List vulnerabilities
Get vulnerabilities from all pentests with filters and pagination.vulnerabilities:read
Get vulnerability detail
vulnerabilities:read
Inspect captured HTTP evidence
Retrieve the ordered requests and responses linked to a finding:vulnerabilities:read. Organization and asset access restrictions also apply.
The exchanges array contains up to ten references in evidence order. Each entry includes run_id, request_id, ordinal, lookup_state, and request metadata. With include_content=true, an archived entry has state: "archived" and an exchange object containing raw_request, raw_response, request_truncated, and response_truncated.
Omit
include_content=true to retrieve references and metadata only. Findings with no captured HTTP evidence, including static-only findings and older findings without links, return an empty array. Links identify captured exchanges; the API does not reconstruct missing traffic from the report text.
In the dashboard, open an issue’s Reproduction tab and select Captured HTTP. Exported tickets link to the same authenticated section. Request and response bodies are untrusted target content and may contain credentials or personal data; handle downloaded evidence accordingly.
Update vulnerability status
Set the status of a finding to in-progress or fixed, or add notes for remediation tracking:vulnerabilities:write
Status values
Retest a vulnerability
Run validation again for one finding. This shows if the finding is still exploitable:scans:write
Create a fix pull request
Create a pull request that contains an AI-generated remediation for the finding:vulnerabilities:write
Get vulnerability history
Get the lifecycle audit trail for a finding, including status, severity, snooze, note, and reason changes. Retest runs are not included:vulnerabilities:read