_MAVEN' | 'ECOSYSTEM_PYPI' | 'ECOSYSTEM_CARGO' | 'ECOSYSTEM_NPM' | 'ECOSYSTEM_GEM' | 'ECOSYSTEM_NUGET' | 'ECOSYSTEM_PACKAGIST' | 'ECOSYSTEM_SBOM' | 'ECOSYSTEM_RPM' | 'ECOSYSTEM_DEBIAN' | 'ECOSYSTEM_GITHUB_ACTION' | 'ECOSYSTEM_COCOAPOD' | 'ECOSYSTEM_APK' | 'ECOSYSTEM_CONTAINER' | 'ECOSYSTEM_HUGGING_FACE' | 'ECOSYSTEM_C' | 'ECOSYSTEM_GIT' | 'ECOSYSTEM_AI_MODEL' | 'ECOSYSTEM_SWIFT' | 'ECOSYSTEM_CONAN' | 'ECOSYSTEM_VSCODE', required — - ECOSYSTEM_GO: GoLang. - ECOSYSTEM_MAVEN: Maven. - ECOSYSTEM_PYPI: Python. - ECOSYSTEM_CARGO: Rust. - ECOSYSTEM_NPM: Javascript. - ECOSYSTEM_GEM: Ruby. - ECOSYSTEM_NUGET: Dotnet. - ECOSYSTEM_PACKAGIST: PHP. - ECOSYSTEM_SBOM: SBOMs. - ECOSYSTEM_RPM: RPM. - ECOSYSTEM_DEBIAN: Debian. - ECOSYSTEM_GITHUB_ACTION: GitHub Actions. - ECOSYSTEM_COCOAPOD: Cocoapods. - ECOSYSTEM_APK: APK (alpine et.al). - ECOSYSTEM_CONTAINER: Containers. - ECOSYSTEM_HUGGING_FACE: Hugging Face. - ECOSYSTEM_C: C/C++. - ECOSYSTEM_GIT: ecosystem GIT for GIT repository dependencies. This can be used for package name of the resolved dependencies when a given repository has dependencies to other GIT repositories. Currently we use this to represent vulnerabilities for the given GIT repository. ex: git submodules, C/C++ dependencies. - ECOSYSTEM_AI_MODEL: AI models. - ECOSYSTEM_SWIFT: Ecosystem Swift consists of native Swift packages, which are defined using the Package.swift manifest file and managed by the Swift Package Manager. There is a separate ecosystem for Cocoapod packages called ECOSYSTEM_COCOAPOD, which is an alternative package manager for Swift packages. - ECOSYSTEM_CONAN: Ecosystem Conan for C/C++ packages managed by the Conan 2.x package manager. - ECOSYSTEM_VSCODE: VS Code editor extensions, distributed via the Microsoft Visual Studio Marketplace. - `name` string, required - `purl` string - `ranges` SpecAffectedRange[] - `fixed` string — The version or commit in which this vulnerability was fixed. - `introduced` string — The earliest version or commit in which this vulnerability was introduced. - `last_affected` string — The last version known to be affected. Versions strictly after this are assumed to be fixed. Used when an explicit fixed version is unavailable. - `repo` string — The repository URL. - `type` 'RANGE_TYPE_UNSPECIFIED' | 'RANGE_TYPE_GIT' | 'RANGE_TYPE_SEMVER' | 'RANGE_TYPE_ECOSYSTEM' — Type of the version information. - `source` 'SOURCE_UNSPECIFIED' | 'SOURCE_OSV' | 'SOURCE_ENDOR' | 'SOURCE_OVAL' - `versions` string[] - `aliases` string[] — Optional. IDs for the same vulnerability in other databases. - `credits` VulnSpecCredit[] — Optional. Credits for the vulnerability. - `contact` string[] — Contact methods (URLs). - `name` string — The name to give the credit. - `cvss_v3_severity` SpecCVSSV3Severity - `level` 'LEVEL_UNSPECIFIED' | 'LEVEL_NONE' | 'LEVEL_LOW' | 'LEVEL_MEDIUM' | 'LEVEL_HIGH' | 'LEVEL_CRITICAL' - `score` number, float — The Common Vulnerability Scoring System (CVSS score) provides a numerical (0-10) representation of the severity of an information security vulnerability. - `temporal_level` 'LEVEL_UNSPECIFIED' | 'LEVEL_NONE' | 'LEVEL_LOW' | 'LEVEL_MEDIUM' | 'LEVEL_HIGH' | 'LEVEL_CRITICAL' - `temporal_score` number, float — The Common Vulnerability Scoring System (CVSS score) provides a numerical (0-10) representation of the severity of an information security vulnerability. - `temporal_vector` string — A specially formatted vector indicating the attack surface and severity of the vulnerability. Format is here: https://www.first.org/cvss/specification-document. - `vector` string — A specially formatted vector indicating the attack surface and severity of the vulnerability. Format is here: