Get vulnerability

GET

vulnerabilities

{vulnerabilityId}

Get vulnerability

curl --request GET \
  --url https://api.perfai.ai/v1/vulnerabilities/{vulnerabilityId} \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.perfai.ai/v1/vulnerabilities/{vulnerabilityId}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.perfai.ai/v1/vulnerabilities/{vulnerabilityId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.perfai.ai/v1/vulnerabilities/{vulnerabilityId}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.perfai.ai/v1/vulnerabilities/{vulnerabilityId}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "id": "<string>",
  "label": "<string>",
  "title": "<string>",
  "severity": "Critical",
  "path": "<string>",
  "method": "<string>",
  "uiPath": "<string>",
  "updated_severity": "<string>",
  "impact": "<string>",
  "issueType": "<string>",
  "action": "<string>",
  "intent": "<string>",
  "owasp": "<string>",
  "cwe": "<string>",
  "cvss_score": 123,
  "cvss_vector": "<string>",
  "isPII": true,
  "isPCI": true,
  "isHIPAA": true,
  "explainer": "<string>",
  "remediation": "<string>",
  "additionalDetails": {},
  "request": "<string>",
  "response": {},
  "unsecureRequest": "<string>",
  "unsecuredResponse": {},
  "requestSchema": {},
  "responseSchema": {},
  "fields": [
    {}
  ],
  "isFixed": true,
  "isDismissed": true,
  "fixClaimed": true,
  "fixClaimedAt": "2023-11-07T05:31:56Z",
  "fixClaimedByEmail": "<string>",
  "fixComment": "<string>",
  "isCustomIssue": true,
  "created_on": "2023-11-07T05:31:56Z",
  "updated_on": "2023-11-07T05:31:56Z"
}

{
  "type": "<string>",
  "title": "<string>"
}

{
  "type": "<string>",
  "title": "<string>"
}

Authorizations

Authorization

string

header

required

JWT login token tied to your Perfai user (not a separate API key). Obtain it via POST /api/v1/auth/token with your username and password (use the returned id_token) — the same login the web console performs. Carries org, user, and role; short-lived.

Path Parameters

vulnerabilityId

string

required

MongoDB ObjectId of the finding — the id of an item from GET /apps/{appId}/vulnerabilities.

Response

The finding.

A security finding, projected onto the public contract — internal test plumbing (token, decodedKey, errors, buildDetails) is never emitted. This is the same detail the Perfai dashboard shows a user. Only id, label, severity, path and method are present on every finding; every other field is conditional and omitted when the scan produced no value for it.

string

Finding identifier. Always present.

label

string

Canonical finding name from the security-category registry. Always present.

title

string

severity

enum<string>

Always present.

Available options:

Critical,

High,

Medium,

Low

path

string

API path where the issue was found. Always present.

method

string

HTTP method of the affected endpoint. Always present.

uiPath

string

UI route the finding was reproduced through.

updated_severity

string

Severity after a manual override.

impact

string

Business and security impact summary.

issueType

string

security or privacy.

action

string

Action classification the scanner assigned.

intent

string

Intended request behaviour the test exercised.

owasp

string

OWASP API Security Top 10 reference (e.g. API1:2023).

cwe

string

CWE identifier (e.g. CWE-639).

cvss_score

number

CVSS v3 base score (0.0-10.0).

cvss_vector

string

CVSS v3 vector string.

isPII

boolean

isPCI

boolean

isHIPAA

boolean

explainer

string

Technical explanation of the vulnerability.

remediation

string

Recommended fix.

additionalDetails

object

Deep-dive analysis when available: description, StepsToReproduce, impact_analysis, mitigation, long_solution, references, conclusion, copilot_prompt, workingExamples. Which keys are present varies by finding.

request

string

cURL reproducer for the authenticated request.

response

object

Response body observed for the authenticated request.

unsecureRequest

string

cURL reproducer for the same call made without authentication.

unsecuredResponse

object

Response body observed for the unauthenticated request.

requestSchema

object

JSON Schema of the request body.

responseSchema

object

JSON Schema of the response body.

fields

object[]

Affected or sensitive fields, each with a name, data type and location.

isFixed

boolean

Set by the platform once a previously-reported finding stops being detected by a later test. Not settable by callers.

isDismissed

boolean

fixClaimed

boolean

Someone asserted this finding is fixed — a claim pending verification, distinct from isFixed. If the next test still detects the finding, the claim is dropped and the finding stays open.

fixClaimedAt

string<date-time> | null

fixClaimedByEmail

string | null

fixComment

string | null

isCustomIssue

boolean

true for a manually created finding.

created_on

string<date-time> | null

updated_on

string<date-time> | null

Get vulnerability

curl --request GET \
  --url https://api.perfai.ai/v1/vulnerabilities/{vulnerabilityId} \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.perfai.ai/v1/vulnerabilities/{vulnerabilityId}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.perfai.ai/v1/vulnerabilities/{vulnerabilityId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.perfai.ai/v1/vulnerabilities/{vulnerabilityId}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.perfai.ai/v1/vulnerabilities/{vulnerabilityId}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "id": "<string>",
  "label": "<string>",
  "title": "<string>",
  "severity": "Critical",
  "path": "<string>",
  "method": "<string>",
  "uiPath": "<string>",
  "updated_severity": "<string>",
  "impact": "<string>",
  "issueType": "<string>",
  "action": "<string>",
  "intent": "<string>",
  "owasp": "<string>",
  "cwe": "<string>",
  "cvss_score": 123,
  "cvss_vector": "<string>",
  "isPII": true,
  "isPCI": true,
  "isHIPAA": true,
  "explainer": "<string>",
  "remediation": "<string>",
  "additionalDetails": {},
  "request": "<string>",
  "response": {},
  "unsecureRequest": "<string>",
  "unsecuredResponse": {},
  "requestSchema": {},
  "responseSchema": {},
  "fields": [
    {}
  ],
  "isFixed": true,
  "isDismissed": true,
  "fixClaimed": true,
  "fixClaimedAt": "2023-11-07T05:31:56Z",
  "fixClaimedByEmail": "<string>",
  "fixComment": "<string>",
  "isCustomIssue": true,
  "created_on": "2023-11-07T05:31:56Z",
  "updated_on": "2023-11-07T05:31:56Z"
}

{
  "type": "<string>",
  "title": "<string>"
}

{
  "type": "<string>",
  "title": "<string>"
}

Getting Started

Core Concepts

Hybrid Deployment

Changelog

Authorizations

Path Parameters

Response