Retrieve a specific suspected vulnerability

GET

organizations

{organizationUid}

suspected-vulnerabilities

{id}

Retrieve a specific suspected vulnerability

curl --request GET \
  --url https://{environment}.synack.com/api/vulnerability/v1/organizations/{organizationUid}/suspected-vulnerabilities/{id}

{
  "suspectedVulnerability": {
    "id": 2000,
    "assetUid": "ah28034gsjdf98eqwgbjufj",
    "listingUid": "ah28034gsjdf",
    "listingCodename": "ACME-H001",
    "organizationUid": "ah28034gsjdf",
    "categoryInScope": true,
    "confidence": "firm",
    "cvssBase": 5.4,
    "exploitableLocations": [
      {}
    ],
    "falsePositive": true,
    "payload": {},
    "referenceUrls": [
      "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitoring_ec2.html",
      "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html"
    ],
    "severity": "low",
    "source": "synack",
    "sourceId": "job-abc-123",
    "vulnerabilityStatusId": 123,
    "reasonTitle": "<string>",
    "reasonDescription": "<string>",
    "automatedTriageStatus": "<string>",
    "automatedTriageStatusUpdatedAt": "2023-12-25T15:45:30.123Z",
    "cves": [
      "CVE-2025-1238923"
    ],
    "cwes": [
      "CWE-1238923"
    ],
    "status": "<string>",
    "typeId": "Type-69d55e",
    "typeTitle": "SQL Injection",
    "typeCategoryId": "<string>",
    "typeCategoryParentName": "<string>",
    "typeCategoryChildName": "<string>",
    "typeDescription": "<string>",
    "exploitableVulnerabilityId": "test_e859b6a8371c-m001-4",
    "createdAt": "2023-12-25T15:45:30.123Z",
    "lastDetectedAt": "2023-12-25T15:45:30.123Z",
    "triageIneligibleReason": "Triage already started or performed.",
    "solution": "Microsoft has released security update KB5002113 to address this issue.",
    "vendorRiskScore": 1.3,
    "triages": [
      {
        "id": "<string>",
        "content": {
          "thoughts": [
            {
              "triageId": "<string>",
              "targetId": "<string>",
              "thoughtId": "<string>",
              "thoughtType": "<string>",
              "thoughtContent": "<string>",
              "toolExecution": {
                "name": "<string>",
                "input": "<string>",
                "output": "<string>",
                "error": "<string>"
              },
              "block": {
                "parentThoughtId": "<string>",
                "predecessorThoughtId": "<string>"
              },
              "addedAt": "2023-11-07T05:31:56Z"
            }
          ],
          "report": "<string>"
        }
      }
    ]
  },
  "metadata": {
    "pagination": {
      "total": 123,
      "page": 123,
      "perPage": 123,
      "totalPages": 123,
      "prev": "<string>",
      "next": "<string>",
      "first": "<string>",
      "last": "<string>",
      "self": "<string>"
    },
    "actions": {}
  }
}

Path Parameters

organizationUid

string

required

Unique identifier for the organization that owns the vulnerability being retrieved

integer<int32>

required

Unique identifier for the specific suspected vulnerability to retrieve

Response

Successfully retrieved detailed information for a single suspected vulnerability, including associated triage data and related metadata.

suspectedVulnerability

object

Extended suspected vulnerability schema that includes embedded triage assessments. Used specifically for single vulnerability responses where triage data is included.

Show child attributes

suspectedVulnerability.id

integer<int64>

Unique numeric identifier for the suspected vulnerability

Example:

2000

suspectedVulnerability.assetUid

string

Unique identifier for the asset where the vulnerability was discovered

Example:

"ah28034gsjdf98eqwgbjufj"

suspectedVulnerability.listingUid

string

Unique identifier for the penetration testing listing/engagement scope

Example:

"ah28034gsjdf"

suspectedVulnerability.listingCodename

string

Human-readable codename for the penetration testing engagement

Example:

"ACME-H001"

suspectedVulnerability.organizationUid

string

Unique identifier for the organization that owns this vulnerability

Example:

"ah28034gsjdf"

suspectedVulnerability.categoryInScope

boolean

Indicates whether this vulnerability category is within the current testing scope

suspectedVulnerability.confidence

string

Confidence level of the vulnerability assessment (e.g., 'firm', 'tentative', 'certain')

Example:

"firm"

suspectedVulnerability.cvssBase

number<double>

CVSS (Common Vulnerability Scoring System) base score indicating severity (0-10 scale)

Example:

5.4

suspectedVulnerability.exploitableLocations

object[]

