Vulnerabilities API

Note: The former Vulnerabilities API was renamed to Vulnerability Findings API and its documentation was moved to a different location. This document now describes the new Vulnerabilities API that provides access to Vulnerabilities.
Caution: This API is in an alpha stage and considered unstable. The response payload may be subject to change or breakage across GitLab releases.

Every API call to vulnerabilities must be authenticated.

Vulnerability permissions inherit permissions from their project. If a project is private, and a user isn’t a member of the project to which the vulnerability belongs, requests to that project returns a 404 Not Found status code.

Single vulnerability

Gets a single vulnerability

GET /vulnerabilities/:id
Attribute Type Required Description
id integer or string yes The ID of a Vulnerability to get
curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/vulnerabilities/1"

Example response:

{
  "id": 1,
  "title": "Predictable pseudorandom number generator",
  "description": null,
  "state": "opened",
  "severity": "medium",
  "confidence": "medium",
  "report_type": "sast",
  "project": {
    "id": 32,
    "name": "security-reports",
    "full_path": "/gitlab-examples/security/security-reports",
    "full_name": "gitlab-examples / security / security-reports"
  },
  "author_id": 1,
  "updated_by_id": null,
  "last_edited_by_id": null,
  "closed_by_id": null,
  "start_date": null,
  "due_date": null,
  "created_at": "2019-10-13T15:08:40.219Z",
  "updated_at": "2019-10-13T15:09:40.382Z",
  "last_edited_at": null,
  "closed_at": null
}

Confirm vulnerability

Confirms a given vulnerability. Returns status code 304 if the vulnerability is already confirmed.

If an authenticated user does not have permission to confirm vulnerabilities, this request results in a 403 status code.

POST /vulnerabilities/:id/confirm
Attribute Type Required Description
id integer or string yes The ID of a vulnerability to confirm
curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/vulnerabilities/5/confirm"

Example response:

{
  "id": 2,
  "title": "Predictable pseudorandom number generator",
  "description": null,
  "state": "confirmed",
  "severity": "medium",
  "confidence": "medium",
  "report_type": "sast",
  "project": {
    "id": 32,
    "name": "security-reports",
    "full_path": "/gitlab-examples/security/security-reports",
    "full_name": "gitlab-examples / security / security-reports"
  },
  "author_id": 1,
  "updated_by_id": null,
  "last_edited_by_id": null,
  "closed_by_id": null,
  "start_date": null,
  "due_date": null,
  "created_at": "2019-10-13T15:08:40.219Z",
  "updated_at": "2019-10-13T15:09:40.382Z",
  "last_edited_at": null,
  "closed_at": null
}

Resolve vulnerability

Resolves a given vulnerability. Returns status code 304 if the vulnerability is already resolved.

If an authenticated user does not have permission to resolve vulnerabilities, this request results in a 403 status code.

POST /vulnerabilities/:id/resolve
Attribute Type Required Description
id integer or string yes The ID of a Vulnerability to resolve
curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/vulnerabilities/5/resolve"

Example response:

{
  "id": 2,
  "title": "Predictable pseudorandom number generator",
  "description": null,
  "state": "resolved",
  "severity": "medium",
  "confidence": "medium",
  "report_type": "sast",
  "project": {
    "id": 32,
    "name": "security-reports",
    "full_path": "/gitlab-examples/security/security-reports",
    "full_name": "gitlab-examples / security / security-reports"
  },
  "author_id": 1,
  "updated_by_id": null,
  "last_edited_by_id": null,
  "closed_by_id": null,
  "start_date": null,
  "due_date": null,
  "created_at": "2019-10-13T15:08:40.219Z",
  "updated_at": "2019-10-13T15:09:40.382Z",
  "last_edited_at": null,
  "closed_at": null
}

Dismiss vulnerability

Dismisses a given vulnerability. Returns status code 304 if the vulnerability is already dismissed.

If an authenticated user does not have permission to dismiss vulnerabilities, this request results in a 403 status code.

POST /vulnerabilities/:id/dismiss
Attribute Type Required Description
id integer or string yes The ID of a vulnerability to dismiss
curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/vulnerabilities/5/dismiss"

Example response:

{
  "id": 2,
  "title": "Predictable pseudorandom number generator",
  "description": null,
  "state": "closed",
  "severity": "medium",
  "confidence": "medium",
  "report_type": "sast",
  "project": {
    "id": 32,
    "name": "security-reports",
    "full_path": "/gitlab-examples/security/security-reports",
    "full_name": "gitlab-examples / security / security-reports"
  },
  "author_id": 1,
  "updated_by_id": null,
  "last_edited_by_id": null,
  "closed_by_id": null,
  "start_date": null,
  "due_date": null,
  "created_at": "2019-10-13T15:08:40.219Z",
  "updated_at": "2019-10-13T15:09:40.382Z",
  "last_edited_at": null,
  "closed_at": null
}

Revert vulnerability to detected state

Reverts a given vulnerability to detected state. Returns status code 304 if the vulnerability is already in detected state.

If an authenticated user does not have permission to revert vulnerability to detected state, this request results in a 403 status code.

POST /vulnerabilities/:id/revert
Attribute Type Required Description
id integer or string yes The ID of a vulnerability to revert to detected state
curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/vulnerabilities/5/dismiss"

Example response:

{
  "id": 2,
  "title": "Predictable pseudorandom number generator",
  "description": null,
  "state": "detected",
  "severity": "medium",
  "confidence": "medium",
  "report_type": "sast",
  "project": {
    "id": 32,
    "name": "security-reports",
    "full_path": "/gitlab-examples/security/security-reports",
    "full_name": "gitlab-examples / security / security-reports"
  },
  "author_id": 1,
  "updated_by_id": null,
  "last_edited_by_id": null,
  "closed_by_id": null,
  "start_date": null,
  "due_date": null,
  "created_at": "2019-10-13T15:08:40.219Z",
  "updated_at": "2019-10-13T15:09:40.382Z",
  "last_edited_at": null,
  "closed_at": null
}