Skip to content
API Enriched

GET Vulnerabilities for Virtual Host.

POST
/api/ml/data/namespaces/{namespace}/virtual_hosts/{name}/vulnerabilities
curl --request POST \
  --url https://example-corp.console.ves.volterra.io/api/v1/api/production/us-east-1/namespaces/default/api/ml/data/namespaces/example/virtual_hosts/example/vulnerabilities \
  --header 'Authorization: <Authorization>' \
  --header 'Content-Type: application/json' \
  --data '{ "api_endpoint": { "collapsed_url": "example", "method": "example" }, "domains": [ "example" ], "name": "example", "namespace": "example" }'

GET vulnerabilities for the given Virtual Host.

Examples of this operation.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
namespace
required
string

Namespace Namespace of the virtual host for current request.

name
required
string

Virtual Host Name Virtual Host name for current request.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
GetVulnerabilitiesReq

Request model for GetVulnerabilitiesReq API.

object
api_endpoint
object
collapsed_url
API URL

Requested API endPoint for API URL.

string
>= 1 characters <= 256 characters
method
Method of current API URL

Requested API endPoint for method.

string
<= 1024 characters
domains
List of Domain

List of domains for which vulnerabilities should be returned. Optional filter by domains. If absent, vulnerabilities for all domains are considered.

Array<string>
<= 5 items
name
Virtual Host Name

Virtual Host name for current request.

string
>= 6 characters <= 1024 characters
namespace
Namespace

Namespace of the virtual host for current request.

string
>= 6 characters <= 1024 characters
Examplegenerated
{
  "api_endpoint": {
    "collapsed_url": "example",
    "method": "example"
  },
  "domains": [
    "example"
  ],
  "name": "example",
  "namespace": "example"
}

Responses

Section titled “Responses”

200

Section titled “200”

A successful response.

Media typeapplication/json
GetVulnerabilitiesRsp

Response model for GetVulnerabilitiesRsp API.

object
vulnerabilities
vulnerabilities

List of vulnerabilities found in context.

Array<object>
Vulnerability

Vulnerability object.

object
category
category

Category of the vulnerability found.

string
<= 1024 characters
context
string
default: CONTEXT_API_ENDPOINT
Allowed values: CONTEXT_API_ENDPOINT CONTEXT_API_BASEPATH CONTEXT_API_DOMAIN
creation_time
creation_time

Creation_time is the time when the vulnerability was created by the discovery mechanism. It is the UTC time and represented in RFC3339 form.

string format: date-time
<= 1024 characters
description
description

Description of the vulnerability found.

string
>= 21 characters <= 1024 characters
domain
domain

Domain of the vulnerability found.

string format: hostname
>= 26 characters <= 1024 characters
evidence
object
end_time
end_time

End_time is the time when vulnerability evidence appeared last. It is the UTC time and represented in RFC3339 form.

string format: date-time
<= 1024 characters
evidence_type
string
default: EVIDENCE_TYPE_REQUESTS
Allowed values: EVIDENCE_TYPE_REQUESTS EVIDENCE_TYPE_SEC_EVENTS EVIDENCE_TYPE_SEC_INCIDENTS
samples
samples

Samples due to which vulnerability was found.

Array<object>
VulnEvidenceSample

Vulnerability evidence sample due to which vulnerability was found.

object
details
details

List of details due to which vulnerability was found.

Array<string>
req_id
req_id

Request ID where vulnerability was found.

string
<= 1024 characters
start_time
start_time

Start_time is the time when vulnerability evidence appeared first. It is the UTC time and represented in RFC3339 form.

string format: date-time
<= 1024 characters
last_observed_time
last_observed_time

Last_observed_time is the time when the vulnerability was last observed by the discovery mechanism. It is the UTC time and represented in RFC3339 form.

string format: date-time
<= 1024 characters
remediation
remediation

Remediation of the vulnerability found.

Array<string>
risk
object
level
string
default: RISK_LEVEL_NONE
Allowed values: RISK_LEVEL_NONE RISK_LEVEL_LOW RISK_LEVEL_MED RISK_LEVEL_HIGH RISK_LEVEL_CRITICAL
score
score

Risk score of the vulnerability found.

number format: float
source
string
default: VULNERABILITY_SOURCE_UNSPECIFIED
Allowed values: VULNERABILITY_SOURCE_UNSPECIFIED VULNERABILITY_SOURCE_TRAFFIC_ANALYSIS VULNERABILITY_SOURCE_API_TESTING
status
string
default: STATUS_NONE
Allowed values: STATUS_NONE STATUS_OPEN STATUS_IGNORE STATUS_RESOLUTION_CONFIRMED STATUS_UNDER_REVIEW
status_change_time
status_change_time