List of key-value maps describing exploitable locations

Show child attributes

suspectedVulnerability.exploitableLocations.{key}

string

suspectedVulnerability.falsePositive

boolean

Flag indicating whether this vulnerability has been determined to be a false positive

suspectedVulnerability.payload

object

Additional vulnerability data and metadata from the detection source

Show child attributes

suspectedVulnerability.payload.{key}

string

suspectedVulnerability.referenceUrls

string[]

External reference URLs providing additional context about the vulnerability

Example:

[
  "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitoring_ec2.html",
  "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html"
]

suspectedVulnerability.severity

string

Normalized severity classification (e.g., 'low', 'medium', 'high', 'critical')

Example:

"low"

suspectedVulnerability.source

string

Tool or system that originally detected this vulnerability

Example:

"synack"

suspectedVulnerability.sourceId

string

Unique identifier for the source job or detection run that created this vulnerability

Example:

"job-abc-123"

suspectedVulnerability.vulnerabilityStatusId

integer<int64>

Numeric identifier for the vulnerability's current status in the workflow

suspectedVulnerability.reasonTitle

string

Brief title explaining the reason for the current status or assessment

suspectedVulnerability.reasonDescription

string

Detailed explanation of the reasoning behind the current status or triage decision

suspectedVulnerability.automatedTriageStatus

string

Current status of the vulnerability in the automated triage workflow

suspectedVulnerability.automatedTriageStatusUpdatedAt

string<date-time>

ISO 8601 timestamp when the automated triage status was last updated

Example:

"2023-12-25T15:45:30.123Z"

suspectedVulnerability.cves

string[]

List of Common Vulnerabilities and Exposures (CVE) identifiers associated with this vulnerability

suspectedVulnerability.cwes

string[]

List of Common Weakness Enumeration (CWE) identifiers classifying this vulnerability type

suspectedVulnerability.status

string

Current workflow status of the vulnerability (e.g., 'eligible', 'vulnerable', 'not_vulnerable')

suspectedVulnerability.typeId

string

String identifier for the vulnerability type classification

Example:

"Type-69d55e"

suspectedVulnerability.typeTitle

string

Title of the vulnerability type

Example:

"SQL Injection"

suspectedVulnerability.typeCategoryId

string

Identifier for the category that this vulnerability type belongs to

suspectedVulnerability.typeCategoryParentName

string

Name of the parent category for hierarchical vulnerability classification

suspectedVulnerability.typeCategoryChildName

string

Name of the child category for hierarchical vulnerability classification

suspectedVulnerability.typeDescription

string

Description of the vulnerability type

suspectedVulnerability.exploitableVulnerabilityId

string

Unique identifier linking this vulnerability to exploitable vulnerability records

Example:

"test_e859b6a8371c-m001-4"

suspectedVulnerability.createdAt

string<date-time>

ISO 8601 timestamp when the vulnerability was first created in the system

Example:

"2023-12-25T15:45:30.123Z"

suspectedVulnerability.lastDetectedAt

string<date-time>

ISO 8601 timestamp when the vulnerability was most recently detected or confirmed

Example:

"2023-12-25T15:45:30.123Z"

suspectedVulnerability.triageIneligibleReason

string

Reason why the vulnerability is not eligible for automated triage

Example:

"Triage already started or performed."

suspectedVulnerability.solution

string

Solution to the vulnerability

Example:

"Microsoft has released security update KB5002113 to address this issue."

suspectedVulnerability.vendorRiskScore

number

A risk score value provided by the vendor of the imported vulnerability.

Example:

1.3

suspectedVulnerability.triages

object[]

Associated triage assessments for this vulnerability

Show child attributes

suspectedVulnerability.triages.id

string

Unique identifier for this triage assessment

suspectedVulnerability.triages.content

object

Detailed content of the triage analysis

Show child attributes

suspectedVulnerability.triages.content.thoughts

object[]

