openapi: 3.1.0
info:
  title: InsightAppSec Accounts Vulnerability API
  description: '<p>Welcome to the reference documentation for the public APIs available for InsightAppSec.</p><p>Here are a few resources to help you learn how to start using our APIs:</p><ul><li><a href=''https://insight.help.rapid7.com/docs/api-overview''>Learn about basic concepts and capabilities</a></li><li><a href=''https://insight.help.rapid7.com/docs/managing-platform-api-keys''>Get an Insight platform API key to set up authentication</a></li><li><a href=''https://insight.help.rapid7.com/docs/product-apis''>See available Insight product APIs</a></li><li><a href=''https://insightappsec.help.rapid7.com/docs''>Learn more about InsightAppSec</a></li></ul><p>After you''ve got the basics down, you can use this API guide to find examples of requests and responses.</p></p><h2>Permissions</h2><p>This API uses the platform role of a user''s API key to inherit a set of permissions.</p><p><b>Notes</b>:<li>Platform Admins do not require explicit access to an App in order to see it, or anything associated with it</li><li>Organization keys will inherit Product Admin permissions.</li></p><table><thead><tr><th>Role</th><th>Permissions</th></tr></thead><tbody><tr><td>Product Admin</td><td><li><code>Manage Apps</code></li><li><code>Read Attack Templates</code></li><li><code>Manage Targets</code><li><code>Manage Scan Configs</code><li><code>Manage Scans</code></li><li><code>Manage Vulnerabilities</code></li><li><code>Administer Vulnerability Comments</code></li><li><code>Manage Engines</code></li><li><code>Manage Engine Groups</code></li><li><code>Manage Schedules</code></li><li><code>Manage Blackouts</code></li><li><code>Manage Global Blackouts</code></li><li><code>Manage Files</code></li><li><code>Manage Tags</code></li><li><code>Manage PDF Report</code></li></td></tr><tr><td>Read Write</td><td><li><code>Manage Apps</code></li><li><code>Read Attack Templates</code></li><li><code>Read Targets</code><li><code>Manage Scan Configs</code><li><code>Manage Scans</code></li><li><code>Manage Vulnerabilities</code></li><li><code>Manage Vulnerability Comments</code></li><li><code>Read Engines</code></li><li><code>Read Engine Groups</code></li><li><code>Manage Schedules</code></li><li><code>Manage Blackouts</code></li><li><code>Manage Files</code></li><li><code>Manage Tags</code></li><li><code>Manage PDF Report</code></li></td></tr><tr><td>Read Only</td><td><li><code>Read Apps</code></li><li><code>Read Attack Templates</code></li><li><code>Read Targets</code><li><code>Read Scan Configs</code><li><code>Read Scans</code></li><li><code>Read Vulnerabilities</code></li><li><code>Read Vulnerability Comments</code></li><li><code>Read Engines</code></li><li><code>Read Engine Groups</code></li><li><code>Read Schedules</code></li><li><code>Read Blackouts</code></li><li><code>Read Files</code></li><li><code>Read Tags</code></li><li><code>Read PDF Report</code></li></td></tr></tbody><table><a href="#pagination"><h2 id="pagination">Pagination Parameters</h2></a><p>The following query parameters can be used to control the order, offset and size of the returned data</p><table><thead><tr><th>Parameter</th><th>Description</th><th>Example</th></tr></thead><tbody><tr><td><code>index</code></td><td><p>The 0-based index of the page of data desired (default: 0)<p></td><td><code>?index=2</code></td></tr><tr><td><code>size</code></td><td><p>The size of the page of data desired (min: 1, max: 1000, default: 50)<p></td><td><code>?size=10</code></td></tr><tr><td><code>sort</code></td><td><p>The sort terms and (optional) directions for the desired ordering of data (default: specific to each resource)<p></td><td><code>?sort=scan.submit_time,DESC,scan.status</code></td></tr><tr><td><code>page-token</code></td><td><p>The page token, used as an alternative to <code>index</code> (default: Not provided)<p></td><td><code>?page-token=NDM0NTk0NTIyOjo6X1M6OjpiYW5hbmFz</code></td></tr></tbody></table><h3>Paging using a page token</h3><p>When intending to page beyond the 10,000th result, or as an alternative to using the <code>index</code> query parameter, the <code>page-token</code> option may be used instead. After retrieving the first page, the <code>page_token</code> will be present in the <code>metadata</code> section of the response.<br />For example, with <code>size=99</code>, <code>index=0</code> to <code>index=99</code> may be used. To load the next page, use the <code>page_token</code> value used in the response e.g. <code>?page-token=NDM0NTk0NTIyO</code> </p><h2>Creating resources</h2><p>As is generally the accepted practice with REST-ful APIs, creating a resource can be performed by sending an appropriately formatted POST request. Any ID provided for a new resource in a POST request <i>body</i> will simply be ignored (and a new one generated internally and returned as part of the resource in subsequent GET requests), and POST requests to URLs following a format similar to <code>.../resource/<ID></code> are unsupported and should respond with <code>415 Method Not Allowed</code>. All requests which successfully create a resource and respond with <code>201 Created</code> will contain a <code>Location</code> header the value of which is an absolute URI for the resource (the ID of which can be determined as the last section of the path in the given URI). For example:<br /><code>Location: https://us.api.insight.rapid7.com/ias/v1/scans/12345678-1234-5678-90AB-1234567890AB</code></p><h2>Date, Time and Timezone Support</h2><p>The value of date and date-time type properties are fixed to the common ISO-8601 format. Unless otherwise specified, all date or date-time data in response bodies are expressed in UTC, and it is also expected that data provided in request bodies are also expressed in UTC.