---
title: "Get vulnerabilities"
method: GET
path: "/vulnerabilities"
tags: ["Vulnerabilities"]
---

# Get vulnerabilities

`GET /vulnerabilities`

List all vulnerabilities based on selected filters.

## Query parameters

- `q` string
- `pageSize` integer — Controls the maximum number of items returned in one response from the API.
- `pageCursor` string — A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset. Note that the requested page will not include the item that corresponds to this cursor but will start from the one immediately after this cursor.
- `isDeactivated` boolean
- `externalVulnerabilityId` string
- `isFixAvailable` boolean
- `packageIdentifier` string
- `slaDeadlineAfterDate` string, date-time
- `slaDeadlineBeforeDate` string, date-time
- `severity` 'CRITICAL' | 'HIGH' | 'LOW' | 'MEDIUM' — ExternalFindingSeverity describes the severity of an external finding (Vulnerability or Security Alert)
- `integrationId` string
- `includeVulnerabilitiesWithoutSlas` boolean
- `vulnerableAssetId` string

## Response `200`

Ok

- PaginatedResponseVulnerability
  - `results` object, required
    - `data` Vulnerability[], required
      - `id` string, required — Unique identifier for the vulnerability.
      - `name` string, required — Display name of the vulnerability.
      - `description` string, required — Description of the vulnerability.
      - `integrationId` string, required — Integration that the vulnerability is scanned by.
      - `packageIdentifier` string, nullable, required — Identifier for the package that the vulnerability is found on. Only relevant to vulnerabilities of type COMMON or GROUPED.
      - `vulnerabilityType` 'CONFIGURATION' | 'COMMON' | 'GROUPED', required
      - `targetId` string, required — Unique identifier for the underlying resource that the vulnerability is found on.
      - `firstDetectedDate` string, date-time, required — Date when the vulnerability was first detected by Vanta.
      - `sourceDetectedDate` string, date-time, nullable, required — Date when the vulnerability was first detected by the source.
      - `lastDetectedDate` string, date-time, nullable, required — Date when the vulnerability was last detected.
      - `severity` 'CRITICAL' | 'HIGH' | 'LOW' | 'MEDIUM', required
      - `cvssSeverityScore` number, double, nullable, required — CVSS severity score of the vulnerability.
      - `scannerScore` number, double, nullable, required — Scanner score of the vulnerability.
      - `isFixable` boolean, required — Whether the vulnerability is fixable.
      - `remediateByDate` string, date-time, nullable, required — Date when the vulnerability should be remediated by.
      - `relatedVulns` string[], required — Related vulnerabilities. Only relevant to vulnerabilities of type GROUPED.
      - `relatedUrls` string[], required — Related URLs.
      - `externalURL` string, required — External URL for the vulnerability.
      - `scanSource` string — Scanning tool that detected the vulnerability
      - `deactivateMetadata` object, nullable, required — Metadata for the deactivation of the vulnerability.
        - `isVulnDeactivatedIndefinitely` boolean, required — Whether the vulnerability is deactivated indefinitely.
        - `deactivatedUntilDate` string, date-time, nullable, required — Date when the vulnerability will be reactivated.
        - `deactivationReason` string, required — Reason for deactivating the vulnerability.
        - `deactivatedOnDate` string, date-time, required — Date when the vulnerability was deactivated.
        - `deactivatedBy` string, required — Identifier of the user who deactivated the vulnerability.
      - `fixedVersion` string, nullable, required — Package version that remediates the vulnerability when reported by the scanner. Null when unknown or not applicable.
      - `externalId` string, nullable, required — Identifier for the affected asset in the source system that detected the vulnerability.
    - `pageInfo` PageInfo, required — Provides information about the pagination of a dataset.
      - `endCursor` string, nullable, required — The cursor that points to the end of the current page, or null if there is no such cursor.
      - `hasNextPage` boolean, required — Indicates if there is another page after the current page.
      - `hasPreviousPage` boolean, required — Indicates if there is a page before the current page.
      - `startCursor` string, nullable, required — The cursor that points to the start of the current page, or null if there is no such cursor.

---

[API](https://skmtc.net/vanta/apis/build-integrations.md) · [All operations](https://skmtc.net/vanta/apis/build-integrations/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vanta/build-integrations/revisions/6c1f7590538b/schema)