> ## Documentation Index > Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt > Use this file to discover all available pages before exploring further. # List vulnerabilities > Returns a paginated list of vulnerabilities across all scans for the organization. Set the finding_type query parameter to dependency to read dependency findings. This filter also requires the dependencies:read scope. ## OpenAPI ````yaml /openapi.json get /vulnerabilities openapi: 3.1.0 info: title: Strix API version: 1.0.0 description: >- Public REST API for the Strix autonomous penetration testing platform. Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks. servers: - url: /api/v1 description: Strix v1 API security: - BearerAuth: [] tags: - name: Scans description: Launch, monitor, and manage security scans. - name: Vulnerabilities description: View and triage discovered vulnerabilities. - name: Assets description: Domains and repositories registered for scanning. - name: Schedules description: Recurring scan schedules (Pro plan). - name: Search description: Search across issues, pentests, PR reviews, chats, assets and schedules. - name: Tokens description: Manage API tokens for authentication. - name: Webhooks description: Configure webhook subscriptions for real-time event notifications. - name: Organization description: Workspace configuration for the authenticated organization. - name: Members description: Manage organization members and roles. - name: Invitations description: List and revoke organization invitations. - name: PR Reviews description: Automated security review of pull requests. - name: Connectors description: Network connectors for scanning internal/private targets. - name: Knowledge description: >- Organization knowledge base: documents, policies, and repo profiles that steer the agent. - name: Uploads description: Upload source/code/documentation archives for whitebox scans. - name: Integrations description: Third-party integrations (GitLab, Bitbucket, ticketing). - name: Chat description: Conversational agent sessions. - name: Analytics description: Aggregate dashboard analytics. - name: Test Users description: >- Per-domain test accounts (with optional MFA) the agent authenticates as during scans. - name: License description: Self-hosted license state, entitlements, and aggregate usage. - name: Supply Chain description: >- SBOM inventory, supply-chain findings, scans, and policy for connected repositories. - name: CLI description: >- Device authorization endpoints that let the Strix CLI and coding agents sign in and receive an API token. - name: Billing description: Credit balance, agent-payable top-ups, and automatic top-up settings. - name: Workspaces description: List, create, and switch workspaces. - name: Asset Discovery description: >- Passive reconnaissance runs that map the organization's external attack surface, and the discovered-asset inventory they fill. - name: Containers description: >- Container registries, tracked images, image scans, findings, and SBOM components. - name: Run Logs description: Persisted engine logs and the diagnostics bundle of a self-hosted install. paths: /vulnerabilities: get: tags: - Vulnerabilities summary: List vulnerabilities description: >- Returns a paginated list of vulnerabilities across all scans for the organization. Set the finding_type query parameter to dependency to read dependency findings. This filter also requires the dependencies:read scope. operationId: listVulnerabilities parameters: - $ref: '#/components/parameters/Page' - $ref: '#/components/parameters/Limit' - name: scan_id in: query description: Filter by scan ID. schema: type: string format: uuid - name: severity in: query required: false description: >- Return only findings with these severities. Supply one severity, or a comma-separated list of severities. The allowed severities are `critical`, `high`, `medium`, and `low`. Unknown values return 400. schema: type: string examples: - critical - critical,high - description: Return only findings in this status. name: status in: query schema: $ref: '#/components/schemas/VulnerabilityStatus' - name: search in: query description: Full-text search across titles, targets, and STRIX display numbers. schema: type: string - name: from in: query description: Filter by scan created_at >= this date. schema: type: string format: date-time - name: to in: query description: Filter by scan created_at <= this date. schema: type: string format: date-time - description: >- Return only the findings of this domain. The response also includes historical findings that have no domain attribution. name: domain_id in: query schema: type: string format: uuid - name: repository_id in: query description: >- Return only the findings of this repository. The response also includes historical findings that have no repository attribution. schema: type: string format: uuid - name: finding_type in: query required: false description: >- Filter by issue type: dynamic findings from live pentests, code review findings, or dependency CVE findings. Omit for all dynamic findings (dependency findings are only returned when explicitly selected). `dependency` additionally requires the `dependencies:read` scope. schema: type: string enum: - live_pentest - code - dependency - name: dependency_relation in: query required: false description: >- Filter dependency findings by how the vulnerable package enters the project. `direct` returns packages that a manifest declares. `transitive` returns packages that another package pulls in. Only applies when `finding_type` is `dependency`. schema: type: string enum: - direct - transitive - name: reachability in: query required: false description: >- Filter dependency findings by the usage levels that the scan proved for the vulnerable code. Supply one level, or a comma-separated list of levels. The level `unknown` also returns the findings without a recorded usage level. This filter applies only when `finding_type` is `dependency`. The allowed levels are `reachable_call_path`, `vulnerable_symbol_used`, `imported`, `not_imported`, and `unknown`. schema: type: string examples: - reachable_call_path - reachable_call_path,vulnerable_symbol_used,imported,unknown - name: retesting in: query required: false description: >- Set to `1` to return only the issues with a retest that is pending or running. schema: type: string enum: - '1' - name: sort_by in: query description: >- The sort key. The key `package` applies only when `finding_type` is `dependency`. For a dependency finding, `cvss` is the score that the scan