> ## Documentation Index > Fetch the complete documentation index at: https://docs.cyrisma.com/llms.txt > Use this file to discover all available pages before exploring further. # List CVEs for authorized partner tenants. > This endpoint returns a cursor-paginated list of CVEs observed across the authorized partner's tenant scope. **Notes:** - `tenant_ids` (optional, comma-separated) restricts results to specific tenants. - `source_type`, `severity`, `root_cause_type`, and `patchability` filter the result set. - `page_size` (optional, default 100, max 500) controls page size. - `cursor` (optional) resumes from a previous page using the `next_cursor` value returned in the response. Required headers: - `Authorization: Bearer {token}` (requires the `pulse.read` scope) ## OpenAPI ````yaml /api/partner-api/reporting.json get /pulse/v1/partner/vulnerabilities/cves openapi: 3.1.1 info: title: 'Cyrisma New Partner API: Reporting' version: v1 servers: - url: https://{instance}.cyrisma.com/app description: The partner's CYRISMA instance host. variables: instance: default: ccnnnnnn description: The instance label of the tenant host issued to the partner. security: - bearerAuth: - pulse.read tags: - name: Reporting paths: /pulse/v1/partner/vulnerabilities/cves: get: tags: - Reporting summary: List CVEs for authorized partner tenants. description: >- This endpoint returns a cursor-paginated list of CVEs observed across the authorized partner's tenant scope. **Notes:** - `tenant_ids` (optional, comma-separated) restricts results to specific tenants. - `source_type`, `severity`, `root_cause_type`, and `patchability` filter the result set. - `page_size` (optional, default 100, max 500) controls page size. - `cursor` (optional) resumes from a previous page using the `next_cursor` value returned in the response. Required headers: - `Authorization: Bearer {token}` (requires the `pulse.read` scope) operationId: ListPartnerCvesV1 parameters: - name: tenant_ids in: query description: >- Comma-separated tenant UUIDs to scope the list to. Omit to use every tenant the caller is authorized for. schema: type: string - name: include_descendants in: query description: >- When true, widens each id in `tenant_ids` to that tenant and every tenant beneath it in the hierarchy. Ignored when `tenant_ids` is omitted, since the default is already the caller's whole scope. schema: enum: - 'true' - 'false' type: string - name: page_size in: query description: Maximum number of items per page. schema: type: string - name: cursor in: query description: >- Opaque pagination cursor: pass the previous response's next_cursor to fetch the next page. schema: type: string - name: severity in: query description: >- Filter by severity. Comma-separated; any of: critical, high, medium, low, info. schema: type: string - name: source_type in: query description: >- Filter by asset source. Comma-separated; any of: endpoint, network, external, domain. schema: type: string - name: root_cause_type in: query description: >- Filter by root-cause type. Comma-separated; any of: product, package, library, os, service, configuration, software, unknown. schema: type: string - name: patchability in: query description: >- Filter by patch availability. Comma-separated; any of: patch_available, manual_only, unknown. `unknown` (no patch state recorded) is a strict subset of manual_only, so /filters offers only the first two. schema: type: string - name: expand in: query description: >- Comma-separated optional expansions. `tenants` adds a per-tenant breakdown to each row; `cves` (on /assets) narrows the list to assets with at least one open finding and attaches their CVEs. Expansions cost extra reads, so ask for them only when needed. schema: type: string - name: asset_id in: query description: >- Restricts the read to a single asset. Asset identifiers are unique within a tenant, not across tenants, so `tenant_ids` must also be supplied; a request with `asset_id` and no `tenant_ids` is rejected with 400 `asset_id_requires_tenant_ids`. schema: type: string responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/PartnerPagedResponseOfGlobalCveRow' '400': description: Bad Request '401': description: Unauthorized content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' '403': description: Forbidden content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' '503': description: Service Unavailable content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' components: schemas: PartnerPagedResponseOfGlobalCveRow: required: - root_tenant_id - page_size - next_cursor - coverage - items type: object properties: root_tenant_id: type: string format: uuid page_size: pattern: ^-?(?:0|[1-9]\d*)$ type: - integer - string format: int32 next_cursor: type: - 'null' - string coverage: type: array items: $ref: '#/components/schemas/PartnerTenantCoverage' items: type: array items: $ref: '#/components/schemas/GlobalCveRow' ProblemDetails: type: object properties: type: type: - 'null' - string title: type: - 'null' - string status: pattern: ^-?(?:0|[1-9]\d*)$ type: - 'null' - integer - string format: int32 detail: type: - 'null' - string instance: type: - 'null' - string PartnerTenantCoverage: required: - tenant_id - tenant_host type: object properties: tenant_id: type: string format: uuid tenant_host: type: string GlobalCveRow: required: - cve_id - description - severity - cvss_score - cvr_score - epss_probability - kev - exploitability_label - impact - affected_asset_count - affected_tenant_count - source_counts - root_cause_count - top_root_causes - first_seen_at - last_seen_at type: object properties: cve_id: type: string description: type: - 'null' - string severity: oneOf: - type: 'null' - $ref: '#/components/schemas/GlobalSeverity' cvss_score: pattern: ^-?(?:0|[1-9]\d*)(?:\.\d+)?$ type: - 'null' - number - string format: double cvr_score: pattern: ^-?(?:0|[1-9]\d*)(?:\.\d+)?$ type: - 'null' - number - string format: double epss_probability: pattern: ^-?(?:0|[1-9]\d*)(?:\.\d+)?$ type: - 'null' - number - string format: double kev: type: boolean exploitability_label: type: - 'null' - string impact: pattern: ^-?(?:0|[1-9]\d*)(?:\.\d+)?$ type: - number - string format: double affected_asset_count: pattern: ^-?(?:0|[1-9]\d*)$ type: - integer - string format: uint64 affected_tenant_count: pattern: ^-?(?:0|[1-9]\d*)$ type: - integer - string format: uint64 source_counts: type: array items: $ref: '#/components/schemas/GlobalSourceCount' root_cause_count: pattern: ^-?(?:0|[1-9]\d*)$ type: - integer - string format: uint64 top_root_causes: type: array items: type: string first_seen_at: type: - 'null' - string format: date-time last_seen_at: type: - 'null' - string format: date-time asset_display_names: type: - 'null' - array items: type: string tenant_names: type: - 'null' - array items: type: string online_asset_count: pattern: ^-?(?:0|[1-9]\d*)$ type: - integer - string format: uint64 default: 0 offline_asset_count: pattern: ^-?(?:0|[1-9]\d*)$ type: - integer - string format: uint64 default: 0 detected_while_offline: type: boolean default: false title: type: - 'null' - string exploit_sources: type: - 'null' - array items: type: string GlobalSeverity: enum: - critical - high - medium - low - info - unknown GlobalSourceCount: required: - source_type - count type: object properties: source_type: $ref: '#/components/schemas/GlobalSourceType' count: pattern: ^-?(?:0|[1-9]\d*)$ type: - integer - string format: uint64 GlobalSourceType: enum: - endpoint - network - external - domain - unknown securitySchemes: bearerAuth: type: http description: >- A Tenant Authority machine-client token from POST /v1/auth/client-token, carrying subject_type=machine_client and the pulse.read scope. scheme: bearer bearerFormat: JWT ````