</p><h3>Schedules and Blackouts</h3><p>The <code>first_start</code> and <code>first_end</code> properties of both Blackouts and Schedules, and the <code>last_start</code> property of Blackouts may be specified with a timezone. If the timezone is not specified, it is assumed to be UTC. For example:<br /><code>2019-08-12T14:00:00.000000Z[Asia/Tokyo]</code><br />It is also possible to specify the timezone as an offset of either <code>GMT</code> or <code>UTC</code>. For example:<br /><code>2019-09-04T15:00:00.000000Z[GMT+03:00]</code></p><table><thead><tr><th>Value</th><th>Format</th><th>Notes</th></tr></thead><tbody><tr><td>Date</td><td>YYYY-MM-DD</td><td>Defaults to 12 am UTC (if used for a date &amp; time)</td></tr><tr><td>Date &amp; time only</td><td>YYYY-MM-DD''T''hh:mm:ss[.nnn]</td><td>Defaults to UTC</td></tr><tr><td>Date &amp; time in UTC</td><td>YYYY-MM-DD''T''hh:mm:ss[.nnn]Z</td><td></td></tr><tr><td>Date &amp; time with specific timezone</td><td>YYYY-MM-DD''T''hh:mm:ss[.nnn]Z[TimeZoneId]</td><td></td></tr></tbody></table><h2>Searching and Filtering</h2><p>One characteristic of a powerful API is support for complex search and filtering of resources using a flexible query language. It is entirely possible to provide basic search and filtering functionality on standard GET resource collection operations using HTTP query parameters, but this becomes restrictive when attempting to encode boolean logic. Other solutions are also possible but come with equally restrictive compromises. The most effective way to facilitate this complex search and filtering is to provide it as a top-level API with a robust Domain-Specific Language (DSL).</p><p>For simple data retrieval that supports paging and sorting functionality, use the traditional resource-specific GET collection operations; for more complex data retrieval that supports a user-crafted query DSL, use the global Search operation.</p><h2>Errors</h2><p>Any response from the API with an HTTP Status Code in the 4xx or 5xx range indicates an error. If in the 4xx range it indicates a client-side error, where in the 5xx range it indicates a server-side error. All responses indicating an error should be JSON formatted, and contain both a "status" and a "message" property indicating the cause of the error, a "r7-correlation-id" header should also always be returned in the format of a UUID, which uniquely identifies the HTTP exchange that took place and caused the error (this header is present on <i>every</i> request). On some occasions, an "error_code" property will be included in the response body, which can provide the support team further context into the cause of the error in cases where the message is not explicitly clear.</p><p>When contacting support about error responses received from the API, please attempt to include, at minimum:<ul><li>A description of the requests intent</li><li>The request URL</li><li>The request body</li><li>The error response body</li><li>The error response "r7-correlation-id" header</li></ul></p><h3>Validation Errors</h3><p>Specifically, when a response with an HTTP Status Code of 422 is returned, this indicates a validation error, almost always received in a response from a non-idempotent request (normally PUT, POST or DELETE). In this case, there should be an additional "errors" property included in the JSON response body that should describe the cause of the validation exception; this will almost always require a modification to the request body to resolve. </p>'
  version: v1
servers:
- url: https://[region].api.insight.rapid7.com/ias/v1
tags:
- name: Vulnerability
  description: Resources and operations for viewing vulnerability content and managing exceptions.
paths:
  /api/3/exploits:
    get:
      tags:
      - Vulnerability
      summary: Exploits
      description: Returns all known exploits.
      operationId: getExploits
      schemes: []
      consumes:
      - application/json
      produces:
      - application/json;charset=UTF-8
      parameters:
      - name: page
        in: query
        description: The index of the page (zero-based) to retrieve.
        required: false
        type: integer
        default: 0
        format: int32
      - name: size
        in: query
        description: The number of records per page to retrieve.
        required: false
        type: integer
        default: 10
        format: int32
      - name: sort
        in: query
        description: 'The criteria to sort the records by, in the format: `property[,ASC|DESC]`. The default sort order is ascending. Multiple sort criteria can be specified using multiple sort query parameters.'
        required: false
        type: array
        items:
          type: string
        collectionFormat: multi
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/PageOf«Exploit»'
          examples: {}
          headers: {}
        '401':
          description: Unauthorized
          schema:
            $ref: '#/definitions/UnauthorizedError'
          examples: {}
          headers: {}
        '404':
          description: Not Found
          schema:
            $ref: '#/definitions/NotFoundError'
          examples: {}
          headers: {}
        '500':
          description: Internal Server Error
          schema:
            $ref: '#/definitions/InternalServerError'
          examples: {}
          headers: {}
        '503':
          description: Service Unavailable
          schema:
            $ref: '#/definitions/ServiceUnavailableError'
          examples: {}
          headers: {}
      security: []
  /api/3/exploits/{id}:
    get:
      tags:
      - Vulnerability
      summary: Exploit
      description: Returns the details for an exploit.
