---
title: "Get vulnerability by ID"
method: GET
path: "/vulnerabilities/{vulnerabilityId}"
tags: ["Vulnerabilities"]
---

# Get vulnerability by ID

`GET /vulnerabilities/{vulnerabilityId}`

Gets a vulnerability by an ID.

## Path parameters

- `vulnerabilityId` string, required

## Response `200`

Ok

- Vulnerability
  - `id` string, required — Unique identifier for the vulnerability.
  - `name` string, required — Display name of the vulnerability.
  - `description` string, required — Description of the vulnerability.
  - `integrationId` string, required — Integration that the vulnerability is scanned by.
  - `packageIdentifier` string, nullable, required — Identifier for the package that the vulnerability is found on. Only relevant to vulnerabilities of type COMMON or GROUPED.
  - `vulnerabilityType` 'CONFIGURATION' | 'COMMON' | 'GROUPED', required
  - `targetId` string, required — Unique identifier for the underlying resource that the vulnerability is found on.
  - `firstDetectedDate` string, date-time, required — Date when the vulnerability was first detected by Vanta.
  - `sourceDetectedDate` string, date-time, nullable, required — Date when the vulnerability was first detected by the source.
  - `lastDetectedDate` string, date-time, nullable, required — Date when the vulnerability was last detected.
  - `severity` 'CRITICAL' | 'HIGH' | 'LOW' | 'MEDIUM', required
  - `cvssSeverityScore` number, double, nullable, required — CVSS severity score of the vulnerability.
  - `scannerScore` number, double, nullable, required — Scanner score of the vulnerability.
  - `isFixable` boolean, required — Whether the vulnerability is fixable.
  - `remediateByDate` string, date-time, nullable, required — Date when the vulnerability should be remediated by.
  - `relatedVulns` string[], required — Related vulnerabilities. Only relevant to vulnerabilities of type GROUPED.
  - `relatedUrls` string[], required — Related URLs.
  - `externalURL` string, required — External URL for the vulnerability.
  - `scanSource` string — Scanning tool that detected the vulnerability
  - `deactivateMetadata` object, nullable, required — Metadata for the deactivation of the vulnerability.
    - `isVulnDeactivatedIndefinitely` boolean, required — Whether the vulnerability is deactivated indefinitely.
    - `deactivatedUntilDate` string, date-time, nullable, required — Date when the vulnerability will be reactivated.
    - `deactivationReason` string, required — Reason for deactivating the vulnerability.
    - `deactivatedOnDate` string, date-time, required — Date when the vulnerability was deactivated.
    - `deactivatedBy` string, required — Identifier of the user who deactivated the vulnerability.
  - `fixedVersion` string, nullable, required — Package version that remediates the vulnerability when reported by the scanner. Null when unknown or not applicable.
  - `externalId` string, nullable, required — Identifier for the affected asset in the source system that detected the vulnerability.

---

[API](https://skmtc.net/vanta/apis/build-integrations.md) · [All operations](https://skmtc.net/vanta/apis/build-integrations/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vanta/build-integrations/revisions/6c1f7590538b/schema)