> ## Documentation Index > Fetch the complete documentation index at: https://docs.cysmiq.com/llms.txt > Use this file to discover all available pages before exploring further. # List vulnerabilities > Returns vulnerabilities with optional filters for repository, ref, sha, state, confirmation, triage status, severity, type, and assignee. Without filters the response includes vulnerabilities of every state (open, fixed, accepted, ignored, rejected) — pass `state` to scope to one workflow bucket. ## OpenAPI ````yaml https://app.cysmiq.com/docs/tenant/openapi.json get /{tenant_slug}/vulnerabilities openapi: 3.1.0 info: title: Cysmiq version: v1 description: Tenant API servers: - url: https://app.cysmiq.com/api/v1 description: Production security: - bearerAuth: [] tags: - name: Token description: Token introspection and authentication context. - name: Organizations description: Read-only organizational unit (org) data. - name: Repositories description: Read-only repository data. - name: Applications description: Read-only application data. - name: Scans description: Read-only scan status data for CI integrations. - name: Vulnerabilities description: Read-only vulnerability data for CI and reporting. - name: Policy Violations description: Read-only policy violation data for CI and reporting. paths: /{tenant_slug}/vulnerabilities: get: tags: - Vulnerabilities summary: List vulnerabilities description: >- Returns vulnerabilities with optional filters for repository, ref, sha, state, confirmation, triage status, severity, type, and assignee. Without filters the response includes vulnerabilities of every state (open, fixed, accepted, ignored, rejected) — pass `state` to scope to one workflow bucket. operationId: listVulnerabilities parameters: - name: repo in: query schema: type: - string - 'null' maxLength: 255 - name: application in: query schema: type: - string - 'null' maxLength: 255 - name: ref in: query schema: type: - string - 'null' maxLength: 255 - name: sha in: query schema: type: - string - 'null' pattern: ^[0-9a-fA-F]{7,40}$ - name: confirmed in: query schema: type: - boolean - 'null' - name: triaged in: query schema: type: - string - 'null' enum: - 'yes' - 'no' - name: state in: query schema: type: - string - 'null' enum: - open - fixed - accepted - ignored - rejected - name: assignee in: query schema: type: - string - 'null' maxLength: 255 - name: severity in: query schema: type: - string - 'null' maxLength: 255 - name: type in: query schema: type: - string - 'null' maxLength: 255 - name: fields in: query schema: type: - string - 'null' maxLength: 500 - name: sort in: query schema: type: - string - 'null' enum: - severity - newest - oldest - name: limit in: query schema: type: - integer - 'null' minimum: 1 maximum: 200 - name: cursor in: query schema: type: - string - 'null' - name: tenant_slug in: path required: true description: Workspace slug for the tenant context. schema: type: string example: acme responses: '200': description: Vulnerability list response. content: application/json: schema: type: object required: - filters - summary - items - next_cursor properties: filters: type: object required: - repo - ref - sha - confirmed - triaged - state - assignee - sort - severity - type properties: repo: type: - string - 'null' ref: type: - string - 'null' sha: type: - string - 'null' confirmed: type: boolean triaged: type: - string - 'null' state: type: - string - 'null' assignee: description: >- Echoed assignee filter; shape mirrors what the request supplied (string for me/email, object for resolved user, null for unfiltered). oneOf: - type: 'null' - type: string - type: object additionalProperties: true sort: type: - string - 'null' enum: - severity - newest - oldest - null severity: type: array items: type: string type: type: array items: type: string summary: type: object required: - total - by_severity - by_type properties: total: type: integer minimum: 0 by_severity: type: object additionalProperties: type: integer minimum: 0 by_type: type: object additionalProperties: type: integer minimum: 0 items: type: array items: type: object additionalProperties: true properties: id: type: string title: type: string repository: type: - object - 'null' required: - id - name - full_name properties: id: type: string name: type: - string - 'null' full_name: type: - string - 'null' severity: type: string type: type: string status: type: string resolution: type: - string - 'null' state: type: string status_version: type: string confirmed: type: boolean triaged: type: boolean assignee: type: - object - 'null' additionalProperties: true properties: id: type: string display_name: type: - string - 'null' email: type: - string - 'null' introduced_at: type: - string - 'null' vulnerable_at: type: - string - 'null' exploitable_at: type: - string - 'null' location: type: - object - 'null' additionalProperties: true properties: id: type: string path: type: string line: type: - integer - 'null' fixed_at: type: - string - 'null' vulnerable_at: type: - string - 'null' exploitable_at: type: - string - 'null' is_vulnerable: type: boolean is_exploitable: type: boolean reference: type: - object - 'null' additionalProperties: true next_cursor: type: - string - 'null' example: filters: repo: acme/widgets ref: main sha: null confirmed: true triaged: null state: null assignee: null sort: null severity: - high type: - dependency summary: total: 2 by_severity: high: 2 by_type: dependency: 2 items: - id: vc_01hxyz title: Prototype Pollution in lodash repository: id: repo_01hxyz name: widgets full_name: acme/widgets severity: high type: dependency status: open resolution: null confirmed: true triaged: false introduced_at: '2026-01-10T09:14:00Z' vulnerable_at: '2026-01-10T09:14:00Z' exploitable_at: null location: id: loc_01hxyz path: package-lock.json line: 142 fixed_at: null vulnerable_at: '2026-01-10T09:14:00Z' exploitable_at: null is_vulnerable: true is_exploitable: false reference: id: ref_01hxyz ref: main sha: a1b2c3d4 type: branch next_cursor: null '401': $ref: '#/components/responses/UnauthorizedError' '403': $ref: '#/components/responses/ForbiddenError' '404': $ref: '#/components/responses/NotFoundError' '422': $ref: '#/components/responses/ValidationFailedError' '429': $ref: '#/components/responses/RateLimitedError' '500': $ref: '#/components/responses/InternalError' '503': $ref: '#/components/responses/ServiceUnavailableError' components: responses: UnauthorizedError: description: Authentication is required or the token is invalid. content: application/json: schema: $ref: '#/components/schemas/ApiError' examples: authenticationRequired: value: code: AUTHENTICATION_REQUIRED message: Unauthenticated. ForbiddenError: description: The token is authenticated but not permitted for this tenant or action. content: application/json: schema: $ref: '#/components/schemas/ApiError' examples: tokenInvalidForTenant: value: code: TOKEN_INVALID_FOR_TENANT message: Token not valid for this tenant. tokenAbilityDenied: value: code: TOKEN_ABILITY_DENIED message: Forbidden. NotFoundError: description: The workspace or requested resource was not found. content: application/json: schema: $ref: '#/components/schemas/ApiError' examples: tenantNotFound: value: code: TENANT_NOT_FOUND message: Workspace not found resourceNotFound: value: code: RESOURCE_NOT_FOUND message: Not found. ValidationFailedError: description: >- The request could not be processed because validation failed or filter values were unsupported. content: application/json: schema: $ref: '#/components/schemas/ApiError' examples: validationFailed: value: code: VALIDATION_FAILED message: The given data was invalid. details: errors: severity: - The selected severity is invalid. invalidFilterValue: value: code: INVALID_FILTER_VALUE message: 'Invalid filter value(s): critical' details: invalid_values: - critical RateLimitedError: description: The request exceeded the tenant API rate limit. content: application/json: schema: $ref: '#/components/schemas/ApiError' examples: rateLimited: value: code: RATE_LIMITED message: Too Many Attempts. InternalError: description: The server encountered an unexpected error. content: application/json: schema: $ref: '#/components/schemas/ApiError' examples: internalError: value: code: INTERNAL_ERROR message: Internal server error ServiceUnavailableError: description: The workspace or service is temporarily unavailable. content: application/json: schema: $ref: '#/components/schemas/ApiError' examples: serviceUnavailable: value: code: SERVICE_UNAVAILABLE message: Service Unavailable schemas: ApiError: type: object required: - code - message properties: code: type: string description: Machine-readable error code. message: type: string description: Human-readable error message. details: type: object description: Optional structured error details. additionalProperties: true securitySchemes: bearerAuth: type: http description: 'Use a Cysmiq API token in the Authorization header: Bearer {token}.' scheme: bearer bearerFormat: Token ````