Get vulnerability

curl --request GET \
  --url https://app.cysmiq.com/api/v1/{tenant_slug}/vulnerabilities/{vulnerability} \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://app.cysmiq.com/api/v1/{tenant_slug}/vulnerabilities/{vulnerability}"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://app.cysmiq.com/api/v1/{tenant_slug}/vulnerabilities/{vulnerability}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

{
  "vulnerability": {
    "id": "vc_01hxyz",
    "title": "Prototype Pollution in lodash",
    "severity": "high",
    "type": "dependency",
    "source": "current",
    "status": "open",
    "resolution": null,
    "confirmed": true,
    "triaged": false,
    "introduced_at": "2026-01-10T09:14:00Z",
    "vulnerable_at": "2026-01-10T09:14:00Z",
    "exploitable_at": null,
    "human_escalation_required_at": null,
    "fixed_at": null,
    "resolved_at": null,
    "created_at": "2026-01-10T09:14:00Z",
    "updated_at": "2026-01-12T11:02:00Z",
    "cwes": [
      {
        "id": "cwe_79",
        "cwe_id": "CWE-79",
        "name": "Cross-site Scripting"
      }
    ]
  },
  "repository": {
    "id": "repo_01hxyz",
    "name": "widgets",
    "full_name": "acme/widgets"
  },
  "lifecycle": {
    "first_seen_scan": {
      "id": "scan_01hxyz",
      "status": "completed",
      "ref": "main",
      "sha": "a1b2c3d4",
      "finished_at": "2026-01-14T17:45:00Z",
      "started_at": "2026-01-14T17:40:00Z"
    },
    "fixed_scan": null
  },
  "locations": {
    "display": {
      "id": "loc_01hxyz",
      "path": "package-lock.json",
      "line": 142,
      "fixed_at": null,
      "vulnerable_at": "2026-01-10T09:14:00Z",
      "exploitable_at": null,
      "is_vulnerable": true,
      "is_exploitable": false,
      "reference": {
        "id": "ref_01hxyz",
        "ref": "main",
        "sha": "a1b2c3d4",
        "type": "branch"
      },
      "artifact": {
        "id": "dep_01hxyz",
        "type": "dependency"
      }
    },
    "summary": {
      "total": 1,
      "active": 1,
      "fixed": 0,
      "has_exploitable": false
    }
  },
  "details": {
    "type": "dependency",
    "package": {
      "id": "pkg_01hxyz",
      "purl": "pkg:npm/lodash@4.17.20",
      "type": "npm",
      "namespace": null,
      "name": "lodash",
      "version": "4.17.20",
      "repository_url": "https://github.com/lodash/lodash"
    },
    "identifiers": {
      "ghsa": "GHSA-xxxx-xxxx-xxxx",
      "cve": "CVE-2021-0000"
    }
  }
}

GET

{tenant_slug}

vulnerabilities

{vulnerability}

Get vulnerability

curl --request GET \
  --url https://app.cysmiq.com/api/v1/{tenant_slug}/vulnerabilities/{vulnerability} \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://app.cysmiq.com/api/v1/{tenant_slug}/vulnerabilities/{vulnerability}"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://app.cysmiq.com/api/v1/{tenant_slug}/vulnerabilities/{vulnerability}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

{
  "vulnerability": {
    "id": "vc_01hxyz",
    "title": "Prototype Pollution in lodash",
    "severity": "high",
    "type": "dependency",
    "source": "current",
    "status": "open",
    "resolution": null,
    "confirmed": true,
    "triaged": false,
    "introduced_at": "2026-01-10T09:14:00Z",
    "vulnerable_at": "2026-01-10T09:14:00Z",
    "exploitable_at": null,
    "human_escalation_required_at": null,
    "fixed_at": null,
    "resolved_at": null,
    "created_at": "2026-01-10T09:14:00Z",
    "updated_at": "2026-01-12T11:02:00Z",
    "cwes": [
      {
        "id": "cwe_79",
        "cwe_id": "CWE-79",
        "name": "Cross-site Scripting"
      }
    ]
  },
  "repository": {
    "id": "repo_01hxyz",
    "name": "widgets",
    "full_name": "acme/widgets"
  },
  "lifecycle": {
    "first_seen_scan": {
      "id": "scan_01hxyz",
      "status": "completed",
      "ref": "main",
      "sha": "a1b2c3d4",
      "finished_at": "2026-01-14T17:45:00Z",
      "started_at": "2026-01-14T17:40:00Z"
    },
    "fixed_scan": null
  },
  "locations": {
    "display": {
      "id": "loc_01hxyz",
      "path": "package-lock.json",
      "line": 142,
      "fixed_at": null,
      "vulnerable_at": "2026-01-10T09:14:00Z",
      "exploitable_at": null,
      "is_vulnerable": true,
      "is_exploitable": false,
      "reference": {
        "id": "ref_01hxyz",
        "ref": "main",
        "sha": "a1b2c3d4",
        "type": "branch"
      },
      "artifact": {
        "id": "dep_01hxyz",
        "type": "dependency"
      }
    },
    "summary": {
      "total": 1,
      "active": 1,
      "fixed": 0,
      "has_exploitable": false
    }
  },
  "details": {
    "type": "dependency",
    "package": {
      "id": "pkg_01hxyz",
      "purl": "pkg:npm/lodash@4.17.20",
      "type": "npm",
      "namespace": null,
      "name": "lodash",
      "version": "4.17.20",
      "repository_url": "https://github.com/lodash/lodash"
    },
    "identifiers": {
      "ghsa": "GHSA-xxxx-xxxx-xxxx",
      "cve": "CVE-2021-0000"
    }
  }
}

Authorizations

Authorization

string

header

required

Use a Cysmiq API token in the Authorization header: Bearer {token}.

Path Parameters

vulnerability

string

required

Vulnerability prefixed id (vc_...).

Query Parameters

include

string | null

Maximum string length: 255

fields

string | null

Maximum string length: 500

locations_limit

integer | null

Required range: 1 <= x <= 200

locations_scope

enum<string> | null

Available options:

live,

all

Response

Vulnerability detail response.

vulnerability

object

required

Vulnerability detail. The set of present fields depends on the requested fields projection (default returns the full set below).

Show child attributes

repository

object | null

required

Show child attributes

lifecycle

object | null

required

Show child attributes

locations

object

required

Always includes display + summary. items/limit/truncated are only present when the request was made with include=locations.

Show child attributes

details

object

required

Type-discriminated detail block. Concrete fields depend on vulnerability.type (dependency vs secret vs code). Call hierarchy details include metadata, data-flow references, and analysis only; source snippets are not returned.

Show child attributes

Overview

Endpoints

Get vulnerability

Authorizations

Path Parameters

Query Parameters

Response