Reference
Get vulnerabilities
Returns security findings for the app. While a test is active the response carries status RUN_IN_PROGRESS — poll the run status endpoint and retry once COMPLETED.
GET
/
apps
/
{appId}
/
vulnerabilities
Get vulnerabilities
curl --request GET \
--url https://api.perfai.ai/v1/apps/{appId}/vulnerabilities \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.perfai.ai/v1/apps/{appId}/vulnerabilities"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.perfai.ai/v1/apps/{appId}/vulnerabilities', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.perfai.ai/v1/apps/{appId}/vulnerabilities",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.perfai.ai/v1/apps/{appId}/vulnerabilities"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.perfai.ai/v1/apps/{appId}/vulnerabilities")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.perfai.ai/v1/apps/{appId}/vulnerabilities")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"status": "COMPLETED",
"data": [
{
"id": "<string>",
"label": "<string>",
"title": "<string>",
"severity": "Critical",
"path": "<string>",
"method": "<string>",
"uiPath": "<string>",
"updated_severity": "<string>",
"impact": "<string>",
"issueType": "<string>",
"action": "<string>",
"intent": "<string>",
"owasp": "<string>",
"cwe": "<string>",
"cvss_score": 123,
"cvss_vector": "<string>",
"isPII": true,
"isPCI": true,
"isHIPAA": true,
"explainer": "<string>",
"remediation": "<string>",
"additionalDetails": {},
"request": "<string>",
"response": {},
"unsecureRequest": "<string>",
"unsecuredResponse": {},
"requestSchema": {},
"responseSchema": {},
"fields": [
{}
],
"isFixed": true,
"isDismissed": true,
"fixClaimed": true,
"fixClaimedAt": "2023-11-07T05:31:56Z",
"fixClaimedByEmail": "<string>",
"fixComment": "<string>",
"isCustomIssue": true,
"created_on": "2023-11-07T05:31:56Z",
"updated_on": "2023-11-07T05:31:56Z"
}
],
"total": 123,
"page": 123,
"pageSize": 123,
"lastRunId": "<string>",
"lastRunCompletedAt": "2023-11-07T05:31:56Z"
}{
"type": "<string>",
"title": "<string>"
}Authorizations
JWT login token tied to your Perfai user (not a separate API key). Obtain it via POST /api/v1/auth/token with your username and password (use the returned id_token) — the same login the web console performs. Carries org, user, and role; short-lived.
Path Parameters
MongoDB ObjectId of the app (from GET /apps or POST /apps).
Query Parameters
Required range:
x >= 1Required range:
1 <= x <= 100Free-text filter across the finding's text fields.
Only return findings of this severity (case-insensitive).
Available options:
Critical, High, Medium, Low Filter by whether Perfai has confirmed the finding is fixed.
Filter by whether the finding has been dismissed as accepted risk.
⌘I
Get vulnerabilities
curl --request GET \
--url https://api.perfai.ai/v1/apps/{appId}/vulnerabilities \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.perfai.ai/v1/apps/{appId}/vulnerabilities"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.perfai.ai/v1/apps/{appId}/vulnerabilities', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.perfai.ai/v1/apps/{appId}/vulnerabilities",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.perfai.ai/v1/apps/{appId}/vulnerabilities"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.perfai.ai/v1/apps/{appId}/vulnerabilities")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.perfai.ai/v1/apps/{appId}/vulnerabilities")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"status": "COMPLETED",
"data": [
{
"id": "<string>",
"label": "<string>",
"title": "<string>",
"severity": "Critical",
"path": "<string>",
"method": "<string>",
"uiPath": "<string>",
"updated_severity": "<string>",
"impact": "<string>",
"issueType": "<string>",
"action": "<string>",
"intent": "<string>",
"owasp": "<string>",
"cwe": "<string>",
"cvss_score": 123,
"cvss_vector": "<string>",
"isPII": true,
"isPCI": true,
"isHIPAA": true,
"explainer": "<string>",
"remediation": "<string>",
"additionalDetails": {},
"request": "<string>",
"response": {},
"unsecureRequest": "<string>",
"unsecuredResponse": {},
"requestSchema": {},
"responseSchema": {},
"fields": [
{}
],
"isFixed": true,
"isDismissed": true,
"fixClaimed": true,
"fixClaimedAt": "2023-11-07T05:31:56Z",
"fixClaimedByEmail": "<string>",
"fixComment": "<string>",
"isCustomIssue": true,
"created_on": "2023-11-07T05:31:56Z",
"updated_on": "2023-11-07T05:31:56Z"
}
],
"total": 123,
"page": 123,
"pageSize": 123,
"lastRunId": "<string>",
"lastRunCompletedAt": "2023-11-07T05:31:56Z"
}{
"type": "<string>",
"title": "<string>"
}
