For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/api/latest/security-monitoring/list-vulnerabilities.md. A documentation index is available at /llms.txt.
homeHomedocsDocsapiAPI
Language
Datadog site

List vulnerabilities

WARNINGNote: This endpoint is deprecated. See the List Security Findings endpoint.
GEThttps://api.datadoghq.com/api/v2/security/vulnerabilitieshttps://api.us3.datadoghq.com/api/v2/security/vulnerabilitieshttps://api.us5.datadoghq.com/api/v2/security/vulnerabilitieshttps://api.datadoghq.eu/api/v2/security/vulnerabilitieshttps://api.ap1.datadoghq.com/api/v2/security/vulnerabilitieshttps://api.ap2.datadoghq.com/api/v2/security/vulnerabilitieshttps://api.uk1.datadoghq.com/api/v2/security/vulnerabilitieshttps://api.ddog-gov.com/api/v2/security/vulnerabilitieshttps://api.us2.ddog-gov.com/api/v2/security/vulnerabilities

Overview

Get a list of vulnerabilities.

Pagination

Pagination is enabled by default in both vulnerabilities and assets. The size of the page varies depending on the endpoint and cannot be modified. To automate the request of the next page, you can use the links section in the response.

This endpoint will return paginated responses. The pages are stored in the links section of the response:

{
  "data": [...],
  "meta": {...},
  "links": {
    "self": "https://.../api/v2/security/vulnerabilities",
    "first": "https://.../api/v2/security/vulnerabilities?page[number]=1&page[token]=abc",
    "last": "https://.../api/v2/security/vulnerabilities?page[number]=43&page[token]=abc",
    "next": "https://.../api/v2/security/vulnerabilities?page[number]=2&page[token]=abc"
  }
}
  • links.previous is empty if the first page is requested.
  • links.next is empty if the last page is requested.

Token

Vulnerabilities can be created, updated or deleted at any point in time.

Upon the first request, a token is created to ensure consistency across subsequent paginated requests.

A token is valid only for 24 hours.

First request

We consider a request to be the first request when there is no page[token] parameter.

The response of this first request contains the newly created token in the links section.

This token can then be used in the subsequent paginated requests.

Note: The first request may take longer to complete than subsequent requests.

Subsequent requests

Any request containing valid page[token] and page[number] parameters will be considered a subsequent request.

If the token is invalid, a 404 response will be returned.

If the page number is invalid, a 400 response will be returned.

The returned token is valid for all requests in the pagination sequence. To send paginated requests in parallel, reuse the same token and change only the page[number] parameter.

Filtering

The request can include some filter parameters to filter the data to be retrieved. The format of the filter parameters follows the JSON:API format: filter[$prop_name], where prop_name is the property name in the entity being filtered by.

All filters can include multiple values, where data will be filtered with an OR clause: filter[title]=Title1,Title2 will filter all vulnerabilities where title is equal to Title1 OR Title2.

String filters are case sensitive.

Boolean filters accept true or false as values.

Number filters must include an operator as a second filter input: filter[$prop_name][$operator]. For example, for the vulnerabilities endpoint: filter[cvss.base.score][lte]=8.

Available operators are: eq (==), lt (<), lte (<=), gt (>) and gte (>=).

Metadata

Following JSON:API format, object including non-standard meta-information.

This endpoint includes the meta member in the response. For more details on each of the properties included in this section, check the endpoints response tables.

{
  "data": [...],
  "meta": {
    "total": 1500,
    "count": 18732,
    "token": "some_token"
  },
  "links": {...}
}

Extensions

Requests may include extensions to modify the behavior of the requested endpoint. The filter parameters follow the JSON:API format format: ext:$extension_name, where extension_name is the name of the modifier that is being applied.

Extensions can only include one value: ext:modifier=value.

This endpoint requires the appsec_vm_read permission.

Arguments

Query Strings

Name
Type
Description
page[token]
string

Its value must come from the links section of the response of the first request. Do not manually edit it.

page[number]
integer

The page number to be retrieved. It should be equal or greater than 1

filter[type]
enum

Filter by vulnerability type.

