List

curl --request GET \
  --url https://{region}.api.plerion.com/v1/tenant/vulnerabilities \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://{region}.api.plerion.com/v1/tenant/vulnerabilities"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://{region}.api.plerion.com/v1/tenant/vulnerabilities', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{region}.api.plerion.com/v1/tenant/vulnerabilities",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://{region}.api.plerion.com/v1/tenant/vulnerabilities"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.get("https://{region}.api.plerion.com/v1/tenant/vulnerabilities")
  .header("Authorization", "Bearer <token>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://{region}.api.plerion.com/v1/tenant/vulnerabilities")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "data": [
    {
      "schemaVersion": "2022-06-09",
      "assetId": "prn:assets:a",
      "organizationId": "98ca8825-a65a-4b50-a6f0-4851c406aedc",
      "tenantId": "98ca8825-a65a-4b50-a6f0-4851c406aedc",
      "integrationId": "98ca8825-a65a-4b50-a6f0-4851c406aedc",
      "vulnerabilityId": "CVE-2022-22965",
      "provider": "AWS",
      "assetType": "AWS::EC2::Instance",
      "description": "A flaw was found in shadow-utils.",
      "severityLevel": "HIGH",
      "firstObservedAt": "2023-10-27T04:54:37.830Z",
      "lastObservedAt": "2023-10-27T04:54:37.830Z",
      "publishedDate": "2023-10-27T04:54:37.830Z",
      "executionId": "1678607803935",
      "title": "Sample Vulnerability Title",
      "targetName": "EcsTaskDefinition:15 > nginx:1.19.1-alpine-perl",
      "severitySource": "redhat",
      "primaryUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965",
      "packages": [
        {
          "packageName": "sample-package",
          "targetName": "EcsTaskDefinition:15 > nginx:1.19.1-alpine-perl",
          "targetType": "sample-target-type",
          "targetPath": "ip-172-31-29-14.ap-southeast-2.compute.internal",
          "targetClass": "os-pkgs",
          "fixedVersion": "1.0.1",
          "installedVersion": "1.0.0"
        }
      ],
      "cwes": [
        {
          "id": "1",
          "name": "CWE-123",
          "cweId": "CWE-123",
          "source": "MITRE",
          "sourceUrl": "https://example.com/cwe/CWE-123",
          "description": "This is a sample CWE description."
        }
      ],
      "hasKev": true,
      "hasExploit": false,
      "hasVendorFix": true,
      "knownExploit": {
        "id": "1",
        "title": "Sample Exploit Title",
        "description": "This is a sample exploit description.",
        "source": "MITRE",
        "sourceUrl": "https://example.com/exploit/CVE-2023-12345"
      },
      "exploits": [
        {
          "id": "1",
          "title": "Sample Exploit Title",
          "description": "This is a sample exploit description.",
          "source": "MITRE",
          "sourceUrl": "https://example.com/exploit/CVE-2023-12345"
        }
      ],
      "exemptions": [
        {
          "exemptionId": "e26380da-946e-496e-bebe-9774dae93ed5",
          "exemption": {
            "name": "exemption-rule-001",
            "reason": "ACCEPTED_RISK",
            "createdAt": "2025-06-05T04:54:49.495Z",
            "updatedAt": "2025-06-05T04:54:49.495Z",
            "rules": [
              {
                "exemptionType": "ASSET_VULNERABILITY",
                "vulnerabilityId": "CVE-2025-12345",
                "vulnerabilityIds": [
                  "CVE-2025-12345"
                ],
                "assetIds": [
                  "prn:assets:c00720a1-c167-4fbf-87ea-b6172949b62d:aws:ec2:instance:ap-southeast-2:i-02dd74c78250f9f1a"
                ],
                "assetGroupIds": [
                  "e26380da-946e-496e-bebe-9774dae93ed5"
                ],
                "assetRegions": [
                  "ap-southeast-2"
                ],
                "assetTags": [
                  {
                    "key": "Owner",
                    "value": "TeamOne"
                  }
                ],
                "noVendorFix": false
              }
            ]
          }
        }
      ],
      "severityLevelValue": 4
    }
  ],
  "meta": {
    "perPage": 123,
    "cursor": "<string>",
    "page": 123,
    "total": 123,
    "hasNextPage": true,
    "hasPreviousPage": true
  }
}

List Vulnerabilities in a tenant

Use the list vulnerabilities API to filter vulnerabilities across the tenant with many options from Organization, Tenant, Integration, Asset, Severity, etc. By default all vulnerabilities are returned.

Date range filtering is supported using the firstObservedAtStart and firstObservedAtEnd parameters:

firstObservedAtStart alone: Includes vulnerabilities observed from the specified date to the present.
firstObservedAtEnd alone: Includes vulnerabilities observed up to the specified date.
Both provided: Includes vulnerabilities observed within the specified date range.