      operationId: getExploit
      schemes: []
      consumes:
      - application/json
      produces:
      - application/json;charset=UTF-8
      parameters:
      - name: id
        in: path
        description: The identifier of the exploit.
        required: true
        type: integer
        format: int32
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/Exploit'
          examples: {}
          headers: {}
        '401':
          description: Unauthorized
          schema:
            $ref: '#/definitions/UnauthorizedError'
          examples: {}
          headers: {}
        '404':
          description: Not Found
          schema:
            $ref: '#/definitions/NotFoundError'
          examples: {}
          headers: {}
        '500':
          description: Internal Server Error
          schema:
            $ref: '#/definitions/InternalServerError'
          examples: {}
          headers: {}
        '503':
          description: Service Unavailable
          schema:
            $ref: '#/definitions/ServiceUnavailableError'
          examples: {}
          headers: {}
      security: []
  /api/3/exploits/{id}/vulnerabilities:
    get:
      tags:
      - Vulnerability
      summary: Exploitable Vulnerabilities
      description: Returns the vulnerabilities exploitable to a exploit.
      operationId: getExploitVulnerabilities
      schemes: []
      consumes:
      - application/json
      produces:
      - application/json;charset=UTF-8
      parameters:
      - name: id
        in: path
        description: The identifier of the exploit.
        required: true
        type: integer
        format: int32
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/ReferencesWith«VulnerabilityNaturalID,Link»'
          examples: {}
          headers: {}
        '401':
          description: Unauthorized
          schema:
            $ref: '#/definitions/UnauthorizedError'
          examples: {}
          headers: {}
        '404':
          description: Not Found
          schema:
            $ref: '#/definitions/NotFoundError'
          examples: {}
          headers: {}
        '500':
          description: Internal Server Error
          schema:
            $ref: '#/definitions/InternalServerError'
          examples: {}
          headers: {}
        '503':
          description: Service Unavailable
          schema:
            $ref: '#/definitions/ServiceUnavailableError'
          examples: {}
          headers: {}
      security: []
  /api/3/malware_kits:
    get:
      tags:
      - Vulnerability
      summary: Malware Kits
      description: Returns all known malware kits.
      operationId: getMalwareKits
      schemes: []
      consumes:
      - application/json
      produces:
      - application/json;charset=UTF-8
      parameters:
      - name: page
        in: query
        description: The index of the page (zero-based) to retrieve.
        required: false
        type: integer
        default: 0
        format: int32
      - name: size
        in: query
        description: The number of records per page to retrieve.
        required: false
        type: integer
        default: 10
        format: int32
      - name: sort
        in: query
        description: 'The criteria to sort the records by, in the format: `property[,ASC|DESC]`. The default sort order is ascending. Multiple sort criteria can be specified using multiple sort query parameters.'
        required: false
        type: array
        items:
          type: string
        collectionFormat: multi
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/PageOf«MalwareKit»'
          examples: {}
          headers: {}
        '401':
          description: Unauthorized
          schema:
            $ref: '#/definitions/UnauthorizedError'
          examples: {}
          headers: {}
        '404':
          description: Not Found
          schema:
            $ref: '#/definitions/NotFoundError'
          examples: {}
          headers: {}
        '500':
          description: Internal Server Error
          schema:
            $ref: '#/definitions/InternalServerError'
          examples: {}
          headers: {}
        '503':
          description: Service Unavailable
          schema:
            $ref: '#/definitions/ServiceUnavailableError'
          examples: {}
          headers: {}
      security: []
  /api/3/malware_kits/{id}:
    get:
      tags:
      - Vulnerability
      summary: Malware Kit
      description: Returns the details for a malware kit.
      operationId: getMalwareKit
      schemes: []
      consumes:
      - application/json
      produces:
      - application/json;charset=UTF-8
      parameters:
      - name: id
        in: path
        description: The identifier of the malware kit.
        required: true
        type: integer
        format: int32
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/MalwareKit'
          examples: {}
          headers: {}
        '401':
          description: Unauthorized
          schema:
            $ref: '#/definitions/UnauthorizedError'
          examples: {}
          headers: {}
        '404':
          description: Not Found
          schema:
            $ref: '#/definitions/NotFoundError'
          examples: {}
          headers: {}
        '500':
          description: Internal Server Error
          schema:
            $ref: '#/definitions/InternalServerError'
          examples: {}
          headers: {}
        '503':
          description: Service Unavailable
          schema:
            $ref: '#/definitions/ServiceUnavailableError'
          examples: {}
          headers: {}
      security: []
  /api/3/malware_kits/{id}/vulnerabilities:
    get:
      tags:
      - Vulnerability
      summary: Malware Kit Vulnerabilities
      description: Returns the vulnerabilities that are susceptible to being attacked by a malware kit.
      operationId: getMalwareKitVulnerabilities
      schemes: []
      consumes:
      - application/json
      produces:
      - application/json;charset=UTF-8
      parameters:
      - name: id
        in: path
        description: The identifier of the malware kit.
