---
title: "# List Instance Scores"
method: POST
path: "/v1/exposures/instances/scores"
tags: ["Instances"]
---

# # List Instance Scores

`POST /v1/exposures/instances/scores`

Returns exposure instance scores for the specified host-exposure pairs.
Duplicate pairs are deduplicated server-side. Unmatched pairs are omitted from the response.

## Request body

- object
  - `filters` object, required
    - `host_exposure_pairs` HostExposurePairSwagger[], required — List of host-exposure pairs to query.
      - `exposure_id` string
      - `hostname` string

## Response `200`

ScoresResponse contains the list of instances for the requested host-exposure pairs.

- object
  - `instance_scores` ScoreItem[] — List of exposure instance scores matching the requested pairs. Unmatched pairs are omitted.
    - `asset_criticality` number, double
    - `asset_id` string
    - `contextual_cvss` number, double
    - `cve_id` string
    - `exploitability` number, double
    - `picus_exposure_score` number, double
    - `security_control_effectiveness` string

## Other responses

- `422` — validationErrorSwagger is represents the erroneous cases
- `default` — genericErrorSwagger is represents the erroneous cases

---

[API](https://skmtc.net/picussecurity/apis/picus-rest-api.md) · [All operations](https://skmtc.net/picussecurity/apis/picus-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/picussecurity/picus-rest-api/versions/cb0d02ee28f8/schema)