Status_change_time is the time when the vulnerability status was updated by the discovery mechanism. It is the UTC time and represented in RFC3339 form.

string format: date-time
<= 1024 characters
ticket
object
external_link
external_link

Fully resolvable hyperlink w/ FQDN to the ticket. This will be the ticket tracking system organization subdomain + external ID.

string
<= 1024 characters
jira_issue
object
fields
object
description
description

The description of the ticket in Atlassian Document Format JSON.

object
issuetype
object
avatar_id
avatar_id

External ID of the avatar.

string
<= 1024 characters
icon_url
icon_url

Externally accessible URL for the avatar of the issue type.

string
<= 1024 characters
id
id

External ID of the Jira issue type.

string
>= 1 <= 4094 <= 1024 characters
name
name

Name (human readable) of the Jira issue type.

string
>= 6 characters <= 1024 characters
project
object
id
id

External ID of the project.

string
>= 1 <= 4094 <= 1024 characters
issue_types
issue_types

Returns available issue types for the project.

Array<object>
JiraIssueType

Issue (ticket) type information that’s specific to Jira - modeled after the JIRA REST API response format.

object
avatar_id
avatar_id

External ID of the avatar.

string
<= 1024 characters
icon_url
icon_url

Externally accessible URL for the avatar of the issue type.

string
<= 1024 characters
id
id

External ID of the Jira issue type.

string
>= 1 <= 4094 <= 1024 characters
name
name

Name (human readable) of the Jira issue type.

string
>= 6 characters <= 1024 characters
key
key

Key of the status.

string
>= 7 characters <= 1024 characters
name
name

Human readable name as it would appear in the external ticket tracking system’s UI.

string
>= 6 characters <= 1024 characters
status
object
icon_url
icon_url

Externally accessible URL for the avatar of the status.

string
<= 1024 characters
id
id

External ID of the status.

string
>= 1 <= 4094 <= 1024 characters
name
name

Human readable status as it would appear in the external ticket tracking system’s UI.

string
>= 6 characters <= 1024 characters
status_category
object
color_name
color_name

Color of the status category.

string
<= 1024 characters
id
id

External ID of the status color.

string format: uint64
>= 1 <= 4094 <= 1024 characters
summary
summary

The summary (title) of the JIRA issue.

string
<= 1024 characters
id
id

External ID of the Jira issue.

string
>= 1 <= 4094 <= 1024 characters
key
key

Cryptographic key material

string
>= 7 characters <= 1024 characters
ticket_tracking_system_type
string
default: TYPE_UNKNOWN
Allowed values: TYPE_UNKNOWN TYPE_JIRA
title
title

Title of the vulnerability found.

string
>= 6 characters <= 1024 characters
vuln_id
vulnerability_id

Vulnerability ID.

string
<= 1024 characters
owasp_categories
owasp_categories

Categories of the vulnerability as per the OWASP API Top 10.

Array<object>
OWASP Category

Represents a category of vulnerability as defined in the OWASP API Top 10.

object
link_to_owasp
OWASP reference link

Link to the OWASP documentation for this category.

string
<= 1024 characters
name
Category name

The name of the OWASP API security category.

string
>= 6 characters <= 1024 characters
Example
{
  "vulnerabilities": [
    {
      "context": "CONTEXT_API_ENDPOINT",
      "evidence": {
        "evidence_type": "EVIDENCE_TYPE_REQUESTS"
      },
      "risk": {
        "level": "RISK_LEVEL_NONE"
      },
      "source": "VULNERABILITY_SOURCE_UNSPECIFIED",
      "status": "STATUS_NONE",
      "ticket": {
        "ticket_tracking_system_type": "TYPE_UNKNOWN"
      }
    }
  ]
}

401

Section titled “401”

Returned when operation is not authorized.

Media typeapplication/json
string format: string
Examplegenerated
example

403

Section titled “403”

Returned when there is no permission to access resource.

Media typeapplication/json
string format: string
Examplegenerated
example

404

Section titled “404”

Returned when resource is not found.

Media typeapplication/json
string format: string
Examplegenerated
example

409

Section titled “409”

Returned when operation on resource is conflicting with current value.

Media typeapplication/json
string format: string
Examplegenerated
example

429

Section titled “429”

Returned when operation has been rejected as it is happening too frequently.

Media typeapplication/json
string format: string
Examplegenerated
example

500

Section titled “500”

Returned when server encountered an error in processing API.

Media typeapplication/json
string format: string
Examplegenerated
example

503

Section titled “503”

Returned when service is unavailable temporarily.

Media typeapplication/json
string format: string
Examplegenerated
example

504

Section titled “504”

Returned when server timed out processing request.

Media typeapplication/json
string format: string
Examplegenerated
example