        required: true
        type: integer
        format: int32
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/ReferencesWith«VulnerabilityNaturalID,Link»'
          examples: {}
          headers: {}
        '401':
          description: Unauthorized
          schema:
            $ref: '#/definitions/UnauthorizedError'
          examples: {}
          headers: {}
        '404':
          description: Not Found
          schema:
            $ref: '#/definitions/NotFoundError'
          examples: {}
          headers: {}
        '500':
          description: Internal Server Error
          schema:
            $ref: '#/definitions/InternalServerError'
          examples: {}
          headers: {}
        '503':
          description: Service Unavailable
          schema:
            $ref: '#/definitions/ServiceUnavailableError'
          examples: {}
          headers: {}
      security: []
  /api/3/solutions:
    get:
      tags:
      - Vulnerability
      summary: Solutions
      description: Returns the details for all solutions.
      operationId: getSolutions
      schemes: []
      consumes:
      - application/json
      produces:
      - application/json;charset=UTF-8
      parameters:
      - name: page
        in: query
        description: The index of the page (zero-based) to retrieve.
        required: false
        type: integer
        default: 0
        format: int32
      - name: size
        in: query
        description: The number of records per page to retrieve.
        required: false
        type: integer
        default: 10
        format: int32
      - name: sort
        in: query
        description: 'The criteria to sort the records by, in the format: `property[,ASC|DESC]`. The default sort order is ascending. Multiple sort criteria can be specified using multiple sort query parameters.'
        required: false
        type: array
        items:
          type: string
        collectionFormat: multi
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/Resources«Solution»'
          examples: {}
          headers: {}
        '401':
          description: Unauthorized
          schema:
            $ref: '#/definitions/UnauthorizedError'
          examples: {}
          headers: {}
        '404':
          description: Not Found
          schema:
            $ref: '#/definitions/NotFoundError'
          examples: {}
          headers: {}
        '500':
          description: Internal Server Error
          schema:
            $ref: '#/definitions/InternalServerError'
          examples: {}
          headers: {}
        '503':
          description: Service Unavailable
          schema:
            $ref: '#/definitions/ServiceUnavailableError'
          examples: {}
          headers: {}
      security: []
  /api/3/solutions/{id}:
    get:
      tags:
      - Vulnerability
      summary: Solution
      description: Returns the details for a solution that can remediate one or more vulnerabilities.
      operationId: getSolution
      schemes: []
      consumes:
      - application/json
      produces:
      - application/json;charset=UTF-8
      parameters:
      - name: id
        in: path
        description: The identifier of the solution.
        required: true
        type: string
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/Solution'
          examples: {}
          headers: {}
        '401':
          description: Unauthorized
          schema:
            $ref: '#/definitions/UnauthorizedError'
          examples: {}
          headers: {}
        '404':
          description: Not Found
          schema:
            $ref: '#/definitions/NotFoundError'
          examples: {}
          headers: {}
        '500':
          description: Internal Server Error
          schema:
            $ref: '#/definitions/InternalServerError'
          examples: {}
          headers: {}
        '503':
          description: Service Unavailable
          schema:
            $ref: '#/definitions/ServiceUnavailableError'
          examples: {}
          headers: {}
      security: []
  /api/3/solutions/{id}/prerequisites:
    get:
      tags:
      - Vulnerability
      summary: Solution Prerequisites
      description: Returns the solutions that must be executed in order for a solution to resolve a vulnerability.
      operationId: getPrerequisiteSolutions
      schemes: []
      consumes:
      - application/json
      produces:
      - application/json;charset=UTF-8
      parameters:
      - name: id
        in: path
        description: The identifier of the solution.
        required: true
        type: string
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/ReferencesWith«SolutionNaturalID,Link»'
          examples: {}
          headers: {}
        '401':
          description: Unauthorized
          schema:
            $ref: '#/definitions/UnauthorizedError'
          examples: {}
          headers: {}
        '404':
          description: Not Found
          schema:
            $ref: '#/definitions/NotFoundError'
          examples: {}
          headers: {}
        '500':
          description: Internal Server Error
          schema:
            $ref: '#/definitions/InternalServerError'
          examples: {}
          headers: {}
        '503':
          description: Service Unavailable
          schema:
            $ref: '#/definitions/ServiceUnavailableError'
          examples: {}
          headers: {}
      security: []
  /api/3/solutions/{id}/supersedes:
    get:
      tags:
      - Vulnerability
      summary: Superseded Solutions
      description: Returns the solutions that are superseded by this solution.
      operationId: getSupersededSolutions
      schemes: []
      consumes:
      - application/json
      produces:
      - application/json;charset=UTF-8
      parameters:
      - name: id
        in: path
        description: The identifier of the solution.
        required: true
        type: string
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/Resources«Solution»'
          examples: {}
          headers: {}
        '401':
          description: Unauthorized
          schema:
            $ref: '#/definitions/UnauthorizedError'
          examples: {}
          headers: {}
        '404':
          description: Not Found
          schema:
            $ref: '#/definitions/NotFoundError'
          examples: {}
          headers: {}
        '500':
          description: Internal Server Error
          schema:
            $ref: '#/definitions/InternalServerError'
          examples: {}
          headers: {}
        '503':
          description: Service Unavailable
          schema:
            $ref: '#/definitions/ServiceUnavailableError'
          examples: {}
          headers: {}
      security: []
  /api/3/solutions/{id}/superseding:
    get:
      tags:
      - Vulnerability
      summary: Superseding Solutions
      description: Returns the solutions that supersede this solution.
