v1

latestOpenAPI 3.0.1Vanta Terms of Service2026-07-26327517821.8 KB

Vulnerabilities

Get vulnerability by ID

Gets a vulnerability by an ID.

get/vulnerabilities/{vulnerabilityId}

vulnerabilityIdstring required

idstring required

Unique identifier for the vulnerability.

namestring required

Display name of the vulnerability.

descriptionstring required

Description of the vulnerability.

integrationIdstring required

Integration that the vulnerability is scanned by.

packageIdentifierstring nullable required

Identifier for the package that the vulnerability is found on. Only relevant to vulnerabilities of type COMMON or GROUPED.

vulnerabilityType'CONFIGURATION' | 'COMMON' | 'GROUPED' required

targetIdstring required

Unique identifier for the underlying resource that the vulnerability is found on.

firstDetectedDatestring date-time required

Date when the vulnerability was first detected by Vanta.

sourceDetectedDatestring date-time nullable required

Date when the vulnerability was first detected by the source.

lastDetectedDatestring date-time nullable required

Date when the vulnerability was last detected.

severity'CRITICAL' | 'HIGH' | 'LOW' | 'MEDIUM' required

cvssSeverityScorenumber double nullable required

CVSS severity score of the vulnerability.

scannerScorenumber double nullable required

Scanner score of the vulnerability.

isFixableboolean required

Whether the vulnerability is fixable.

remediateByDatestring date-time nullable required

Date when the vulnerability should be remediated by.

relatedVulnsstring[] required

Related vulnerabilities. Only relevant to vulnerabilities of type GROUPED.

relatedUrlsstring[] required

Related URLs.

externalURLstring required

External URL for the vulnerability.

scanSourcestring

Scanning tool that detected the vulnerability

fixedVersionstring nullable required

Package version that remediates the vulnerability when reported by the scanner. Null when unknown or not applicable.

externalIdstring nullable required

Identifier for the affected asset in the source system that detected the vulnerability.