---
title: "List assets associated with vulnerabilities"
method: GET
path: "/audits/{auditId}/vulnerable-assets"
tags: ["Audits"]
deprecated: true
---

# List assets associated with vulnerabilities

`GET /audits/{auditId}/vulnerable-assets`

> **Deprecated.**

List assets that Vanta monitors that are associated with vulnerabilities.

End of life — this endpoint works for classic audits only; it does not support
controlled audit view. It remains available for existing classic audits but will be removed once
classic audits are fully phased out, so do not build new integrations on it.

Rate limit: 10 requests / minute.

## Path parameters

- `auditId` string, required

## Query parameters

- `query` string
- `pageSize` integer — Controls the maximum number of items returned in one response from the API.
- `pageCursor` string — A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset. Note that the requested page will not include the item that corresponds to this cursor but will start from the one immediately after this cursor.
- `integrationId` string
- `assetType` 'SERVER' | 'SERVERLESS_FUNCTION' | 'CONTAINER' | 'CONTAINER_REPOSITORY' | 'CONTAINER_REPOSITORY_IMAGE' | 'CODE_REPOSITORY' | 'MANIFEST_FILE' | 'WORKSTATION' | 'OTHER' — VulnerableAssetType describes the types of assets a vulnerability is on.
- `assetExternalAccountId` string

## Response `200`

Ok

- PaginatedResponseVulnerableAsset
  - `results` object, required
    - `data` VulnerableAsset[], required
      - `id` string, required — Unique identifier for the vulnerable asset.
      - `name` string, required — Display name of the vulnerable asset.
      - `assetType` 'SERVER' | 'SERVERLESS_FUNCTION' | 'CONTAINER' | 'CONTAINER_REPOSITORY' | 'CONTAINER_REPOSITORY_IMAGE' | 'CODE_REPOSITORY' | 'MANIFEST_FILE' | 'WORKSTATION' | 'OTHER', required — VulnerableAssetType describes the types of assets a vulnerability is on.
      - `hasBeenScanned` boolean, required — Whether the vulnerable asset has been scanned.
      - `imageScanTag` string, nullable, required — Only relevant for container repositories. This field sets the container image tag that vulnerabilities will be retrieved for. If null, the latest image will be retrieved.
      - `scanners` VulnerableAssetScanner[], required — The integrations that are scanning this vulnerable asset.
        - `resourceId` string, required — The scanned asset's Vanta resource id.
        - `integrationId` string, required — Integration that the the vulnerable asset is scanned by.
        - `imageDigest` string, nullable, required — Digest of the scanned container image.
        - `imagePushedAtDate` string, date-time, nullable, required — Push date of the scanned container image.
        - `imageTags` string[], nullable, required — Tags of the scanned container image.
        - `assetTags` KeyValuePair[], nullable, required — Tags of the scanned asset.
          - `key` string, required — Key of key-value pair.
          - `value` string, required — Value of key-value pair.
        - `parentAccountOrOrganization` string, nullable, required — The parent account or organization of the scanned asset.
        - `biosUuid` string, nullable, required — BIOS UUID of the scanned asset.
        - `ipv4s` string[], nullable, required — IPV4s of the scanned asset.
        - `ipv6s` string[], nullable, required — IPV6s of the scanned asset.
        - `macAddresses` string[], nullable, required — Mac addresses of the scanned asset.
        - `hostnames` string[], nullable, required — Host names of the scanned asset.
        - `fqdns` string[], nullable, required — fqdns of the scanned asset.
        - `operatingSystems` string[], nullable, required — Operating systems of the scanned asset.
        - `targetId` string, nullable, required — The asset's identifier code.
    - `pageInfo` PageInfo, required — Provides information about the pagination of a dataset.
      - `endCursor` string, nullable, required — The cursor that points to the end of the current page, or null if there is no such cursor.
      - `hasNextPage` boolean, required — Indicates if there is another page after the current page.
      - `hasPreviousPage` boolean, required — Indicates if there is a page before the current page.
      - `startCursor` string, nullable, required — The cursor that points to the start of the current page, or null if there is no such cursor.

---

[API](https://skmtc.net/vanta/apis/build-integrations.md) · [All operations](https://skmtc.net/vanta/apis/build-integrations/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vanta/build-integrations/revisions/6c1f7590538b/schema)