> ## Documentation Index > Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt > Use this file to discover all available pages before exploring further. # Vulnerabilities > List, inspect, and update vulnerability findings export const ScarfPixel = () => ; ## List vulnerabilities Get vulnerabilities from all pentests with filters and pagination. ```bash theme={null} curl -X GET "https://app.strix.ai/api/v1/vulnerabilities" \ -H "Authorization: Bearer " ``` **Required scope:** `vulnerabilities:read` ## Get vulnerability detail ```bash theme={null} curl -X GET "https://app.strix.ai/api/v1/vulnerabilities/" \ -H "Authorization: Bearer " ``` **Required scope:** `vulnerabilities:read` ## Inspect captured HTTP evidence Retrieve the ordered requests and responses linked to a finding: ```bash theme={null} curl "https://app.strix.ai/api/v1/vulnerabilities//http-exchanges?include_content=true" \ -H "Authorization: Bearer " ``` **Required scope:** `vulnerabilities:read`. Organization and asset access restrictions also apply. The `exchanges` array contains up to ten references in evidence order. Each entry includes `run_id`, `request_id`, `ordinal`, `lookup_state`, and request metadata. With `include_content=true`, an archived entry has `state: "archived"` and an `exchange` object containing `raw_request`, `raw_response`, `request_truncated`, and `response_truncated`. | State | Meaning | | - | - | | `archived` | The captured request and response are available in `exchange`. | | `unarchived` | Request metadata exists, but the raw exchange was not stored or has expired. | | `not_found` | The linked request is no longer available. | | `unavailable` | The traffic or archive service could not be reached. Retry later. | Omit `include_content=true` to retrieve references and metadata only. Findings with no captured HTTP evidence, including static-only findings and older findings without links, return an empty array. Links identify captured exchanges; the API does not reconstruct missing traffic from the report text. In the dashboard, open an issue's **Reproduction** tab and select **Captured HTTP**. Exported tickets link to the same authenticated section. Request and response bodies are untrusted target content and may contain credentials or personal data; handle downloaded evidence accordingly. ## Get screenshot evidence Some findings carry screenshots of the browser. The agent attaches a screenshot only when the image proves something that the text and the captured HTTP do not, for example: * A payload that renders as a dialog * The data of another user on a page * An admin page that the agent reached after a bypass Most findings have no screenshots. List the screenshots of a finding: ```bash theme={null} curl "https://app.strix.ai/api/v1/vulnerabilities//screenshots" \ -H "Authorization: Bearer " ``` **Required scope:** `vulnerabilities:read`. Organization and asset access restrictions also apply. The `screenshots` array contains up to five entries in evidence order. Each entry includes `ordinal`, `content_type` (`image/png` or `image/jpeg`), `bytes`, `width`, `height`, `caption`, and `url`. A finding with no screenshots returns an empty array. Download one image with its `ordinal`: ```bash theme={null} curl "https://app.strix.ai/api/v1/vulnerabilities//screenshots/0" \ -H "Authorization: Bearer " \ --output screenshot-0.png ``` The response body is the image. The `Content-Type` header gives the image type. A screenshot shows target content and can contain personal data. Handle downloaded evidence accordingly. In the dashboard, screenshots appear in the **Evidence** section of an issue. Shared issue links show the same screenshots. ## Update vulnerability status Set the status of a finding to in-progress or fixed, or add notes for remediation tracking: ```bash theme={null} curl -X PATCH "https://app.strix.ai/api/v1/vulnerabilities/" \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{"status":"in_progress","note":"Linked to remediation ticket"}' ``` **Required scope:** `vulnerabilities:write` ### Status values | Status | Description | | - | - | | `open` | New finding, remediation not started | | `in_progress` | Remediation is in progress | | `snoozed` | Temporarily deferred until its snooze deadline | | `fixed` | Remediation is complete | | `ignored` | Known finding, risk accepted | | `not_affected` | Reviewed and determined not applicable to this asset | ## Update many vulnerabilities at once Set the status or the severity of up to 100 findings in one request. Send a `status`, a `severity`, or both: ```bash theme={null} curl -X POST "https://app.strix.ai/api/v1/vulnerabilities/bulk-update" \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{"vulnerability_ids":["",""],"status":"open","note":"Reopened after the fix was reverted"}' ``` **Required scope:** `vulnerabilities:write` Strix applies the change to each finding independently. The response lists a result for each id, so one finding that is not found or not in scope does not stop the others. A finding that already has the requested value counts as a success. If `status` is `snoozed`, also send `snoozed_until` with a future date. ## Retest a vulnerability Run validation again for one finding. This shows if the finding is still exploitable: ```bash theme={null} curl -X POST "https://app.strix.ai/api/v1/vulnerabilities//retest" \ -H "Authorization: Bearer " ``` **Required scope:** `scans:write` ## Create a fix pull request Create a pull request that contains an AI-generated remediation for the finding: ```bash theme={null} curl -X POST "https://app.strix.ai/api/v1/vulnerabilities//create-fix-pr" \ -H "Authorization: Bearer " ``` **Required scope:** `vulnerabilities:write` ## Get vulnerability history Get the lifecycle audit trail for a finding, including status, severity, snooze, note, and reason changes. Retest runs are not included: ```bash theme={null} curl -X GET "https://app.strix.ai/api/v1/vulnerabilities//history" \ -H "Authorization: Bearer " ``` **Required scope:** `vulnerabilities:read` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.