Date strings must follow ISO 8601 format (e.g., 2023-02-01T18:09:07Z).

GET

tenant

vulnerabilities

List

curl --request GET \
  --url https://{region}.api.plerion.com/v1/tenant/vulnerabilities \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://{region}.api.plerion.com/v1/tenant/vulnerabilities"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://{region}.api.plerion.com/v1/tenant/vulnerabilities', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{region}.api.plerion.com/v1/tenant/vulnerabilities",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://{region}.api.plerion.com/v1/tenant/vulnerabilities"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.get("https://{region}.api.plerion.com/v1/tenant/vulnerabilities")
  .header("Authorization", "Bearer <token>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://{region}.api.plerion.com/v1/tenant/vulnerabilities")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "data": [
    {
      "schemaVersion": "2022-06-09",
      "assetId": "prn:assets:a",
      "organizationId": "98ca8825-a65a-4b50-a6f0-4851c406aedc",
      "tenantId": "98ca8825-a65a-4b50-a6f0-4851c406aedc",
      "integrationId": "98ca8825-a65a-4b50-a6f0-4851c406aedc",
      "vulnerabilityId": "CVE-2022-22965",
      "provider": "AWS",
      "assetType": "AWS::EC2::Instance",
      "description": "A flaw was found in shadow-utils.",
      "severityLevel": "HIGH",
      "firstObservedAt": "2023-10-27T04:54:37.830Z",
      "lastObservedAt": "2023-10-27T04:54:37.830Z",
      "publishedDate": "2023-10-27T04:54:37.830Z",
      "executionId": "1678607803935",
      "title": "Sample Vulnerability Title",
      "targetName": "EcsTaskDefinition:15 > nginx:1.19.1-alpine-perl",
      "severitySource": "redhat",
      "primaryUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965",
      "packages": [
        {
          "packageName": "sample-package",
          "targetName": "EcsTaskDefinition:15 > nginx:1.19.1-alpine-perl",
          "targetType": "sample-target-type",
          "targetPath": "ip-172-31-29-14.ap-southeast-2.compute.internal",
          "targetClass": "os-pkgs",
          "fixedVersion": "1.0.1",
          "installedVersion": "1.0.0"
        }
      ],
      "cwes": [
        {
          "id": "1",
          "name": "CWE-123",
          "cweId": "CWE-123",
          "source": "MITRE",
          "sourceUrl": "https://example.com/cwe/CWE-123",
          "description": "This is a sample CWE description."
        }
      ],
      "hasKev": true,
      "hasExploit": false,
      "hasVendorFix": true,
      "knownExploit": {
        "id": "1",
        "title": "Sample Exploit Title",
        "description": "This is a sample exploit description.",
        "source": "MITRE",
        "sourceUrl": "https://example.com/exploit/CVE-2023-12345"
      },
      "exploits": [
        {
          "id": "1",
          "title": "Sample Exploit Title",
          "description": "This is a sample exploit description.",
          "source": "MITRE",
          "sourceUrl": "https://example.com/exploit/CVE-2023-12345"
        }
      ],
      "exemptions": [
        {
          "exemptionId": "e26380da-946e-496e-bebe-9774dae93ed5",
          "exemption": {
            "name": "exemption-rule-001",
            "reason": "ACCEPTED_RISK",
            "createdAt": "2025-06-05T04:54:49.495Z",
            "updatedAt": "2025-06-05T04:54:49.495Z",
            "rules": [
              {
                "exemptionType": "ASSET_VULNERABILITY",
                "vulnerabilityId": "CVE-2025-12345",
                "vulnerabilityIds": [
                  "CVE-2025-12345"
                ],
                "assetIds": [
                  "prn:assets:c00720a1-c167-4fbf-87ea-b6172949b62d:aws:ec2:instance:ap-southeast-2:i-02dd74c78250f9f1a"
                ],
                "assetGroupIds": [
                  "e26380da-946e-496e-bebe-9774dae93ed5"
                ],
                "assetRegions": [
                  "ap-southeast-2"
                ],
                "assetTags": [
                  {
                    "key": "Owner",
                    "value": "TeamOne"
                  }
                ],
                "noVendorFix": false
              }
            ]
          }
        }
      ],
      "severityLevelValue": 4
    }
  ],
  "meta": {
    "perPage": 123,
    "cursor": "<string>",
    "page": 123,
    "total": 123,
    "hasNextPage": true,
    "hasPreviousPage": true
  }
}

Authorizations

Authorization

string

header

required

Bearer API Key. For example, "Bearer {Tenant API Key}"

Headers

Authorization

string

required

Bearer API Key. For example, "Bearer {Tenant API Key}"

Content-Type

string

application/json

Query Parameters

vulnerabilityIds

string

Filter vulnerabilities on vulnerability ids. Accepts a comma-separated list with a maximum length of 100

Example:

"CVE-2022-22965,CVE-2022-22966,CVE-2022-22967"

assetIds

string

Filter vulnerabilities on asset ids. Accepts a comma-separated list with a maximum length of 10

Example:

["prn:assets:a,prn:assets:b"]

providers

enum<string>

Filter vulnerabilities based on provider. Accepts a comma-separated list of providers.