      operationId: getSupersedingSolutions
      schemes: []
      consumes:
      - application/json
      produces:
      - application/json;charset=UTF-8
      parameters:
      - name: id
        in: path
        description: The identifier of the solution.
        required: true
        type: string
      - name: rollup
        in: query
        description: Whether to return only highest-level "rollup" superseding solutions.
        required: false
        type: boolean
        default: true
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/Resources«Solution»'
          examples: {}
          headers: {}
        '401':
          description: Unauthorized
          schema:
            $ref: '#/definitions/UnauthorizedError'
          examples: {}
          headers: {}
        '404':
          description: Not Found
          schema:
            $ref: '#/definitions/NotFoundError'
          examples: {}
          headers: {}
        '500':
          description: Internal Server Error
          schema:
            $ref: '#/definitions/InternalServerError'
          examples: {}
          headers: {}
        '503':
          description: Service Unavailable
          schema:
            $ref: '#/definitions/ServiceUnavailableError'
          examples: {}
          headers: {}
      security: []
  /api/3/vulnerabilities:
    get:
      tags:
      - Vulnerability
      summary: Vulnerabilities
      description: Returns all vulnerabilities that can be assessed during a scan.
      operationId: getVulnerabilities
      schemes: []
      consumes:
      - application/json
      produces:
      - application/json;charset=UTF-8
      parameters:
      - name: page
        in: query
        description: The index of the page (zero-based) to retrieve.
        required: false
        type: integer
        default: 0
        format: int32
      - name: size
        in: query
        description: The number of records per page to retrieve.
        required: false
        type: integer
        default: 10
        format: int32
      - name: sort
        in: query
        description: 'The criteria to sort the records by, in the format: `property[,ASC|DESC]`. The default sort order is ascending. Multiple sort criteria can be specified using multiple sort query parameters.'
        required: false
        type: array
        items:
          type: string
        collectionFormat: multi
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/PageOf«Vulnerability»'
          examples: {}
          headers: {}
        '401':
          description: Unauthorized
          schema:
            $ref: '#/definitions/UnauthorizedError'
          examples: {}
          headers: {}
        '404':
          description: Not Found
          schema:
            $ref: '#/definitions/NotFoundError'
          examples: {}
          headers: {}
        '500':
          description: Internal Server Error
          schema:
            $ref: '#/definitions/InternalServerError'
          examples: {}
          headers: {}
        '503':
          description: Service Unavailable
          schema:
            $ref: '#/definitions/ServiceUnavailableError'
          examples: {}
          headers: {}
      security: []
  /api/3/vulnerabilities/{id}:
    get:
      tags:
      - Vulnerability
      summary: Vulnerability
      description: Returns the details for a vulnerability.
      operationId: getVulnerability
      schemes: []
      consumes:
      - application/json
      produces:
      - application/json;charset=UTF-8
      parameters:
      - name: id
        in: path
        description: The identifier of the vulnerability.
        required: true
        type: string
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/Vulnerability'
          examples: {}
          headers: {}
        '401':
          description: Unauthorized
          schema:
            $ref: '#/definitions/UnauthorizedError'
          examples: {}
          headers: {}
        '404':
          description: Not Found
          schema:
            $ref: '#/definitions/NotFoundError'
          examples: {}
          headers: {}
        '500':
          description: Internal Server Error
          schema:
            $ref: '#/definitions/InternalServerError'
          examples: {}
          headers: {}
        '503':
          description: Service Unavailable
          schema:
            $ref: '#/definitions/ServiceUnavailableError'
          examples: {}
          headers: {}
      security: []
  /api/3/vulnerabilities/{id}/assets:
    get:
      tags:
      - Vulnerability
      summary: Vulnerability Affected Assets
      description: Get the assets affected by the vulnerability.
      operationId: getAffectedAssets
      schemes: []
      consumes:
      - application/json
      produces:
      - application/json;charset=UTF-8
      parameters:
      - name: id
        in: path
        description: The identifier of the vulnerability.
        required: true
        type: string
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/ReferencesWith«AssetID,Link»'
          examples: {}
          headers: {}
        '401':
          description: Unauthorized
          schema:
            $ref: '#/definitions/UnauthorizedError'
          examples: {}
          headers: {}
        '404':
          description: Not Found
          schema:
            $ref: '#/definitions/NotFoundError'
          examples: {}
          headers: {}
        '500':
          description: Internal Server Error
          schema:
            $ref: '#/definitions/InternalServerError'
          examples: {}
          headers: {}
        '503':
          description: Service Unavailable
          schema:
            $ref: '#/definitions/ServiceUnavailableError'
          examples: {}
          headers: {}
      security: []
  /api/3/vulnerabilities/{id}/exploits:
    get:
      tags:
      - Vulnerability
      summary: Vulnerability Exploits
      description: Returns the exploits that can be used to exploit a vulnerability.
