> ## Documentation Index > Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get dependency (SCA) findings for a scan > Returns dependency / supply-chain CVE findings for a scan, grouped by package and enriched from the CVE database (CVSS / KEV / EPSS). These supply-chain findings are surfaced separately from the validated pentest vulnerabilities (see `GET /scans/{scanId}`). ## OpenAPI ````yaml /openapi.json get /scans/{scanId}/dependencies openapi: 3.1.0 info: title: Strix API version: 1.0.0 description: >- Public REST API for the Strix autonomous penetration testing platform. Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks. servers: - url: /api/v1 description: Strix v1 API security: - BearerAuth: [] tags: - name: Scans description: Launch, monitor, and manage security scans. - name: Vulnerabilities description: View and triage discovered vulnerabilities. - name: Assets description: Domains and repositories registered for scanning. - name: Schedules description: Recurring scan schedules (Pro plan). - name: Tokens description: Manage API tokens for authentication. - name: Webhooks description: Configure webhook subscriptions for real-time event notifications. - name: Organization description: Workspace configuration for the authenticated organization. - name: Members description: Manage organization members and roles. - name: Invitations description: List and revoke organization invitations. - name: PR Reviews description: Automated security review of pull requests. - name: Connectors description: Network connectors for scanning internal/private targets. - name: Knowledge description: >- Organization knowledge base: documents, policies, and repo profiles that steer the agent. - name: Uploads description: Upload source/code/documentation archives for whitebox scans. - name: Integrations description: Third-party integrations (GitLab, Bitbucket, ticketing). - name: Chat description: Conversational agent sessions. - name: Analytics description: Aggregate dashboard analytics. - name: Test Users description: >- Per-domain test accounts (with optional MFA) the agent authenticates as during scans. paths: /scans/{scanId}/dependencies: get: tags: - Scans summary: Get dependency (SCA) findings for a scan description: >- Returns dependency / supply-chain CVE findings for a scan, grouped by package and enriched from the CVE database (CVSS / KEV / EPSS). These supply-chain findings are surfaced separately from the validated pentest vulnerabilities (see `GET /scans/{scanId}`). operationId: getScanDependencies parameters: - $ref: '#/components/parameters/ScanId' responses: '200': description: Dependency findings grouped by package. content: application/json: schema: $ref: '#/components/schemas/DependencyFindings' '401': $ref: '#/components/responses/Unauthorized' '404': $ref: '#/components/responses/NotFound' '500': $ref: '#/components/responses/InternalError' security: - BearerAuth: - dependencies:read components: parameters: ScanId: name: scanId in: path required: true schema: type: string format: uuid schemas: DependencyFindings: type: object description: >- Dependency / supply-chain CVE (SCA) findings for a scan, grouped by package and enriched from the CVE database (CVSS / KEV / EPSS). These are kept separate from the validated pentest vulnerabilities surface. properties: summary: $ref: '#/components/schemas/DependencyFindingsSummary' packages: type: array items: $ref: '#/components/schemas/DependencyPackageGroup' required: - summary - packages DependencyFindingsSummary: type: object properties: total_occurrences: type: integer description: Number of vulnerable-dependency occurrences (vulnerability rows). total_cves: type: integer description: Distinct CVE count across all packages. package_count: type: integer kev_count: type: integer description: >- Count of CVEs flagged in CISA's Known Exploited Vulnerabilities catalog. severity_counts: type: object properties: critical: type: integer high: type: integer medium: type: integer low: type: integer unknown: type: integer required: - critical - high - medium - low - unknown ecosystems: type: array items: type: string description: Distinct package ecosystems present (npm, pip, go, maven, ...). required: - total_occurrences - total_cves - package_count - kev_count - severity_counts - ecosystems DependencyPackageGroup: type: object properties: key: type: string description: Stable group key (`ecosystem::package`). package: type: string ecosystem: type: string installed_versions: type: array items: type: string fixed_version: type: - string - 'null' description: Recommended upgrade target. manifest_paths: type: array items: type: string max_cvss: type: - number - 'null' max_severity: $ref: '#/components/schemas/DependencySeverity' has_kev: type: boolean max_epss_percentile: type: - number - 'null' cve_count: type: integer cves: type: array items: $ref: '#/components/schemas/DependencyCveDetail' required: - key - package - ecosystem - installed_versions - fixed_version - manifest_paths - max_cvss - max_severity - has_kev - max_epss_percentile - cve_count - cves ErrorResponse: type: object properties: detail: type: string required: - detail DependencySeverity: type: string enum: - critical - high - medium - low - unknown DependencyCveDetail: type: object properties: cve_id: type: string severity: $ref: '#/components/schemas/DependencySeverity' cvss: type: - number - 'null' kev: type: boolean kev_due_date: type: - string - 'null' epss_percentile: type: - number - 'null' epss_score: type: - number - 'null' description: type: - string - 'null' references: type: array items: type: object properties: url: type: string source: type: string tags: type: array items: type: string required: - url installed_version: type: - string - 'null' fixed_version: type: - string - 'null' manifest_path: type: - string - 'null' enriched: type: boolean description: Whether a matching record was found in the CVE enrichment table. required: - cve_id - severity - cvss - kev - kev_due_date - epss_percentile - epss_score - description - references - installed_version - fixed_version - manifest_path - enriched responses: Unauthorized: description: Missing or invalid API token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' NotFound: description: Resource not found. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' InternalError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: BearerAuth: type: http scheme: bearer description: >- API token obtained from the Tokens endpoint. Include as `Authorization: Bearer `. ````