Get vulnerability
curl --request GET \
--url https://app.cysmiq.com/api/v1/{tenant_slug}/vulnerabilities/{vulnerability} \
--header 'Authorization: Bearer <token>'import requests
url = "https://app.cysmiq.com/api/v1/{tenant_slug}/vulnerabilities/{vulnerability}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://app.cysmiq.com/api/v1/{tenant_slug}/vulnerabilities/{vulnerability}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"vulnerability": {
"id": "vc_01hxyz",
"title": "Prototype Pollution in lodash",
"severity": "high",
"type": "dependency",
"source": "current",
"status": "open",
"resolution": null,
"confirmed": true,
"triaged": false,
"introduced_at": "2026-01-10T09:14:00Z",
"vulnerable_at": "2026-01-10T09:14:00Z",
"exploitable_at": null,
"human_escalation_required_at": null,
"fixed_at": null,
"resolved_at": null,
"created_at": "2026-01-10T09:14:00Z",
"updated_at": "2026-01-12T11:02:00Z",
"cwes": [
{
"id": "cwe_79",
"cwe_id": "CWE-79",
"name": "Cross-site Scripting"
}
]
},
"repository": {
"id": "repo_01hxyz",
"name": "widgets",
"full_name": "acme/widgets"
},
"lifecycle": {
"first_seen_scan": {
"id": "scan_01hxyz",
"status": "completed",
"ref": "main",
"sha": "a1b2c3d4",
"finished_at": "2026-01-14T17:45:00Z",
"started_at": "2026-01-14T17:40:00Z"
},
"fixed_scan": null
},
"locations": {
"display": {
"id": "loc_01hxyz",
"path": "package-lock.json",
"line": 142,
"fixed_at": null,
"vulnerable_at": "2026-01-10T09:14:00Z",
"exploitable_at": null,
"is_vulnerable": true,
"is_exploitable": false,
"reference": {
"id": "ref_01hxyz",
"ref": "main",
"sha": "a1b2c3d4",
"type": "branch"
},
"artifact": {
"id": "dep_01hxyz",
"type": "dependency"
}
},
"summary": {
"total": 1,
"active": 1,
"fixed": 0,
"has_exploitable": false
}
},
"details": {
"type": "dependency",
"package": {
"id": "pkg_01hxyz",
"purl": "pkg:npm/lodash@4.17.20",
"type": "npm",
"namespace": null,
"name": "lodash",
"version": "4.17.20",
"repository_url": "https://github.com/lodash/lodash"
},
"identifiers": {
"ghsa": "GHSA-xxxx-xxxx-xxxx",
"cve": "CVE-2021-0000"
}
}
}Vulnerabilities
Get vulnerability
Returns detailed vulnerability context, with optional includes for locations, advisories, secrets, call hierarchies, impacts, and source snippets. Snippets are only returned when explicitly requested via include=snippet.
GET
/
{tenant_slug}
/
vulnerabilities
/
{vulnerability}
Get vulnerability
curl --request GET \
--url https://app.cysmiq.com/api/v1/{tenant_slug}/vulnerabilities/{vulnerability} \
--header 'Authorization: Bearer <token>'import requests
url = "https://app.cysmiq.com/api/v1/{tenant_slug}/vulnerabilities/{vulnerability}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://app.cysmiq.com/api/v1/{tenant_slug}/vulnerabilities/{vulnerability}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"vulnerability": {
"id": "vc_01hxyz",
"title": "Prototype Pollution in lodash",
"severity": "high",
"type": "dependency",
"source": "current",
"status": "open",
"resolution": null,
"confirmed": true,
"triaged": false,
"introduced_at": "2026-01-10T09:14:00Z",
"vulnerable_at": "2026-01-10T09:14:00Z",
"exploitable_at": null,
"human_escalation_required_at": null,
"fixed_at": null,
"resolved_at": null,
"created_at": "2026-01-10T09:14:00Z",
"updated_at": "2026-01-12T11:02:00Z",
"cwes": [
{
"id": "cwe_79",
"cwe_id": "CWE-79",
"name": "Cross-site Scripting"
}
]
},
"repository": {
"id": "repo_01hxyz",
"name": "widgets",
"full_name": "acme/widgets"
},
"lifecycle": {
"first_seen_scan": {
"id": "scan_01hxyz",
"status": "completed",
"ref": "main",
"sha": "a1b2c3d4",
"finished_at": "2026-01-14T17:45:00Z",
"started_at": "2026-01-14T17:40:00Z"
},
"fixed_scan": null
},
"locations": {
"display": {
"id": "loc_01hxyz",
"path": "package-lock.json",
"line": 142,
"fixed_at": null,
"vulnerable_at": "2026-01-10T09:14:00Z",
"exploitable_at": null,
"is_vulnerable": true,
"is_exploitable": false,
"reference": {
"id": "ref_01hxyz",
"ref": "main",
"sha": "a1b2c3d4",
"type": "branch"
},
"artifact": {
"id": "dep_01hxyz",
"type": "dependency"
}
},
"summary": {
"total": 1,
"active": 1,
"fixed": 0,
"has_exploitable": false
}
},
"details": {
"type": "dependency",
"package": {
"id": "pkg_01hxyz",
"purl": "pkg:npm/lodash@4.17.20",
"type": "npm",
"namespace": null,
"name": "lodash",
"version": "4.17.20",
"repository_url": "https://github.com/lodash/lodash"
},
"identifiers": {
"ghsa": "GHSA-xxxx-xxxx-xxxx",
"cve": "CVE-2021-0000"
}
}
}Authorizations
Use a Cysmiq API token in the Authorization header: Bearer {token}.
Path Parameters
Vulnerability prefixed id (vc_...).
Query Parameters
Maximum string length:
255Maximum string length:
500Required range:
1 <= x <= 200Available options:
live, all Response
Vulnerability detail response.
Vulnerability detail. The set of present fields depends on the requested fields projection (default returns the full set below).
Show child attributes
Show child attributes
Show child attributes
Show child attributes
Show child attributes
Show child attributes
Always includes display + summary. items/limit/truncated are only present when the request was made with include=locations.
Show child attributes
Show child attributes
Type-discriminated detail block. Concrete fields depend on vulnerability.type (dependency vs secret vs code). Call hierarchy details include metadata, data-flow references, and analysis only; source snippets are not returned.
Show child attributes
Show child attributes
Was this page helpful?