List vulnerabilities
curl --request GET \
--url https://app.cysmiq.com/api/v1/{tenant_slug}/vulnerabilities \
--header 'Authorization: Bearer <token>'import requests
url = "https://app.cysmiq.com/api/v1/{tenant_slug}/vulnerabilities"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://app.cysmiq.com/api/v1/{tenant_slug}/vulnerabilities', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"filters": {
"repo": "acme/widgets",
"ref": "main",
"sha": null,
"confirmed": true,
"triaged": null,
"state": null,
"source": null,
"assignee": null,
"sort": null,
"severity": [
"high"
],
"type": [
"dependency"
]
},
"summary": {
"total": 2,
"by_severity": {
"high": 2
},
"by_type": {
"dependency": 2
}
},
"items": [
{
"id": "vc_01hxyz",
"title": "Prototype Pollution in lodash",
"repository": {
"id": "repo_01hxyz",
"name": "widgets",
"full_name": "acme/widgets"
},
"severity": "high",
"type": "dependency",
"source": "current",
"status": "open",
"resolution": null,
"confirmed": true,
"triaged": false,
"introduced_at": "2026-01-10T09:14:00Z",
"vulnerable_at": "2026-01-10T09:14:00Z",
"exploitable_at": null,
"location": {
"id": "loc_01hxyz",
"path": "package-lock.json",
"line": 142,
"fixed_at": null,
"vulnerable_at": "2026-01-10T09:14:00Z",
"exploitable_at": null,
"is_vulnerable": true,
"is_exploitable": false,
"reference": {
"id": "ref_01hxyz",
"ref": "main",
"sha": "a1b2c3d4",
"type": "branch"
}
}
}
],
"next_cursor": null
}
Vulnerabilities
List vulnerabilities
Returns vulnerabilities with optional filters for repository, ref, sha, state, source, confirmation, triage status, severity, type, and assignee. Without filters the response includes vulnerabilities of every state (open, fixed, accepted, ignored, rejected) — pass state to scope to one workflow bucket.
GET
/
{tenant_slug}
/
vulnerabilities
List vulnerabilities
curl --request GET \
--url https://app.cysmiq.com/api/v1/{tenant_slug}/vulnerabilities \
--header 'Authorization: Bearer <token>'import requests
url = "https://app.cysmiq.com/api/v1/{tenant_slug}/vulnerabilities"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://app.cysmiq.com/api/v1/{tenant_slug}/vulnerabilities', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"filters": {
"repo": "acme/widgets",
"ref": "main",
"sha": null,
"confirmed": true,
"triaged": null,
"state": null,
"source": null,
"assignee": null,
"sort": null,
"severity": [
"high"
],
"type": [
"dependency"
]
},
"summary": {
"total": 2,
"by_severity": {
"high": 2
},
"by_type": {
"dependency": 2
}
},
"items": [
{
"id": "vc_01hxyz",
"title": "Prototype Pollution in lodash",
"repository": {
"id": "repo_01hxyz",
"name": "widgets",
"full_name": "acme/widgets"
},
"severity": "high",
"type": "dependency",
"source": "current",
"status": "open",
"resolution": null,
"confirmed": true,
"triaged": false,
"introduced_at": "2026-01-10T09:14:00Z",
"vulnerable_at": "2026-01-10T09:14:00Z",
"exploitable_at": null,
"location": {
"id": "loc_01hxyz",
"path": "package-lock.json",
"line": 142,
"fixed_at": null,
"vulnerable_at": "2026-01-10T09:14:00Z",
"exploitable_at": null,
"is_vulnerable": true,
"is_exploitable": false,
"reference": {
"id": "ref_01hxyz",
"ref": "main",
"sha": "a1b2c3d4",
"type": "branch"
}
}
}
],
"next_cursor": null
}
Authorizations
Use a Cysmiq API token in the Authorization header: Bearer {token}.
Path Parameters
Workspace slug for the tenant context.
Query Parameters
Maximum string length:
255Maximum string length:
255Maximum string length:
255Pattern:
^[0-9a-fA-F]{7,40}$Available options:
yes, no Available options:
open, fixed, accepted, ignored, rejected Available options:
current, git_history Maximum string length:
255Maximum string length:
255Maximum string length:
255Maximum string length:
500Available options:
severity, newest, oldest Required range:
1 <= x <= 200Was this page helpful?