Available options:

AWS,

Azure,

GCP,

Kubernetes

Example:

"AWS,GCP"

executionIds

string

Filter vulnerabilities on execution ids. Accepts a comma-separated list with a maximum length of 10

Example:

"1678607803935,1778607801234"

integrationIds

string

Filter vulnerabilities on integration ids. Accepts a comma-separated list with a maximum length of 10

Example:

"UUID1,UUID2"

assetGroupIds

string

Filter vulnerabilities on asset group ids. Accepts a comma-separated list of asset group ids.

Example:

"UUID1,UUID2"

environmentIds

string

Filter vulnerabilities on the environment. This parameter accepts any combination of environment name or environment IDs (UUIDs) in a comma-separated list.

Supported environment names:

production - Production environment
non-production - Non-production environment

Example:

"production,550e8400-e29b-41d4-a716-446655440000"

packageName

string

Filter vulnerabilities on a package name.

Example:

"lodash"

regions

string

Filter vulnerabilities on asset regions.

Example:

"us-east-1,us-west-2"

targetName

string

Filter vulnerabilities on a target name. For ECS Task Definitions this will be {TaskDefinition}:{revision} > {containerImage}

Example:

"EcsTaskDefinition:15 > nginx:1.19.1-alpine-perl"

targetType

string

Filter vulnerabilities on a target type.

Example:

"targetType"

targetClass

string

Filter vulnerabilities on a target class.

Example:

"lang-pkgs,os-pkgs"

hasKev

boolean

Filter vulnerabilities on hasKev. Accepts true or false.

Example:

true

isExempted

boolean

default:false

Filter vulnerabilities based on exemptions. Returns exempted vulnerabilities if set true. Accepts true or false.

Example:

true

isExploitable

boolean

Filter vulnerabilities based on exploitability under the Common Vulnerability Scoring System (CVSS). Accepts true or false.

Example:

true

hasExploit

boolean

Filter vulnerabilities on hasExploit. Accepts true or false.

Example:

true

hasVendorFix

boolean

Filter vulnerabilities where the affected packages have a fixed version. Is true if any affected package has a fixed version. Accepts true or false.

Example:

true

severityLevels

enum<string>

Filter vulnerabilities on severity. Accepts a comma-separated list.

Available options:

CRITICAL,

HIGH,

MEDIUM,

LOW,

INFORMATIONAL,

UNKNOWN

Example:

"CRITICAL,HIGH"

firstObservedAtStart

string<date-time>

Start of the date range for filtering vulnerabilities based on the first observed time. Specify the start of the range using a valid ISO 8601 date-time string. If firstObservedAtStart is provided and firstObservedAtEnd is omitted, results will include vulnerabilities observed from this date to the present. Supported formats include:

yyyy-MM-ddTHH:mm:ssZ (e.g., 2020-12-18T08:00:00Z)
yyyy-MM-ddTHH:mm:ss.SSSZ (e.g., 2020-12-18T08:00:00.000Z)

Example:

"2023-02-01T18:09:07Z"

firstObservedAtEnd

string<date-time>

End of the date range for filtering vulnerabilities based on the first observed time. Specify the end of the range using a valid ISO 8601 date-time string. If firstObservedAtEnd is provided and firstObservedAtStart is omitted, results will include vulnerabilities observed up to this date. Supported formats include:

yyyy-MM-ddTHH:mm:ssZ (e.g., 2020-12-18T08:00:00Z)
yyyy-MM-ddTHH:mm:ss.SSSZ (e.g., 2020-12-18T08:00:00.000Z)

Example:

"2023-02-01T18:09:07Z"

sortBy

enum<string>

Sort results by the specified field.

Available options:

hasKev,

hasExploit,

lastObservedAt,

firstObservedAt,

severityLevelValue

Example:

"hasExploit"

sortOrder

enum<string>

Sort order for the results.

Available options:

ASC,

DESC

Example:

"ASC"

page

integer

default:1

Page number for the results. Accepts a positive integer.

Required range: x >= 1

Example:

10

perPage

integer

default:100

Number of results per page. Accepts a positive integer.

Required range: x <= 2000

Example:

50

cursor

string

Get the next batch of vulnerabilities. Used for pagination. When cursor is provided, the response will not include total count.

includeTotal

boolean

default:true

Include the total count of available vulnerabilities. Defaults to true. Set to false to improve response times for large datasets.

Example:

true

Response

Successful response with the list of vulnerabilities

data

object[]

Show child attributes

Overview

API documentation

List Vulnerabilities in a tenant

Authorizations

Headers

Query Parameters

Response