      operationId: getVulnerabilityExploits
      schemes: []
      consumes:
      - application/json
      produces:
      - application/json;charset=UTF-8
      parameters:
      - name: id
        in: path
        description: The identifier of the vulnerability.
        required: true
        type: string
      - name: page
        in: query
        description: The index of the page (zero-based) to retrieve.
        required: false
        type: integer
        default: 0
        format: int32
      - name: size
        in: query
        description: The number of records per page to retrieve.
        required: false
        type: integer
        default: 10
        format: int32
      - name: sort
        in: query
        description: 'The criteria to sort the records by, in the format: `property[,ASC|DESC]`. The default sort order is ascending. Multiple sort criteria can be specified using multiple sort query parameters.'
        required: false
        type: array
        items:
          type: string
        collectionFormat: multi
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/PageOf«Exploit»'
          examples: {}
          headers: {}
        '401':
          description: Unauthorized
          schema:
            $ref: '#/definitions/UnauthorizedError'
          examples: {}
          headers: {}
        '404':
          description: Not Found
          schema:
            $ref: '#/definitions/NotFoundError'
          examples: {}
          headers: {}
        '500':
          description: Internal Server Error
          schema:
            $ref: '#/definitions/InternalServerError'
          examples: {}
          headers: {}
        '503':
          description: Service Unavailable
          schema:
            $ref: '#/definitions/ServiceUnavailableError'
          examples: {}
          headers: {}
      security: []
  /api/3/vulnerabilities/{id}/malware_kits:
    get:
      tags:
      - Vulnerability
      summary: Vulnerability Malware Kits
      description: Returns the malware kits that are known to be used to exploit the vulnerability.
      operationId: getVulnerabilityMalwareKits
      schemes: []
      consumes:
      - application/json
      produces:
      - application/json;charset=UTF-8
      parameters:
      - name: id
        in: path
        description: The identifier of the vulnerability.
        required: true
        type: string
      - name: page
        in: query
        description: The index of the page (zero-based) to retrieve.
        required: false
        type: integer
        default: 0
        format: int32
      - name: size
        in: query
        description: The number of records per page to retrieve.
        required: false
        type: integer
        default: 10
        format: int32
      - name: sort
        in: query
        description: 'The criteria to sort the records by, in the format: `property[,ASC|DESC]`. The default sort order is ascending. Multiple sort criteria can be specified using multiple sort query parameters.'
        required: false
        type: array
        items:
          type: string
        collectionFormat: multi
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/PageOf«MalwareKit»'
          examples: {}
          headers: {}
        '401':
          description: Unauthorized
          schema:
            $ref: '#/definitions/UnauthorizedError'
          examples: {}
          headers: {}
        '404':
          description: Not Found
          schema:
            $ref: '#/definitions/NotFoundError'
          examples: {}
          headers: {}
        '500':
          description: Internal Server Error
          schema:
            $ref: '#/definitions/InternalServerError'
          examples: {}
          headers: {}
        '503':
          description: Service Unavailable
          schema:
            $ref: '#/definitions/ServiceUnavailableError'
          examples: {}
          headers: {}
      security: []
  /api/3/vulnerabilities/{id}/references:
    get:
      tags:
      - Vulnerability
      summary: Vulnerability References
      description: Returns the external references that may be associated to a vulnerability.
      operationId: getVulnerabilityReferences_1
      schemes: []
      consumes:
      - application/json
      produces:
      - application/json;charset=UTF-8
      parameters:
      - name: id
        in: path
        description: The identifier of the vulnerability.
        required: true
        type: string
      - name: page
        in: query
        description: The index of the page (zero-based) to retrieve.
        required: false
        type: integer
        default: 0
        format: int32
      - name: size
        in: query
        description: The number of records per page to retrieve.
        required: false
        type: integer
        default: 10
        format: int32
      - name: sort
        in: query
        description: 'The criteria to sort the records by, in the format: `property[,ASC|DESC]`. The default sort order is ascending. Multiple sort criteria can be specified using multiple sort query parameters.'
        required: false
        type: array
        items:
          type: string
        collectionFormat: multi
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/PageOf«VulnerabilityReference»'
          examples: {}
          headers: {}
        '401':
          description: Unauthorized
          schema:
            $ref: '#/definitions/UnauthorizedError'
          examples: {}
          headers: {}
        '404':
          description: Not Found
          schema:
            $ref: '#/definitions/NotFoundError'
          examples: {}
          headers: {}
        '500':
          description: Internal Server Error
          schema:
            $ref: '#/definitions/InternalServerError'
          examples: {}
          headers: {}
        '503':
          description: Service Unavailable
          schema:
            $ref: '#/definitions/ServiceUnavailableError'
          examples: {}
          headers: {}
      security: []
  /api/3/vulnerabilities/{id}/solutions:
    get:
      tags:
      - Vulnerability
      summary: Vulnerability Solutions
      description: Returns all solutions (across all platforms) that may be used to remediate this vulnerability.
      operationId: getVulnerabilitySolutions
      schemes: []
      consumes:
      - application/json
      produces:
      - application/json;charset=UTF-8
      parameters:
      - name: id
        in: path
        description: The identifier of the vulnerability.
