Get Vulnerabilities

get

https://{hostname}/api/v2/vulnerabilities/

This endpoint retrieves a list of vulnerabilities from the Kondukto. It supports pagination and various filters to streamline the search and retrieval of vulnerability data. Clients can specify parameters to filter results based on severity, branch, type, status, and other relevant criteria.

Query Params

limit

int32

Defaults to 30

The maximum number of vulnerabilities to return per request. Default is 30. Max. value can be 30.

start

int32

Defaults to 0

The starting index of the vulnerabilities list. Default is 0.

woe

string

Defaults to eq:15

Filters vulnerabilities by their window of exposure. Acceptable operators are eq, gt, and lt, followed by the number of days (e.g., woe=eq:15, woe=gt:4, woe=lt:3).

branch

string

Performs a search on the branch names of the application's source code. Entering a partial string will return all branches containing that substring.

type

string

Specifies the type of scan, such as "sast", "dast", "sca", "cs", "infra", etc.

boolean

Filters out vulnerabilities when set to "false" or includes only fp when set to "true".

cvss

float

Filters vulnerabilities based on the CVSS v3 score.

path

string

Filters vulnerabilities based on the path or target URL. Entering a partial string will return all vulnerabilities associated with matching paths or URLs.

status

string

Filters vulnerabilities by their status. Possible values are "new", "recurrent", and "closed". Multiple statuses can be specified, separated by commas (e.g., status=new,recurrent).

cwe_name

string

Filters vulnerabilities based on the name of the CWE. Entering a partial string will return all vulnerabilities associated with matching CWE names.

cwe_no

int32

Filters vulnerabilities based on CWE numbers. Multiple CWE numbers can be specified, separated by commas (e.g., cwe_no=79,89,20).

tool_name

string

Filters vulnerabilities by the exact name of the tool that identified them. This parameter requires an exact match. If no alphanumeric value is entered, this parameter will not work.

issue_status

string

Filters vulnerabilities based on the status of any associated issue. This parameter requires an exact match and can take values like "open", "closed".

committers

string

Filters vulnerabilities based on the email of committers. This is a searchable parameter that accepts multiple values. Each value can be a part of the full string, separated by commas (e.g., committers=[email protected], appsec_user)

from

date

Filters vulnerabilities based on the date and time they were first seen, starting from the specified ISO 8601 date (e.g., 2024-05-08T12:20:57.588Z).

date

Filters vulnerabilities based on the date and time they were first seen, up to the specified ISO 8601 date (e.g., 2024-05-08T12:20:57.588Z).

boolean

Filters out vulnerabilities marked as true positives when set to "false" or includes only true positives when set to "true".

string

Filters vulnerabilities by their unique identification number. This parameter allows for direct access to specific vulnerability.

teams

array of strings

Filters vulnerabilities based on the names of teams the vulnerabilities. Multiple team names can be specified, separated by commas (e.g., teams=security,development).

teams

vuln_name

string

Filters vulnerabilities based on their name. This is a searchable parameter that supports partial matching. Entering a partial name will return all vulnerabilities containing that substring.

project_name

string

Filters vulnerabilities based on the name of the project. This is a searchable parameter that supports partial matching. Entering a partial project name will return all vulnerabilities containing that substring.

product_name

string

Filters vulnerabilities by the exact name of the product that identified them. This parameter requires an exact match.

team_ids

array of strings

Filters vulnerabilities based on the identifiers of the teams involved. Multiple team IDs can be specified, separated by commas (e.g., team_ids=661e36fbb3bdf42202f9eb12,65a78ae2710eb82e835b78c8).

team_ids

label_ids

array of strings

Filters vulnerabilities based on the identifiers of the labels involved. Multiple label IDs can be specified, separated by commas (e.g., label_ids=661e36fbb3bdf42202f9eb12,65a78ae2710eb82e835b78c8).

label_ids

severity

array of int32s

Filters vulnerabilities by specified severity levels. Multiple severities can be specified, separated by commas (e.g., severity=1,2).

severity

labels

array of strings

Filters vulnerabilities based on the names of the labels involved. Multiple labels can be specified, separated by commas (e.g., labels=appsec,infrasecurity).

labels

overdue

boolean

Filters out vulnerabilities when set to "false" or includes only overdue when set to "true".

boolean

Filters out vulnerabilities when set to "false" or includes only Won't Fix when set to "true".

mitigated

boolean

Filters out vulnerabilities when set to "false" or includes only Mitigated when set to "true".

Headers

X-Cookie

string

required

Personal Access Token

Responses

200200

401401