gave the risk in this codebase. The key `severity` sorts by the CVSS score, and `sort_order=desc` puts the most severe findings first. A finding without a score, or with a severity override, sorts by its severity level. schema: type: string enum: - cvss - created_at - severity - package - $ref: '#/components/parameters/SortOrder' responses: '200': description: Paginated list of vulnerabilities. content: application/json: schema: $ref: '#/components/schemas/PaginatedResponse_VulnerabilitySummary' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '500': $ref: '#/components/responses/InternalError' security: - BearerAuth: - vulnerabilities:read components: parameters: Page: description: Page number of the result set. The first page is 1. name: page in: query schema: type: integer minimum: 1 default: 1 Limit: description: >- Maximum number of items per page. The default is 20 and the maximum is 100. name: limit in: query schema: type: integer minimum: 1 maximum: 100 default: 20 SortOrder: description: Sort direction. Use `asc` for oldest first or `desc` for newest first. name: sort_order in: query schema: type: string enum: - asc - desc default: desc schemas: VulnerabilityStatus: type: string enum: - open - in_progress - snoozed - fixed - ignored - not_affected PaginatedResponse_VulnerabilitySummary: type: object properties: items: type: array items: $ref: '#/components/schemas/VulnerabilitySummary' meta: $ref: '#/components/schemas/PaginationMeta' required: - items - meta VulnerabilitySummary: type: object description: Abbreviated vulnerability returned in list endpoints. properties: id: type: string scan_id: type: string format: uuid title: type: string target: type: - string - 'null' severity: $ref: '#/components/schemas/VulnerabilitySeverity' cve: type: - string - 'null' cvss: type: - number - 'null' status: $ref: '#/components/schemas/VulnerabilityStatus' created_at: type: string format: date-time display_number: type: - integer - 'null' finding_type: type: string enum: - live_pentest - code - dependency description: >- Issue type bucket: dynamic finding from a live pentest, a code review finding, or a dependency CVE finding. dependency_metadata: type: - object - 'null' additionalProperties: true description: >- Dependency findings only: the package details the scan recorded, such as `package`, `ecosystem`, `installed_version`, `fixed_version`, `manifest_path`, `introduced_by`, `reachability`, and the contextual CVSS rating. latest_retest: $ref: '#/components/schemas/VulnerabilityRetest' required: - id - scan_id - title - severity - status - created_at PaginationMeta: type: object properties: page: type: integer limit: type: integer total_items: type: integer total_pages: type: integer has_next: type: boolean has_prev: type: boolean required: - page - limit - total_items - total_pages - has_next - has_prev ErrorResponse: type: object properties: detail: type: string description: Human-readable explanation of the error. code: type: string description: >- Stable machine-readable error code. `insufficient_scope` means the token does not hold the scope that this endpoint requires. required_scope: $ref: '#/components/schemas/ApiV1Scope' description: >- Scope that the caller must add to the token. Returned with the `insufficient_scope` code. docs: type: string format: uri description: Documentation page that explains how to resolve the error. hint: type: string description: >- One instruction that resolves the error. For `insufficient_scope`, a CLI session gets the `strix cloud session scopes set full` or `strix cloud login --scope-profile full` command, and an API token gets the settings page where the user creates a token with the scope. When the owner's role cannot hold the scope, the hint asks for a role change instead. required: - detail VulnerabilitySeverity: type: string enum: - critical - high - medium - low VulnerabilityRetest: type: - object - 'null' description: >- The newest retest of the issue. The value is null when nobody retested the issue. properties: scan_id: type: string description: The retest scan. Read it with `GET /scans/{scanId}`. outcome: $ref: '#/components/schemas/RetestOutcome' inconclusive_reason: type: - string - 'null' description: >- Why an `inconclusive` retest could not verify the issue, in the retest agent's words. Null for every other outcome, and when the retest gave no reason; the retest scan's trace has the details. started_at: type: string format: date-time required: - scan_id - outcome - inconclusive_reason - started_at ApiV1Scope: type: string enum: - scans:read - scans:write - vulnerabilities:read - vulnerabilities:write - dependencies:read - schedules:read - schedules:write - assets:read - assets:write - organizations:read - organizations:write - members:read - members:write - invitations:read - invitations:write - webhooks:read - webhooks:write - tokens:write - audit:read - pr_reviews:read - pr_reviews:write - connectors:read - connectors:write - knowledge:read - knowledge:write - uploads:write - integrations:read - integrations:write - chat:read - chat:write - scans:message - analytics:read - llm:read - llm:write - test_users:read - test_users:write - discovery:read - discovery:write - license:read - supply_chain:read - supply_chain:write - billing:read - billing:write - containers:read - containers:write - logs:read RetestOutcome: type: string enum: - running - still_present - inconclusive - not_reproduced - failed - cancelled description: >- The state of a retest. `running` means the retest scan is pending or running. `still_present` means the retest reproduced the issue. `inconclusive` means the retest completed but could not verify the issue, for example because the target did not respond; the issue keeps its status. If the service was taken down on purpose, close these issues with `POST /vulnerabilities/bulk-update` and `status: fixed`. `not_reproduced` means the retest completed and did not find the issue. `failed` and `cancelled` mirror the retest scan status. responses: BadRequest: description: Bad request. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unauthorized: description: Missing or invalid API token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' InternalError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: BearerAuth: type: http scheme: bearer description: >- API token obtained from the Tokens endpoint or CLI device login. Include as `Authorization: Bearer `. Requests made with a managed CLI session also include `X-Strix-Workspace: ` to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.