        required: true
        type: string
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/ReferencesWith«SolutionNaturalID,Link»'
          examples: {}
          headers: {}
        '401':
          description: Unauthorized
          schema:
            $ref: '#/definitions/UnauthorizedError'
          examples: {}
          headers: {}
        '404':
          description: Not Found
          schema:
            $ref: '#/definitions/NotFoundError'
          examples: {}
          headers: {}
        '500':
          description: Internal Server Error
          schema:
            $ref: '#/definitions/InternalServerError'
          examples: {}
          headers: {}
        '503':
          description: Service Unavailable
          schema:
            $ref: '#/definitions/ServiceUnavailableError'
          examples: {}
          headers: {}
      security: []
  /api/3/vulnerability_categories:
    get:
      tags:
      - Vulnerability
      summary: Categories
      description: Returns all vulnerabilities categories that can be assigned to a vulnerability. These categories group and label vulnerabilities by general purpose, affected systems, vendor, etc.
      operationId: getVulnerabilityCategories
      schemes: []
      consumes:
      - application/json
      produces:
      - application/json;charset=UTF-8
      parameters:
      - name: page
        in: query
        description: The index of the page (zero-based) to retrieve.
        required: false
        type: integer
        default: 0
        format: int32
      - name: size
        in: query
        description: The number of records per page to retrieve.
        required: false
        type: integer
        default: 10
        format: int32
      - name: sort
        in: query
        description: 'The criteria to sort the records by, in the format: `property[,ASC|DESC]`. The default sort order is ascending. Multiple sort criteria can be specified using multiple sort query parameters.'
        required: false
        type: array
        items:
          type: string
        collectionFormat: multi
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/PageOf«VulnerabilityCategory»'
          examples: {}
          headers: {}
        '401':
          description: Unauthorized
          schema:
            $ref: '#/definitions/UnauthorizedError'
          examples: {}
          headers: {}
        '404':
          description: Not Found
          schema:
            $ref: '#/definitions/NotFoundError'
          examples: {}
          headers: {}
        '500':
          description: Internal Server Error
          schema:
            $ref: '#/definitions/InternalServerError'
          examples: {}
          headers: {}
        '503':
          description: Service Unavailable
          schema:
            $ref: '#/definitions/ServiceUnavailableError'
          examples: {}
          headers: {}
      security: []
  /api/3/vulnerability_categories/{id}:
    get:
      tags:
      - Vulnerability
      summary: Category
      description: Returns the details for a vulnerability category.
      operationId: getVulnerabilityCategory
      schemes: []
      consumes:
      - application/json
      produces:
      - application/json;charset=UTF-8
      parameters:
      - name: id
        in: path
        description: The identifier of the vulnerability category.
        required: true
        type: integer
        format: int32
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/VulnerabilityCategory'
          examples: {}
          headers: {}
        '401':
          description: Unauthorized
          schema:
            $ref: '#/definitions/UnauthorizedError'
          examples: {}
          headers: {}
        '404':
          description: Not Found
          schema:
            $ref: '#/definitions/NotFoundError'
          examples: {}
          headers: {}
        '500':
          description: Internal Server Error
          schema:
            $ref: '#/definitions/InternalServerError'
          examples: {}
          headers: {}
        '503':
          description: Service Unavailable
          schema:
            $ref: '#/definitions/ServiceUnavailableError'
          examples: {}
          headers: {}
      security: []
  /api/3/vulnerability_categories/{id}/vulnerabilities:
    get:
      tags:
      - Vulnerability
      summary: Category Vulnerabilities
      description: Returns hypermedia links to the vulnerabilities that are in a vulnerability category.
      operationId: getVulnerabilityCategoryVulnerabilities
      schemes: []
      consumes:
      - application/json
      produces:
      - application/json;charset=UTF-8
      parameters:
      - name: id
        in: path
        description: The identifier of the vulnerability category.
        required: true
        type: integer
        format: int32
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/ReferencesWith«VulnerabilityNaturalID,Link»'
          examples: {}
          headers: {}
        '401':
          description: Unauthorized
          schema:
            $ref: '#/definitions/UnauthorizedError'
          examples: {}
          headers: {}
        '404':
          description: Not Found
          schema:
            $ref: '#/definitions/NotFoundError'
          examples: {}
          headers: {}
        '500':
          description: Internal Server Error
          schema:
            $ref: '#/definitions/InternalServerError'
          examples: {}
          headers: {}
        '503':
          description: Service Unavailable
          schema:
            $ref: '#/definitions/ServiceUnavailableError'
          examples: {}
          headers: {}
      security: []
  /api/3/vulnerability_references:
    get:
      tags:
      - Vulnerability
      summary: References
      description: Returns the external references that may be associated to a vulnerability.
      operationId: getVulnerabilityReferences
      schemes: []
      consumes:
      - application/json
      produces:
      - application/json;charset=UTF-8
      parameters:
      - name: page
        in: query
        description: The index of the page (zero-based) to retrieve.
        required: false
        type: integer
        default: 0
        format: int32
      - name: size
        in: query
        description: The number of records per page to retrieve.
        required: false
        type: integer
        default: 10
        format: int32
      - name: sort
        in: query
        description: 'The criteria to sort the records by, in the format: `property[,ASC|DESC]`. The default sort order is ascending. Multiple sort criteria can be specified using multiple sort query parameters.'
