> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cyrisma.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Vulnerability for scan Id

> Returns asets with asset vulnerabilities.

Each asset returned by the API may include three collections: **vulnerabilities**, **openPorts**, and **flaws**. These collections are populated based on the **scan type**, as follows:
- Internal Authenticated (scan type 5), Internal Unauthenticated (scan type 10), and External IP scans (scan type 9) will include data for **vulnerabilities** and **openPorts**.
- External Web Application scans (scan type 11) will include data for **flaws**.


Required headers:


- `Authorization: access_token {token}`



## OpenAPI

````yaml openapi.json get /partner/scans/vulnerability/{scanId}
openapi: 3.1.0
info:
  title: Cyrisma Partner API
  description: >-
    Cyrisma partner API assists organizations that use the Cyrisma risk
    management platform to further automate and enhance overall risk management.
    The API provides provisioning and reporting features meaning that
    deployments can be automated and scan data can be retrieved for further
    aggregation and reporting. The API will enable the setup of new partners and
    instances, review of partner and instance status and utilization, and
    management of partners through their lifecycle.  Access to Cyrisma risk
    management is based on a foundation of secure API access token
    authentication and identity management.
  version: v1
servers: []
security: []
paths:
  /partner/scans/vulnerability/{scanId}:
    get:
      tags:
        - Scans
      summary: Vulnerability for scan Id
      description: "Returns asets with asset vulnerabilities.\r\n\r\nEach asset returned by the API may include three collections: **vulnerabilities**, **openPorts**, and **flaws**. These collections are populated based on the **scan type**, as follows:\r\n- Internal Authenticated (scan type 5), Internal Unauthenticated (scan type 10), and External IP scans (scan type 9) will include data for **vulnerabilities** and **openPorts**.\r\n- External Web Application scans (scan type 11) will include data for **flaws**.\r\n\r\n\r\nRequired headers:\r\n\r\n\r\n- `Authorization: access_token {token}`"
      operationId: GetScanVulnerabilities
      parameters:
        - name: scanId
          in: path
          description: Id of the vulnerability scan.
          required: true
          schema:
            title: Scan Id
            type: integer
            description: Id of the vulnerability scan.
            format: int32
        - name: Authorization
          in: header
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VulnerabilityScan'
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '422':
          description: Unprocessable Entity
        '500':
          description: Internal Server Error
components:
  schemas:
    VulnerabilityScan:
      title: Vulnerability Scan
      type: object
      properties:
        scanId:
          title: Scan Id
          type: integer
          description: Unique identifier for the scan.
          format: int32
        scanName:
          title: Scan Name
          type:
            - string
            - 'null'
          description: Name of the scan.
        scanType:
          title: Scan Type
          type:
            - string
            - 'null'
          description: Type of the scan
        scanStart:
          title: Scan Start
          type: string
          description: Start and end times of the scan.
          format: date-time
        scanEnd:
          title: Scan End
          type: string
          description: End time of the scan.
          format: date-time
        assets:
          title: Assets
          type:
            - array
            - 'null'
          items:
            $ref: '#/components/schemas/Asset'
          description: List of assets included in the scan.
      additionalProperties: false
      description: >-
        Represents a vulnerability scan with its associated assets and their
        vulnerabilities.
    Asset:
      title: Asset
      type: object
      properties:
        id:
          title: Asset Id
          type: integer
          description: Unique identifier for the asset.
          format: int32
        name:
          title: Asset Name
          type:
            - string
            - 'null'
          description: Name of the asset.
        ipAddress:
          title: Ip Address
          type:
            - string
            - 'null'
          description: IP address of the asset.
        vulnerabilities:
          title: Vulnerabilities
          type:
            - array
            - 'null'
          items:
            $ref: '#/components/schemas/Cve'
          description: List of vulnerabilities associated with the asset.
        openPorts:
          title: Open Ports
          type:
            - array
            - 'null'
          items:
            $ref: '#/components/schemas/Port'
          description: List of open ports on the asset.
        flaws:
          title: Flaws
          type:
            - array
            - 'null'
          items:
            $ref: '#/components/schemas/Flaw'
          description: List of flaws identified on the asset.
      additionalProperties: false
      description: >-
        Represents an asset with its associated vulnerabilities, open ports, and
        flaws.
    Cve:
      title: CVE
      type: object
      properties:
        cve:
          title: CVE
          type:
            - string
            - 'null'
          description: CVE identifier
        title:
          title: CVE Title
          type:
            - string
            - 'null'
          description: Title or brief description of the CVE.
        score:
          title: CVSS score
          type: number
          description: CVSS score of the vulnerability.
          format: double
        epssScore:
          title: EPSS score
          type: number
          description: EPSS score of the vulnerability.
          format: double
        riskLevel:
          title: Risk level
          type:
            - string
            - 'null'
          description: Risk level of the vulnerability.
        exploitability:
          title: Exploitability
          type:
            - string
            - 'null'
          description: Exploitability details of the vulnerability.
        scanId:
          title: Scan Id
          type: integer
          description: Identifier of the scan in which the CVE was found.
          format: int32
        cveId:
          title: CVE Id
          type: integer
          description: Unique numeric ID for the CVE.
          format: int32
        firstSeen:
          title: First Seen
          type: string
          description: Date and time when the CVE was first seen.
          format: date-time
        targetIp:
          title: Target Ip
          type:
            - string
            - 'null'
          description: Target IP address associated with the CVE.
        targetHostName:
          title: Target Host Name
          type:
            - string
            - 'null'
          description: Target host name associated with the CVE.
      additionalProperties: false
      description: >-
        Represents a CVE (Common Vulnerabilities and Exposures) entry with its
        details.
    Port:
      title: Port
      type: object
      properties:
        id:
          title: Port Id
          type: integer
          description: Unique identifier for the port.
          format: int32
        targetIp:
          title: Target Ip
          type:
            - string
            - 'null'
          description: Target IP address associated with the port.
        targetName:
          title: Target Name
          type:
            - string
            - 'null'
          description: Target name associated with the port.
        portNumber:
          title: Port Number
          type:
            - string
            - 'null'
          description: Port number (e.g., "80", "443").
        portProtocol:
          title: Port Protocol
          type:
            - string
            - 'null'
          description: Protocol used by the port (e.g., "TCP", "UDP").
        portDescription:
          title: Port Description
          type:
            - string
            - 'null'
          description: Description of the port service.
        riskLevel:
          title: Risk Level
          type:
            - string
            - 'null'
          description: Risk level associated with the port.
      additionalProperties: false
      description: Represents an open network port on an asset with its details.
    Flaw:
      title: Flaw (alert)
      type: object
      properties:
        alertId:
          title: Alert Id
          type: integer
          description: Unique identifier for the alert.
          format: int32
        port:
          title: Port Number
          type: integer
          description: Port number associated with the alert.
          format: int32
        alertRef:
          title: Alert Reference
          type:
            - string
            - 'null'
          description: Reference code for the alert.
        alertName:
          title: Alert Name
          type:
            - string
            - 'null'
          description: Name of the alert.
        riskLevel:
          title: Risk Level
          type:
            - string
            - 'null'
          description: Risk level of the alert.
        alertCount:
          title: Alert Count
          type: integer
          description: Count of occurrences for the alert.
          format: int32
        target:
          title: Target
          type:
            - string
            - 'null'
          description: Target associated with the alert.
      additionalProperties: false
      description: Represents a flaw identified on an asset with its details.

````