https://www.first.org/cvss/specification-document. - `cvss_v4_severity` SpecCVSSV4Severity - `base_level` 'V4_LEVEL_UNSPECIFIED' | 'V4_LEVEL_NONE' | 'V4_LEVEL_LOW' | 'V4_LEVEL_MEDIUM' | 'V4_LEVEL_HIGH' | 'V4_LEVEL_CRITICAL' - `base_score` number, float — The Common Vulnerability Scoring System v4.0 base score provides a numerical (0-10) representation of the severity of an information security vulnerability. - `environmental_level` 'V4_LEVEL_UNSPECIFIED' | 'V4_LEVEL_NONE' | 'V4_LEVEL_LOW' | 'V4_LEVEL_MEDIUM' | 'V4_LEVEL_HIGH' | 'V4_LEVEL_CRITICAL' - `environmental_score` number, float — The CVSS v4.0 environmental score provides context-specific scoring based on the deployment environment. - `threat_level` 'V4_LEVEL_UNSPECIFIED' | 'V4_LEVEL_NONE' | 'V4_LEVEL_LOW' | 'V4_LEVEL_MEDIUM' | 'V4_LEVEL_HIGH' | 'V4_LEVEL_CRITICAL' - `threat_score` number, float — The CVSS v4.0 threat score provides additional context about the exploitability of the vulnerability. - `vector` string — A specially formatted vector indicating the attack surface and severity of the vulnerability. Format is here: https://www.first.org/cvss/v4.0/specification-document. - `database_specific` object — Optional. JSON object holding additional information about the vulnerability as defined by the database for which the record applies. - `deepdive` boolean — Indicates whether the research team performed full analysis on multiple artifact_ids involved in CVE. - `disputed` boolean — Indicates whether the research team considers a CVE should be disputed based on analysis. - `epss_score` SpecEPSSScore - `percentile_score` number, double - `probability_score` number, double - `malicious` boolean — Indicates whether this item is classified as malicious or not. - `modified` string, date-time — The RFC3339 timestamp indicating when this entry was last modified. - `published` string, date-time — The RFC3339 timestamp indicating when this entry was published. - `raw` SpecRaw - `endor_vulnerability` Endorv1Vulnerability — Vulnerability models information that can be extracted by analyzing CVEs. - `additional_notes` string — Notes by the person that processed the CVE. - `component` VulnerabilityComponent[] — Information about affected artifacts, versions and function identifiers. - … - `cve_description` string, required — A freeform textual summary of the vulnerability. - `cve_id` string, required — The CVE ID, as it appears in the NVD. For example, CVE-2021-36090. - `cve_references` string[] - `cvss_score` number, float — The Common Vulnerability Scoring System (CVSS score) provides a numerical (0-10) representation of the severity of an information security vulnerability. - `cvss_vector` string - `cwe` string - `deepdive` boolean — Indicates whether the research team performed full analysis on multiple artifact_ids involved in CVE. - `disputed` boolean — Indicates whether the research team considers a CVE should be disputed based on analysis. - `ecosystem` string, required - `fix_commit` string[] - `last_updated` string, date-time — The timestamp when the vulnerability was last updated. - `malicious` boolean — Indicates whether this item is classified as malicious or not. - `nofix` boolean — Indicates whether the fix is not released or not disclosed for a CVE. In such cases, the endor_uri string might not be available. - `package_name` string, required - `schema_version` string, required — The schema version used for this vulnerability descriptor. - `withdrawn` string, date-time — Indicates whether the underlying vulnerability has been withdrawn. - `epss_record` SpecEPSSRecord - `cve_id` string - `ingestion_time` string, date-time - `percentile` number, double - `probability` number, double - `kev_record` SpecKEVRecord - `cve_id` string - `date_added` string, date-time - `due_date` string, date-time - `known_ransomware_campaign_use` string - `notes` string - `product` string - `required_action` string - `short_description` string - `vendor_project` string - `vulnerability_name` string - `nvd_vulnerability` V1NVDVulnerability — NVD Vulnerability. Based on schema definition provided by NVD here. https://csrc.nist.gov/schema/nvd/api/2.0/cve_api_json_2.0.schema. - `cve` NVDVulnerabilityRootCve - … - `osv_vulnerability` OsvVulnerability — A vulnerability entry. The protobuf representation is *NOT* stable and only used for implementing the JSON based API. - `affected` OsvAffected[] — Required. Affected commit ranges and versions. - … - `aliases` string[] — Optional. IDs for the same vulnerability in other databases. - `credits` OsvCredit[] — Optional. Credits for the vulnerability. - … - `database_specific` object — Optional. JSON object holding additional information about the vulnerability as defined by the database for which the record applies. - `details` string — Required. Any additional human readable details for the vulnerability. - `id` string — The `id` field is a unique identifier for the vulnerability entry. It is a string of the format `-`, where `DB` names the database and `ENTRYID` is in the format used by the database. For example: “OSV-2020-111”, “CVE-2021-3114”, or “GHSA-vp9c-fpxx-744v”. - `modified` string, date-time — The RFC3339 timestamp indicating when this entry was last modified. - `package` OsvPackage — Package information and version. - … - `published` string, date-time — The RFC3339 timestamp indicating when this entry was published. - `references` OsvReference[] — Optional. URLs to more information/advisories (including the scheme e.g "https://"). - … - `related` string[] — Optional. List of IDs of closely related vulnerabilities, such as the same problem in alternate ecosystems. - `schema_version` string — The OSV schema version. - `severity` OsvSeverity[] — Optional. Severity of the vulnerability. - … - `summary` string — Required. One line human readable summary for the vulnerability. It is recommended to keep this under 120 characters. - `withdrawn` string, date-time — Optional. The RFC3339 timestamp indicating when this entry is considered to be withdrawn. - `references` VulnSpecReference[] — Reference URLs for the vulnerability. - `type` 'REFERENCE_TYPE_UNSPECIFIED' | 'REFERENCE_TYPE_WEB' | 'REFERENCE_TYPE_ADVISORY' | 'REFERENCE_TYPE_REPORT' | 'REFERENCE_TYPE_FIX' | 'REFERENCE_TYPE_PACKAGE' | 'REFERENCE_TYPE_ARTICLE', required - `url` string, required — The vulnerability URL. - `related` string[] — Optional. List of IDs of closely related vulnerabilities, such as the same problem in alternate ecosystems. - `summary` string — Long summary of the vulnerability. - `withdrawn` string, date-time — Optional. The RFC3339 timestamp indicating when this entry is considered to be withdrawn. - `tenant_meta` V1TenantMeta — Tenant related data for the tenant containing the resource. - `namespace` string, required — Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string — The UUID of a vulnerability. - `response` V1ListResponse — Response to a list request. - `next_page_id` string — The UUID of last message retrieved. - `next_page_token` integer — Pagination token that can be used to retrieve the next page of results. ## Other responses - `default` — An unexpected error response. --- [API](https://skmtc.net/endorlabs/apis/endor-labs-rest-api-reference.md) · [All operations](https://skmtc.net/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/endorlabs/endor-labs-rest-api-reference/revisions/2fe1f84213b3/schema)