---
title: "Asset Vulnerability Validations"
method: POST
path: "/api/3/assets/{id}/vulnerabilities/{vulnerabilityId}/validations"
tags: ["Vulnerability Result"]
---

# Asset Vulnerability Validations

`POST /api/3/assets/{id}/vulnerabilities/{vulnerabilityId}/validations`

Creates a vulnerability validation for a vulnerability on an asset. The validation signifies that the vulnerability has been confirmed exploitable by an external tool, such as <a target="_blank" rel="noopener noreferrer" href="https://www.metasploit.com">Metasploit</a>.

## Path parameters

- `id` integer, required — The identifier of the asset.
- `vulnerabilityId` string, required — The identifier of the vulnerability.

## Request body

- VulnerabilityValidationResource — A vulnerability validation for a vulnerability on an asset. The validation signifies that the vulnerability has been confirmed exploitable by an external tool, such as <a target="_blank" rel="noopener noreferrer" href="https://www.metasploit.com">Metasploit</a>.
  - `date` string, date-time — The date and time the vulnerability was validated, in the ISO8601 format.
  - `id` object — The identifier of the vulnerability validation.
  - `links` Link[], required — Hypermedia links to corresponding or related resources.
    - `deprecation` string
    - `href` string — A hypertext reference, which is either a URI (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc3986">RFC 3986</a>) or URI template (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc6570">RFC 6570</a>).
    - `hreflang` string
    - `media` string
    - `rel` string — The link relation type. This value is one from the <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc5988#section-6.2">Link Relation Type Registry</a> or is the type of resource being linked to.
    - `title` string
    - `type` string
  - `source` VulnerabilityValidationSource — The source used to validate the vulnerability.
    - `key` string — The identifier or name of the exploit that was used to validate the vulnerability.
    - `name` 'metasploit' | 'other' — The name of the source used to validate the vulnerability.

## Response `200`

OK

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `500` — Internal Server Error
- `503` — Service Unavailable

---

[API](https://skmtc.net/rapid7/apis/rapid7-vm-api.md) · [All operations](https://skmtc.net/rapid7/apis/rapid7-vm-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/rapid7/rapid7-vm-api/versions/3a8197c22d71/schema)