> ## Documentation Index > Fetch the complete documentation index at: https://docs.cyrisma.com/llms.txt > Use this file to discover all available pages before exploring further. # Export vulnerability events for authorized partner tenants. > This endpoint returns a single-page export of live vulnerability detection events, within a bounded time window, for the authorized partner's tenant scope. The response is returned with a `Content-Disposition: attachment` header naming a timestamped export file. **Notes:** - `tenant_ids` (optional, comma-separated) restricts the export to specific tenants. - `from` / `to` (optional, ISO-8601 timestamps) bound the detection window; defaults to the last 24 hours. `from` must not be later than `to`. - `source_type`, `severity`, `root_cause_type`, and `patchability` filter the result set. - `format` (optional, default `json`) selects the export format; only `json` is currently supported; any other value returns 400. - The export is capped at the maximum page size (500 events) and is not cursor-paginated. Required headers: - `Authorization: Bearer {token}` (requires the `pulse.read` scope) ## OpenAPI ````yaml /api/partner-api/reporting.json get /pulse/v1/partner/exports/vulnerability-events openapi: 3.1.1 info: title: 'Cyrisma New Partner API: Reporting' version: v1 servers: - url: https://{instance}.cyrisma.com/app description: The partner's CYRISMA instance host. variables: instance: default: ccnnnnnn description: The instance label of the tenant host issued to the partner. security: - bearerAuth: - pulse.read tags: - name: Reporting paths: /pulse/v1/partner/exports/vulnerability-events: get: tags: - Reporting summary: Export vulnerability events for authorized partner tenants. description: >- This endpoint returns a single-page export of live vulnerability detection events, within a bounded time window, for the authorized partner's tenant scope. The response is returned with a `Content-Disposition: attachment` header naming a timestamped export file. **Notes:** - `tenant_ids` (optional, comma-separated) restricts the export to specific tenants. - `from` / `to` (optional, ISO-8601 timestamps) bound the detection window; defaults to the last 24 hours. `from` must not be later than `to`. - `source_type`, `severity`, `root_cause_type`, and `patchability` filter the result set. - `format` (optional, default `json`) selects the export format; only `json` is currently supported; any other value returns 400. - The export is capped at the maximum page size (500 events) and is not cursor-paginated. Required headers: - `Authorization: Bearer {token}` (requires the `pulse.read` scope) operationId: ExportPartnerVulnerabilityEventsV1 parameters: - name: tenant_ids in: query description: >- Comma-separated tenant UUIDs to scope the list to. Omit to use every tenant the caller is authorized for. schema: type: string - name: from in: query description: Start of the window, RFC 3339. Treated as UTC. schema: type: string - name: to in: query description: End of the window, RFC 3339. Treated as UTC. schema: type: string - name: format in: query description: Export encoding. schema: enum: - json - csv type: string responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/PartnerVulnerabilityEventExportResponse' '400': description: Bad Request '401': description: Unauthorized content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' '403': description: Forbidden content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' '503': description: Service Unavailable content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' components: schemas: PartnerVulnerabilityEventExportResponse: required: - root_tenant_id - generated_at - from - to - format - coverage - items type: object properties: root_tenant_id: type: string format: uuid generated_at: type: string format: date-time from: type: string format: date-time to: type: string format: date-time format: type: string coverage: type: array items: $ref: '#/components/schemas/PartnerTenantCoverage' items: type: array items: $ref: '#/components/schemas/GlobalDetectionRow' ProblemDetails: type: object properties: type: type: - 'null' - string title: type: - 'null' - string status: pattern: ^-?(?:0|[1-9]\d*)$ type: - 'null' - integer - string format: int32 detail: type: - 'null' - string instance: type: - 'null' - string PartnerTenantCoverage: required: - tenant_id - tenant_host type: object properties: tenant_id: type: string format: uuid tenant_host: type: string GlobalDetectionRow: required: - finding_event_id - tenant_id - tenant_host - event_type - occurred_at - cve_id - description - severity - cvss_score - cvr_score - epss_probability - exploitability_label - root_cause_key - root_cause_label - source_type - asset_id - asset_display_name - asset_type - os_family - os_name - agent_status type: object properties: finding_event_id: type: string format: uuid tenant_id: type: string format: uuid tenant_host: type: string event_type: $ref: '#/components/schemas/GlobalFindingEventType' occurred_at: type: - 'null' - string format: date-time cve_id: type: - 'null' - string description: type: - 'null' - string severity: oneOf: - type: 'null' - $ref: '#/components/schemas/GlobalSeverity' cvss_score: pattern: ^-?(?:0|[1-9]\d*)(?:\.\d+)?$ type: - 'null' - number - string format: double cvr_score: pattern: ^-?(?:0|[1-9]\d*)(?:\.\d+)?$ type: - 'null' - number - string format: double epss_probability: pattern: ^-?(?:0|[1-9]\d*)(?:\.\d+)?$ type: - 'null' - number - string format: double exploitability_label: type: - 'null' - string root_cause_key: type: - 'null' - string root_cause_label: type: - 'null' - string source_type: oneOf: - type: 'null' - $ref: '#/components/schemas/GlobalSourceType' asset_id: type: string asset_display_name: type: - 'null' - string asset_type: $ref: '#/components/schemas/GlobalAssetType' os_family: type: - 'null' - string os_name: type: - 'null' - string agent_status: type: - 'null' - string tenant_name: type: - 'null' - string detected_while_offline: type: boolean default: false exploit_sources: type: - 'null' - array items: type: string GlobalFindingEventType: enum: - opened - evidence_changed - fixed - reopened - suppressed - remediated - unknown GlobalSeverity: enum: - critical - high - medium - low - info - unknown GlobalSourceType: enum: - endpoint - network - external - domain - unknown GlobalAssetType: enum: - endpoint - host - server - workstation - network_device - printer - router - switch - firewall - service - external - domain - unknown securitySchemes: bearerAuth: type: http description: >- A Tenant Authority machine-client token from POST /v1/auth/client-token, carrying subject_type=machine_client and the pulse.read scope. scheme: bearer bearerFormat: JWT ````