---
title: "List vulnerabilities within the scope of a given audit"
method: GET
path: "/audits/{auditId}/vulnerabilities"
tags: ["Audits"]
deprecated: true
---

# List vulnerabilities within the scope of a given audit

`GET /audits/{auditId}/vulnerabilities`

> **Deprecated.**

List all vulnerabilities based on selected filters.

End of life — this endpoint works for classic audits only; it does not support
controlled audit view. It remains available for existing classic audits but will be removed once
classic audits are fully phased out, so do not build new integrations on it.

Rate limit: 10 requests / minute.

## Path parameters

- `auditId` string, required

## Query parameters

- `query` string
- `pageSize` integer — Controls the maximum number of items returned in one response from the API.
- `pageCursor` string — A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset. Note that the requested page will not include the item that corresponds to this cursor but will start from the one immediately after this cursor.
- `isDeactivated` boolean
- `externalVulnerabilityId` string
- `isFixAvailable` boolean
- `packageIdentifier` string
- `slaDeadlineAfterDate` string, date-time
- `slaDeadlineBeforeDate` string, date-time
- `severity` 'CRITICAL' | 'HIGH' | 'LOW' | 'MEDIUM' — ExternalFindingSeverity describes the severity of an external finding (Vulnerability or Security Alert)
- `integrationId` string
- `includeVulnerabilitiesWithoutSlas` boolean
- `vulnerableAssetId` string

## Response `200`

Ok

- PaginatedResponseAuditorApiVulnerability
  - `results` object, required
    - `data` AuditorApiVulnerability[], required
      - `id` string, required — Unique identifier for the vulnerability.
      - `name` string, required — Display name of the vulnerability.
      - `description` string, required — Description of the vulnerability.
      - `integrationId` string, required — Integration that the vulnerability is scanned by.
      - `packageIdentifier` string, nullable, required — Identifier for the package that the vulnerability is found on. Only relevant to vulnerabilities of type COMMON or GROUPED.
      - `vulnerabilityType` 'CONFIGURATION' | 'COMMON' | 'GROUPED', required
      - `targetId` string, required — Unique identifier for the underlying resource that the vulnerability is found on.
      - `firstDetectedDate` string, date-time, required — Date when the vulnerability was first detected by Vanta.
      - `sourceDetectedDate` string, date-time, nullable, required — Date when the vulnerability was first detected by the source.
      - `lastDetectedDate` string, date-time, nullable, required — Date when the vulnerability was last detected.
      - `severity` 'CRITICAL' | 'HIGH' | 'LOW' | 'MEDIUM', required
      - `cvssSeverityScore` number, double, nullable, required — CVSS severity score of the vulnerability.
      - `scannerScore` number, double, nullable, required — Scanner score of the vulnerability.
      - `isFixable` boolean, required — Whether the vulnerability is fixable.
      - `remediateByDate` string, date-time, nullable, required — Date when the vulnerability should be remediated by.
      - `relatedVulns` string[], required — Related vulnerabilities. Only relevant to vulnerabilities of type GROUPED.
      - `relatedUrls` string[], required — Related URLs.
      - `externalURL` string, required — External URL for the vulnerability.
      - `scanSource` string — Scanning tool that detected the vulnerability
      - `deactivateMetadata` object, nullable, required — Metadata for the deactivation of the vulnerability.
        - `isVulnDeactivatedIndefinitely` boolean, required — Whether the vulnerability is deactivated indefinitely.
        - `deactivatedUntilDate` string, date-time, nullable, required — Date when the vulnerability will be reactivated.
        - `deactivationReason` string, required — Reason for deactivating the vulnerability.
        - `deactivatedOnDate` string, date-time, required — Date when the vulnerability was deactivated.
        - `deactivatedBy` string, required — Identifier of the user who deactivated the vulnerability.
    - `pageInfo` PageInfo, required — Provides information about the pagination of a dataset.
      - `endCursor` string, nullable, required — The cursor that points to the end of the current page, or null if there is no such cursor.
      - `hasNextPage` boolean, required — Indicates if there is another page after the current page.
      - `hasPreviousPage` boolean, required — Indicates if there is a page before the current page.
      - `startCursor` string, nullable, required — The cursor that points to the start of the current page, or null if there is no such cursor.

---

[API](https://skmtc.net/vanta/apis/build-integrations.md) · [All operations](https://skmtc.net/vanta/apis/build-integrations/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vanta/build-integrations/versions/6c1f7590538b/schema)