> ## Documentation Index > Fetch the complete documentation index at: https://docs.cysmiq.com/llms.txt > Use this file to discover all available pages before exploring further. # List vulnerability locations > Returns paginated locations for a single vulnerability. Use `scope=all` to include locations that have been fixed; default `live` returns only currently-vulnerable locations. ## OpenAPI ````yaml https://app.cysmiq.com/docs/tenant/openapi.json get /{tenant_slug}/vulnerabilities/{vulnerability}/locations openapi: 3.1.0 info: title: Cysmiq version: v1 description: Tenant API servers: - url: https://app.cysmiq.com/api/v1 description: Production security: - bearerAuth: [] tags: - name: Token description: Token introspection and authentication context. - name: Organizations description: Read-only organizational unit (org) data. - name: Repositories description: Read-only repository data. - name: Applications description: Read-only application data. - name: Scans description: Read-only scan status data for CI integrations. - name: Vulnerabilities description: Read-only vulnerability data for CI and reporting. - name: Policy Violations description: Read-only policy violation data for CI and reporting. paths: /{tenant_slug}/vulnerabilities/{vulnerability}/locations: get: tags: - Vulnerabilities summary: List vulnerability locations description: >- Returns paginated locations for a single vulnerability. Use `scope=all` to include locations that have been fixed; default `live` returns only currently-vulnerable locations. operationId: listVulnerabilityLocations parameters: - name: scope in: query schema: type: - string - 'null' enum: - live - all - name: limit in: query schema: type: - integer - 'null' minimum: 1 maximum: 200 - name: cursor in: query schema: type: - string - 'null' - name: tenant_slug in: path required: true description: Workspace slug for the tenant context. schema: {} example: acme - name: vulnerability in: path required: true description: Vulnerability prefixed id (vc_...). schema: type: string example: vc_01hxyz responses: '200': description: Vulnerability locations list response. content: application/json: schema: type: object required: - vulnerability - filters - summary - items - next_cursor properties: vulnerability: type: object required: - id - title properties: id: type: string title: type: - string - 'null' filters: type: object required: - scope properties: scope: type: string enum: - live - all summary: type: object required: - total - active - fixed properties: total: type: integer minimum: 0 active: type: integer minimum: 0 fixed: type: integer minimum: 0 items: type: array items: type: object additionalProperties: true properties: id: type: string path: type: string line: type: - integer - 'null' fixed_at: type: - string - 'null' vulnerable_at: type: - string - 'null' exploitable_at: type: - string - 'null' is_vulnerable: type: boolean is_exploitable: type: boolean reference: type: - object - 'null' additionalProperties: true artifact: type: - object - 'null' additionalProperties: true next_cursor: type: - string - 'null' '401': $ref: '#/components/responses/UnauthorizedError' '403': $ref: '#/components/responses/ForbiddenError' '404': $ref: '#/components/responses/NotFoundError' '422': $ref: '#/components/responses/ValidationFailedError' '429': $ref: '#/components/responses/RateLimitedError' '500': $ref: '#/components/responses/InternalError' '503': $ref: '#/components/responses/ServiceUnavailableError' components: responses: UnauthorizedError: description: Authentication is required or the token is invalid. content: application/json: schema: $ref: '#/components/schemas/ApiError' examples: authenticationRequired: value: code: AUTHENTICATION_REQUIRED message: Unauthenticated. ForbiddenError: description: The token is authenticated but not permitted for this tenant or action. content: application/json: schema: $ref: '#/components/schemas/ApiError' examples: tokenInvalidForTenant: value: code: TOKEN_INVALID_FOR_TENANT message: Token not valid for this tenant. tokenAbilityDenied: value: code: TOKEN_ABILITY_DENIED message: Forbidden. NotFoundError: description: The workspace or requested resource was not found. content: application/json: schema: $ref: '#/components/schemas/ApiError' examples: tenantNotFound: value: code: TENANT_NOT_FOUND message: Workspace not found resourceNotFound: value: code: RESOURCE_NOT_FOUND message: Not found. ValidationFailedError: description: >- The request could not be processed because validation failed or filter values were unsupported. content: application/json: schema: $ref: '#/components/schemas/ApiError' examples: validationFailed: value: code: VALIDATION_FAILED message: The given data was invalid. details: errors: severity: - The selected severity is invalid. invalidFilterValue: value: code: INVALID_FILTER_VALUE message: 'Invalid filter value(s): critical' details: invalid_values: - critical RateLimitedError: description: The request exceeded the tenant API rate limit. content: application/json: schema: $ref: '#/components/schemas/ApiError' examples: rateLimited: value: code: RATE_LIMITED message: Too Many Attempts. InternalError: description: The server encountered an unexpected error. content: application/json: schema: $ref: '#/components/schemas/ApiError' examples: internalError: value: code: INTERNAL_ERROR message: Internal server error ServiceUnavailableError: description: The workspace or service is temporarily unavailable. content: application/json: schema: $ref: '#/components/schemas/ApiError' examples: serviceUnavailable: value: code: SERVICE_UNAVAILABLE message: Service Unavailable schemas: ApiError: type: object required: - code - message properties: code: type: string description: Machine-readable error code. message: type: string description: Human-readable error message. details: type: object description: Optional structured error details. additionalProperties: true securitySchemes: bearerAuth: type: http description: 'Use a Cysmiq API token in the Authorization header: Bearer {token}.' scheme: bearer bearerFormat: Token ````