HTTP API

Base URL: https://www.vulnetix.com/api/site/v1/. Paths below are written from /v1. Every route takes the console session or Authorization: ApiKey <orgId>:<key>, and acts on the caller’s organisation. A row that belongs to another organisation answers 404.

A plan-gated route answers 200 with planLocked: true, requiredPlan and an _entitlements marker instead of 403, so check the body, not only the status.

Findings

Method	Path	Explained in
GET	/v1/findings/	Findings and triage
GET	/v1/findings/metrics	Findings and triage
GET	/v1/findings/stats, /v1/findings/facets, /v1/findings/metric-detail	dashboard counts
GET	/v1/findings/export	export of the current filter
GET	/v1/findings/{findingUuid}/enrichment
GET	/v1/findings/strategy-lens	Risk strategies
PATCH	/v1/findings/{uuid}/triage	Findings and triage
PATCH	/v1/findings/{uuid}/score	Findings and triage
POST	/v1/findings/bulk/triage, /v1/findings/bulk/score, /v1/findings/bulk/suppress	Findings and triage
POST	/v1/findings/{uuid}/github-advisory	drafts a private GitHub repository advisory from the finding
GET	/v1/scanner-results/finding/{findingUuid}/attack-surface	Internet exposure

Review

Method	Path	Explained in
GET	/v1/review/counts, /v1/review/findings, /v1/review/decisions, /v1/review/audit, /v1/review/audit/summary	Findings and triage
GET, POST	/v1/review/dependencies	dependency decisions

Suppressions

Method	Path	Explained in
GET, POST	/v1/suppressions	Suppressions
PATCH, DELETE	/v1/suppressions/{uuid}	Suppressions

Prioritisation and policy

Method	Path	Explained in
GET, POST	/v1/risk-strategies/	Risk strategies
PUT, DELETE	/v1/risk-strategies/{id}	Risk strategies
PUT	/v1/risk-strategies/{id}/rules	Risk strategies
GET, POST	/v1/attack-paths/	Risk strategies
GET, PUT, DELETE	/v1/attack-paths/{id}
PUT	/v1/attack-paths/{id}/vectors
GET, PUT	/v1/triage-policy	Remediation policy

Campaigns (Pro and above)

Method	Path	Explained in
GET, POST	/v1/campaigns/	Campaigns
POST	/v1/campaigns/preview	Scope and done criteria
GET	/v1/campaigns/contributor-candidates	Campaigns
GET, PATCH, DELETE	/v1/campaigns/{id}	Campaigns
PUT	/v1/campaigns/{id}/contributors
POST	/v1/campaigns/{id}/evaluate	Campaigns
GET	/v1/campaigns/{id}/evaluate-status, /items, /metrics, /context, /events	Campaigns

Repositories

Method	Path	Explained in
GET	/v1/repositories/, /v1/repositories/stats, /v1/repositories/names, /v1/repositories/search	Repository scope
POST	/v1/repositories/resolve	Repository scope
GET	/v1/repositories/detail, /facets, /scanner-results, /findings, /dependencies, /package-managers, /malware, /firewall-logs (all ?fullName=)	Repository scope
GET	/v1/integrations/github/repos/status?repo= (console session only)	Repository scope

Graph and labels

Method	Path	Explained in
GET	/v1/insights/graph, /v1/insights/graph/{repoId}/nodes, /v1/insights/graph/{repoId}/intel, /v1/insights/node/{repoId}/{nodeId}, /v1/insights/org/metrics	Asset relationships
GET, POST	/v1/threat-model/annotations	Asset relationships
PATCH, DELETE	/v1/threat-model/annotations/{id}
GET	/v1/threat-model/annotations/labels
POST	/v1/threat-model/annotations/derive