Allowed enum values: AdminConsoleActive, CodeInjection, CommandInjection, ComponentWithKnownVulnerability, DangerousWorkflows, DefaultAppDeployed, DefaultHtmlEscapeInvalid, DirectoryListingLeak, EmailHtmlInjection, EndOfLife
Show 34 moreHardcodedPassword, HardcodedSecret, HeaderInjection, HstsHeaderMissing, InsecureAuthProtocol, InsecureCookie, InsecureJspLayout, LdapInjection, MaliciousPackage, MandatoryRemediation, NoHttpOnlyCookie, NoSameSiteCookie, NoSqlMongoDbInjection, PathTraversal, ReflectionInjection, RiskyLicense, SessionRewriting, SessionRewritting, SessionTimeout, SqlInjection, Ssrf, StackTraceLeak, TemplateInjection, TrustBoundaryViolation, Unmaintained, UntrustedDeserialization, UnvalidatedRedirect, VerbTampering, WeakCipher, WeakHash, WeakRandomness, XContentTypeHeaderMissing, XPathInjection, Xss
filter[cvss.base.score][`$op`]
number

Filter by vulnerability base (i.e. from the original advisory) severity score.

filter[cvss.base.severity]
enum

Filter by vulnerability base severity.

Allowed enum values: Unknown, None, Low, Medium, High, Critical
filter[cvss.base.vector]
string

Filter by vulnerability base CVSS vector.

filter[cvss.datadog.score][`$op`]
number

Filter by vulnerability Datadog severity score.

filter[cvss.datadog.severity]
enum

Filter by vulnerability Datadog severity.

Allowed enum values: Unknown, None, Low, Medium, High, Critical
filter[cvss.datadog.vector]
string

Filter by vulnerability Datadog CVSS vector.

filter[status]
enum

Filter by the status of the vulnerability.

Allowed enum values: Open, Muted, Remediated, InProgress, AutoClosed
filter[tool]
enum

Filter by the tool of the vulnerability.

Allowed enum values: IAST, SCA, Infra, SAST
filter[library.name]
string

Filter by library name.

filter[library.version]
string

Filter by library version.

filter[advisory.id]
string

Filter by advisory ID.

filter[risks.exploitation_probability]
boolean

Filter by exploitation probability.

filter[risks.poc_exploit_available]
boolean

Filter by POC exploit availability.

filter[risks.exploit_available]
boolean

Filter by public exploit availability.

filter[risks.epss.score][`$op`]
number

Filter by vulnerability EPSS severity score.

filter[risks.epss.severity]
enum

Filter by vulnerability EPSS severity.

Allowed enum values: Unknown, None, Low, Medium, High, Critical
filter[language]
string

Filter by language.

filter[ecosystem]
enum

Filter by ecosystem.

Allowed enum values: PyPI, Maven, NuGet, Npm, RubyGems, Go, Packagist, Deb, Rpm, Apk
Show 6 moreWindows, Generic, MacOs, Oci, BottleRocket, None
filter[code_location.location]
string

Filter by vulnerability location.

filter[code_location.file_path]
string

Filter by vulnerability file path.

filter[code_location.method]
string

Filter by method.

filter[fix_available]
boolean

Filter by fix availability.

filter[repo_digests]
string

Filter by vulnerability repo_digest (when the vulnerability is related to Image asset).

filter[origin]
string

Filter by origin.

filter[running_kernel]
boolean

Filter for whether the vulnerability affects a running kernel (for vulnerabilities related to a Host asset).

filter[asset.name]
string

Filter by asset name. This field supports the usage of wildcards (*).

filter[asset.type]
enum

Filter by asset type.

Allowed enum values: Repository, Service, Host, HostImage, Image, ServerlessFunction
filter[asset.version.first]
string

Filter by the first version of the asset this vulnerability has been detected on.

filter[asset.version.last]
string

Filter by the last version of the asset this vulnerability has been detected on.

filter[asset.repository_url]
string

Filter by the repository url associated to the asset.

filter[asset.risks.in_production]
boolean

Filter whether the asset is in production or not.

filter[asset.risks.under_attack]
boolean

Filter whether the asset is under attack or not.

filter[asset.risks.is_publicly_accessible]
boolean

Filter whether the asset is publicly accessible or not.

filter[asset.risks.has_privileged_access]
boolean

Filter whether the asset is publicly accessible or not.

filter[asset.risks.has_access_to_sensitive_data]
boolean

Filter whether the asset has access to sensitive data or not.

filter[asset.environments]
string

Filter by asset environments.

filter[asset.teams]
string

Filter by asset teams.

filter[asset.arch]
string

Filter by asset architecture.

filter[asset.operating_system.name]
string

Filter by asset operating system name.

filter[asset.operating_system.version]
string

Filter by asset operating system version.

Response

OK

The expected response schema when listing vulnerabilities.

Field
Type
Description
data [required]
[object]

List of vulnerabilities.

links
object

The JSON:API links related to pagination.

meta
object

The metadata related to this request.

Code Example

# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security/vulnerabilities" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"