List of analytical thoughts or observations from the triage process

Show child attributes

suspectedVulnerability.triages.content.thoughts.triageId

string

Unique identifier for this triage assessment

suspectedVulnerability.triages.content.thoughts.targetId

string

Unique identifier for the target of this triage assessment

suspectedVulnerability.triages.content.thoughts.thoughtId

string

Unique identifier for this thought

suspectedVulnerability.triages.content.thoughts.thoughtType

string

Type of thought

suspectedVulnerability.triages.content.thoughts.thoughtContent

string

Content of the thought

suspectedVulnerability.triages.content.thoughts.toolExecution

object

Tool execution data for a vulnerability triage, including analysis and reporting

Show child attributes

suspectedVulnerability.triages.content.thoughts.toolExecution.name

string

Name of the tool

suspectedVulnerability.triages.content.thoughts.toolExecution.input

string

Input to the tool

suspectedVulnerability.triages.content.thoughts.toolExecution.output

string

Output of the tool

suspectedVulnerability.triages.content.thoughts.toolExecution.error

string

Error of the tool

suspectedVulnerability.triages.content.thoughts.block

object

Block data for a vulnerability triage, including analysis and reporting

Show child attributes

suspectedVulnerability.triages.content.thoughts.block.parentThoughtId

string

Unique identifier for the parent thought

suspectedVulnerability.triages.content.thoughts.block.predecessorThoughtId

string

Unique identifier for the predecessor thought

suspectedVulnerability.triages.content.thoughts.addedAt

string<date-time>

ISO 8601 timestamp when the thought was added

suspectedVulnerability.triages.content.report

string

Comprehensive triage report with findings and recommendations

metadata

object

Additional metadata accompanying API responses

Show child attributes

metadata.pagination

object

Pagination metadata for navigating through large result sets

Show child attributes

metadata.pagination.total

integer

required

Total number of items across all pages

metadata.pagination.page

integer

required

Current page number (1-based)

metadata.pagination.perPage

integer

required

Number of items per page

metadata.pagination.totalPages

integer

required

Total number of pages available

metadata.pagination.prev

string

URL for the previous page (null if on first page)

metadata.pagination.next

string

URL for the next page (null if on last page)

metadata.pagination.first

string

URL for the first page

metadata.pagination.last

string

URL for the last page

metadata.pagination.self

string

URL for the current page

metadata.actions

object

Available actions that can be performed on the returned data

Create Asset TagsCreate new tags. 409 Conflict is logged as warn if the name matches the name of a tag that already exists in a given org uid.

⌘I

Retrieve a specific suspected vulnerability

curl --request GET \
  --url https://{environment}.synack.com/api/vulnerability/v1/organizations/{organizationUid}/suspected-vulnerabilities/{id}

{
  "suspectedVulnerability": {
    "id": 2000,
    "assetUid": "ah28034gsjdf98eqwgbjufj",
    "listingUid": "ah28034gsjdf",
    "listingCodename": "ACME-H001",
    "organizationUid": "ah28034gsjdf",
    "categoryInScope": true,
    "confidence": "firm",
    "cvssBase": 5.4,
    "exploitableLocations": [
      {}
    ],
    "falsePositive": true,
    "payload": {},
    "referenceUrls": [
      "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitoring_ec2.html",
      "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html"
    ],
    "severity": "low",
    "source": "synack",
    "sourceId": "job-abc-123",
    "vulnerabilityStatusId": 123,
    "reasonTitle": "<string>",
    "reasonDescription": "<string>",
    "automatedTriageStatus": "<string>",
    "automatedTriageStatusUpdatedAt": "2023-12-25T15:45:30.123Z",
    "cves": [
      "CVE-2025-1238923"
    ],
    "cwes": [
      "CWE-1238923"
    ],
    "status": "<string>",
    "typeId": "Type-69d55e",
    "typeTitle": "SQL Injection",
    "typeCategoryId": "<string>",
    "typeCategoryParentName": "<string>",
    "typeCategoryChildName": "<string>",
    "typeDescription": "<string>",
    "exploitableVulnerabilityId": "test_e859b6a8371c-m001-4",
    "createdAt": "2023-12-25T15:45:30.123Z",
    "lastDetectedAt": "2023-12-25T15:45:30.123Z",
    "triageIneligibleReason": "Triage already started or performed.",
    "solution": "Microsoft has released security update KB5002113 to address this issue.",
    "vendorRiskScore": 1.3,
    "triages": [
      {
        "id": "<string>",
        "content": {
          "thoughts": [
            {
              "triageId": "<string>",
              "targetId": "<string>",
              "thoughtId": "<string>",
              "thoughtType": "<string>",
              "thoughtContent": "<string>",
              "toolExecution": {
                "name": "<string>",
                "input": "<string>",
                "output": "<string>",
                "error": "<string>"
              },
              "block": {
                "parentThoughtId": "<string>",
                "predecessorThoughtId": "<string>"
              },
              "addedAt": "2023-11-07T05:31:56Z"
            }
          ],
          "report": "<string>"
        }
      }
    ]
  },
  "metadata": {
    "pagination": {
      "total": 123,
      "page": 123,
      "perPage": 123,
      "totalPages": 123,
      "prev": "<string>",
      "next": "<string>",
      "first": "<string>",
      "last": "<string>",
      "self": "<string>"
    },
    "actions": {}
  }
}

Asset Management v2 API

Vulnerability Management API

Asset Tagging v1 API

Platform v1 API

Query API v1

Retrieve a specific suspected vulnerability

Path Parameters

Response