Vulnerabilities API

Introduced in GitLab Ultimate 12.6.

The former Vulnerabilities API was renamed to Vulnerability Findings API and its documentation was moved to a different location. This document now describes the new Vulnerabilities API that provides access to Vulnerabilities.

This API is in the process of being deprecated and considered unstable. The response payload may be subject to change or breakage across GitLab releases. Please use the GraphQL API instead.

Every API call to vulnerabilities must be authenticated.

Vulnerability permissions inherit permissions from their project. If a project is private, and a user isn’t a member of the project to which the vulnerability belongs, requests to that project returns a 404 Not Found status code.

Single vulnerability

Gets a single vulnerability

GET /vulnerabilities/:id

Attribute	Type	Required	Description
`id`	integer or string	yes	The ID of a Vulnerability to get

curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/vulnerabilities/1"

Example response:

{
  "id": 1,
  "title": "Predictable pseudorandom number generator",
  "description": null,
  "state": "opened",
  "severity": "medium",
  "confidence": "medium",
  "report_type": "sast",
  "project": {
    "id": 32,
    "name": "security-reports",
    "full_path": "/gitlab-examples/security/security-reports",
    "full_name": "gitlab-examples / security / security-reports"
  },
  "author_id": 1,
  "updated_by_id": null,
  "last_edited_by_id": null,
  "closed_by_id": null,
  "start_date": null,
  "due_date": null,
  "created_at": "2019-10-13T15:08:40.219Z",
  "updated_at": "2019-10-13T15:09:40.382Z",
  "last_edited_at": null,
  "closed_at": null
}

Confirm vulnerability

Confirms a given vulnerability. Returns status code 304 if the vulnerability is already confirmed.

If an authenticated user does not have permission to confirm vulnerabilities, this request results in a 403 status code.

POST /vulnerabilities/:id/confirm

Attribute	Type	Required	Description
`id`	integer or string	yes	The ID of a vulnerability to confirm

curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/vulnerabilities/5/confirm"

Example response:

{
  "id": 2,
  "title": "Predictable pseudorandom number generator",
  "description": null,
  "state": "confirmed",
  "severity": "medium",
  "confidence": "medium",
  "report_type": "sast",
  "project": {
    "id": 32,
    "name": "security-reports",
    "full_path": "/gitlab-examples/security/security-reports",
    "full_name": "gitlab-examples / security / security-reports"
  },
  "author_id": 1,
  "updated_by_id": null,
  "last_edited_by_id": null,
  "closed_by_id": null,
  "start_date": null,
  "due_date": null,
  "created_at": "2019-10-13T15:08:40.219Z",
  "updated_at": "2019-10-13T15:09:40.382Z",
  "last_edited_at": null,
  "closed_at": null
}

Resolve vulnerability

Resolves a given vulnerability. Returns status code 304 if the vulnerability is already resolved.

If an authenticated user does not have permission to resolve vulnerabilities, this request results in a 403 status code.

POST /vulnerabilities/:id/resolve

Attribute	Type	Required	Description
`id`	integer or string	yes	The ID of a Vulnerability to resolve

curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/vulnerabilities/5/resolve"

Example response:

{
  "id": 2,
  "title": "Predictable pseudorandom number generator",
  "description": null,
  "state": "resolved",
  "severity": "medium",
  "confidence": "medium",
  "report_type": "sast",
  "project": {
    "id": 32,
    "name": "security-reports",
    "full_path": "/gitlab-examples/security/security-reports",
    "full_name": "gitlab-examples / security / security-reports"
  },
  "author_id": 1,
  "updated_by_id": null,
  "last_edited_by_id": null,
  "closed_by_id": null,
  "start_date": null,
  "due_date": null,
  "created_at": "2019-10-13T15:08:40.219Z",
  "updated_at": "2019-10-13T15:09:40.382Z",
  "last_edited_at": null,
  "closed_at": null
}

Dismiss vulnerability

Dismisses a given vulnerability. Returns status code 304 if the vulnerability is already dismissed.

If an authenticated user does not have permission to dismiss vulnerabilities, this request results in a 403 status code.

POST /vulnerabilities/:id/dismiss

Attribute	Type	Required	Description
`id`	integer or string	yes	The ID of a vulnerability to dismiss

curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/vulnerabilities/5/dismiss"

Example response:

{
  "id": 2,
  "title": "Predictable pseudorandom number generator",
  "description": null,
  "state": "closed",
  "severity": "medium",
  "confidence": "medium",
  "report_type": "sast",
  "project": {
    "id": 32,
    "name": "security-reports",
    "full_path": "/gitlab-examples/security/security-reports",
    "full_name": "gitlab-examples / security / security-reports"
  },
  "author_id": 1,
  "updated_by_id": null,
  "last_edited_by_id": null,
  "closed_by_id": null,
  "start_date": null,
  "due_date": null,
  "created_at": "2019-10-13T15:08:40.219Z",
  "updated_at": "2019-10-13T15:09:40.382Z",
  "last_edited_at": null,
  "closed_at": null
}

Revert vulnerability to detected state

Reverts a given vulnerability to detected state. Returns status code 304 if the vulnerability is already in detected state.

If an authenticated user does not have permission to revert vulnerability to detected state, this request results in a 403 status code.

POST /vulnerabilities/:id/revert

Attribute	Type	Required	Description
`id`	integer or string	yes	The ID of a vulnerability to revert to detected state

curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/vulnerabilities/5/dismiss"

Example response:

{
  "id": 2,
  "title": "Predictable pseudorandom number generator",
  "description": null,
  "state": "detected",
  "severity": "medium",
  "confidence": "medium",
  "report_type": "sast",
  "project": {
    "id": 32,
    "name": "security-reports",
    "full_path": "/gitlab-examples/security/security-reports",
    "full_name": "gitlab-examples / security / security-reports"
  },
  "author_id": 1,
  "updated_by_id": null,
  "last_edited_by_id": null,
  "closed_by_id": null,
  "start_date": null,
  "due_date": null,
  "created_at": "2019-10-13T15:08:40.219Z",
  "updated_at": "2019-10-13T15:09:40.382Z",
  "last_edited_at": null,
  "closed_at": null
}