> ## Documentation Index > Fetch the complete documentation index at: https://docs.cyrisma.com/llms.txt > Use this file to discover all available pages before exploring further. # List vulnerability root causes for authorized partner tenants. > This endpoint returns a cursor-paginated list of vulnerability root causes observed across the authorized partner's tenant scope. **Notes:** - `tenant_ids` (optional, comma-separated) restricts results to specific tenants. - `source_type`, `severity`, `root_cause_type`, and `patchability` filter the result set. - `page_size` (optional, default 100, max 500) controls page size. - `cursor` (optional) resumes from a previous page using the `next_cursor` value returned in the response. Required headers: - `Authorization: Bearer {token}` (requires the `pulse.read` scope) ## OpenAPI ````yaml /api/partner-api/reporting.json get /pulse/v1/partner/vulnerabilities/root-causes openapi: 3.1.1 info: title: 'Cyrisma New Partner API: Reporting' version: v1 servers: - url: https://{instance}.cyrisma.com/app description: The partner's CYRISMA instance host. variables: instance: default: ccnnnnnn description: The instance label of the tenant host issued to the partner. security: - bearerAuth: - pulse.read tags: - name: Reporting paths: /pulse/v1/partner/vulnerabilities/root-causes: get: tags: - Reporting summary: List vulnerability root causes for authorized partner tenants. description: >- This endpoint returns a cursor-paginated list of vulnerability root causes observed across the authorized partner's tenant scope. **Notes:** - `tenant_ids` (optional, comma-separated) restricts results to specific tenants. - `source_type`, `severity`, `root_cause_type`, and `patchability` filter the result set. - `page_size` (optional, default 100, max 500) controls page size. - `cursor` (optional) resumes from a previous page using the `next_cursor` value returned in the response. Required headers: - `Authorization: Bearer {token}` (requires the `pulse.read` scope) operationId: ListPartnerRootCausesV1 parameters: - name: tenant_ids in: query description: >- Comma-separated tenant UUIDs to scope the list to. Omit to use every tenant the caller is authorized for. schema: type: string - name: include_descendants in: query description: >- When true, widens each id in `tenant_ids` to that tenant and every tenant beneath it in the hierarchy. Ignored when `tenant_ids` is omitted, since the default is already the caller's whole scope. schema: enum: - 'true' - 'false' type: string - name: page_size in: query description: Maximum number of items per page. schema: type: string - name: cursor in: query description: >- Opaque pagination cursor: pass the previous response's next_cursor to fetch the next page. schema: type: string - name: severity in: query description: >- Filter by severity. Comma-separated; any of: critical, high, medium, low, info. schema: type: string - name: source_type in: query description: >- Filter by asset source. Comma-separated; any of: endpoint, network, external, domain. schema: type: string - name: root_cause_type in: query description: >- Filter by root-cause type. Comma-separated; any of: product, package, library, os, service, configuration, software, unknown. schema: type: string - name: patchability in: query description: >- Filter by patch availability. Comma-separated; any of: patch_available, manual_only, unknown. `unknown` (no patch state recorded) is a strict subset of manual_only, so /filters offers only the first two. schema: type: string - name: expand in: query description: >- Comma-separated optional expansions. `tenants` adds a per-tenant breakdown to each row; `cves` (on /assets) narrows the list to assets with at least one open finding and attaches their CVEs. Expansions cost extra reads, so ask for them only when needed. schema: type: string - name: asset_id in: query description: >- Restricts the read to a single asset. Asset identifiers are unique within a tenant, not across tenants, so `tenant_ids` must also be supplied; a request with `asset_id` and no `tenant_ids` is rejected with 400 `asset_id_requires_tenant_ids`. schema: type: string responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/PartnerPagedResponseOfGlobalRootCauseRow' '400': description: Bad Request '401': description: Unauthorized content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' '403': description: Forbidden content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' '503': description: Service Unavailable content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' components: schemas: PartnerPagedResponseOfGlobalRootCauseRow: required: - root_tenant_id - page_size - next_cursor - coverage - items type: object properties: root_tenant_id: type: string format: uuid page_size: pattern: ^-?(?:0|[1-9]\d*)$ type: - integer - string format: int32 next_cursor: type: - 'null' - string coverage: type: array items: $ref: '#/components/schemas/PartnerTenantCoverage' items: type: array items: $ref: '#/components/schemas/GlobalRootCauseRow' ProblemDetails: type: object properties: type: type: - 'null' - string title: type: - 'null' - string status: pattern: ^-?(?:0|[1-9]\d*)$ type: - 'null' - integer - string format: int32 detail: type: - 'null' - string instance: type: - 'null' - string PartnerTenantCoverage: required: - tenant_id - tenant_host type: object properties: tenant_id: type: string format: uuid tenant_host: type: string GlobalRootCauseRow: required: - root_cause_key - root_cause_label - root_cause_type - product_key - package_manager - highest_cvr_score - impact - affected_asset_count - affected_tenant_count - cve_count - highest_epss_probability - exploitability_label - patch_available - fixed_version type: object properties: root_cause_key: type: string root_cause_label: type: string root_cause_type: $ref: '#/components/schemas/GlobalRootCauseType' product_key: type: - 'null' - string package_manager: type: - 'null' - string highest_cvr_score: pattern: ^-?(?:0|[1-9]\d*)(?:\.\d+)?$ type: - 'null' - number - string format: double impact: pattern: ^-?(?:0|[1-9]\d*)(?:\.\d+)?$ type: - number - string format: double affected_asset_count: pattern: ^-?(?:0|[1-9]\d*)$ type: - integer - string format: uint64 affected_tenant_count: pattern: ^-?(?:0|[1-9]\d*)$ type: - integer - string format: uint64 cve_count: pattern: ^-?(?:0|[1-9]\d*)$ type: - integer - string format: uint64 highest_epss_probability: pattern: ^-?(?:0|[1-9]\d*)(?:\.\d+)?$ type: - 'null' - number - string format: double exploitability_label: type: - 'null' - string patch_available: type: - 'null' - boolean fixed_version: type: - 'null' - string highest_cvss_score: pattern: ^-?(?:0|[1-9]\d*)(?:\.\d+)?$ type: - 'null' - number - string format: double critical_cve_count: pattern: ^-?(?:0|[1-9]\d*)$ type: - integer - string format: uint64 default: 0 high_cve_count: pattern: ^-?(?:0|[1-9]\d*)$ type: - integer - string format: uint64 default: 0 medium_cve_count: pattern: ^-?(?:0|[1-9]\d*)$ type: - integer - string format: uint64 default: 0 low_cve_count: pattern: ^-?(?:0|[1-9]\d*)$ type: - integer - string format: uint64 default: 0 asset_display_names: type: - 'null' - array items: type: string tenant_names: type: - 'null' - array items: type: string patchability_reason: type: - 'null' - string online_asset_count: pattern: ^-?(?:0|[1-9]\d*)$ type: - integer - string format: uint64 default: 0 offline_asset_count: pattern: ^-?(?:0|[1-9]\d*)$ type: - integer - string format: uint64 default: 0 exploit_sources: type: - 'null' - array items: type: string GlobalRootCauseType: enum: - product - package - library - os - service - configuration - software - unknown securitySchemes: bearerAuth: type: http description: >- A Tenant Authority machine-client token from POST /v1/auth/client-token, carrying subject_type=machine_client and the pulse.read scope. scheme: bearer bearerFormat: JWT ````