        required: false
        type: array
        items:
          type: string
        collectionFormat: multi
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/PageOf«VulnerabilityReference»'
          examples: {}
          headers: {}
        '401':
          description: Unauthorized
          schema:
            $ref: '#/definitions/UnauthorizedError'
          examples: {}
          headers: {}
        '404':
          description: Not Found
          schema:
            $ref: '#/definitions/NotFoundError'
          examples: {}
          headers: {}
        '500':
          description: Internal Server Error
          schema:
            $ref: '#/definitions/InternalServerError'
          examples: {}
          headers: {}
        '503':
          description: Service Unavailable
          schema:
            $ref: '#/definitions/ServiceUnavailableError'
          examples: {}
          headers: {}
      security: []
  /api/3/vulnerability_references/{id}:
    get:
      tags:
      - Vulnerability
      summary: Reference
      description: Returns an external vulnerability reference.
      operationId: getVulnerabilityReference
      schemes: []
      consumes:
      - application/json
      produces:
      - application/json;charset=UTF-8
      parameters:
      - name: id
        in: path
        description: The identifier of the vulnerability reference.
        required: true
        type: integer
        format: int32
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/VulnerabilityReference'
          examples: {}
          headers: {}
        '401':
          description: Unauthorized
          schema:
            $ref: '#/definitions/UnauthorizedError'
          examples: {}
          headers: {}
        '404':
          description: Not Found
          schema:
            $ref: '#/definitions/NotFoundError'
          examples: {}
          headers: {}
        '500':
          description: Internal Server Error
          schema:
            $ref: '#/definitions/InternalServerError'
          examples: {}
          headers: {}
        '503':
          description: Service Unavailable
          schema:
            $ref: '#/definitions/ServiceUnavailableError'
          examples: {}
          headers: {}
      security: []
  /api/3/vulnerability_references/{id}/vulnerabilities:
    get:
      tags:
      - Vulnerability
      summary: Reference Vulnerabilities
      description: Returns the vulnerabilities that are referenced by an external reference.
      operationId: getVulnerabilityReferenceVulnerabilities
      schemes: []
      consumes:
      - application/json
      produces:
      - application/json;charset=UTF-8
      parameters:
      - name: id
        in: path
        description: id
        required: true
        type: integer
        format: int32
      - name: page
        in: query
        description: The index of the page (zero-based) to retrieve.
        required: false
        type: integer
        default: 0
        format: int32
      - name: size
        in: query
        description: The number of records per page to retrieve.
        required: false
        type: integer
        default: 10
        format: int32
      - name: sort
        in: query
        description: 'The criteria to sort the records by, in the format: `property[,ASC|DESC]`. The default sort order is ascending. Multiple sort criteria can be specified using multiple sort query parameters.'
        required: false
        type: array
        items:
          type: string
        collectionFormat: multi
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/PageOf«Vulnerability»'
          examples: {}
          headers: {}
        '401':
          description: Unauthorized
          schema:
            $ref: '#/definitions/UnauthorizedError'
          examples: {}
          headers: {}
        '404':
          description: Not Found
          schema:
            $ref: '#/definitions/NotFoundError'
          examples: {}
          headers: {}
        '500':
          description: Internal Server Error
          schema:
            $ref: '#/definitions/InternalServerError'
          examples: {}
          headers: {}
        '503':
          description: Service Unavailable
          schema:
            $ref: '#/definitions/ServiceUnavailableError'
          examples: {}
          headers: {}
      security: []
definitions:
  ExploitSource:
    type: object
    properties:
      key:
        type: string
        example: exploit/windows/iis/iis_webdav_scstoragepathfromurl
        description: The identifier of the exploit in the source library.
      link:
        example: ''
        description: Link to the source of the exploit.
        $ref: '#/definitions/ExploitSourceLink'
      name:
        type: string
        example: metasploit
        description: The source library of the exploit, typically the name of the vendor that maintains and/or defined the exploit.
        enum:
        - metasploit
        - exploitdb
    description: ''
  ContentDescription:
    type: object
    properties:
      html:
        type: string
        example: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge. ...
        description: Hypertext Markup Language (HTML) representation of the content.
      text:
        type: string
        example: <p>A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge. ...</p>
        description: Textual representation of the content.
    description: ''
  ReferencesWith«SolutionNaturalID,Link»:
    type: object
    properties:
      links:
        type: array
        description: Hypermedia links to corresponding or related resources.
        items:
          $ref: '#/definitions/Link'
      resources:
        type: array
        description: The identifiers of the associated resources.
        items:
          type: string
    description: ''
  VulnerabilityCvssV2:
    type: object
    properties:
      accessComplexity:
        type: string
        example: M
        description: "Access Complexity (AC) component which measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system. \n| Access Complexity       | Description                                                              | \n| ----------------------- | ------------------------------------------------------------------------ | \n| High (`\"H\"`)            | Specialized access conditions exist.                                     | \n| Medium (`\"M\"`)          | The access conditions are somewhat specialized.                          | \n| Low (`\"L\"`)             | Specialized access conditions or extenuating circumstances do not exist. |"
        enum:
        - L
        - M
        - H
      accessVector:
        type: string
        example: L
        description: "Access Vector (Av) component which reflects how the vulnerability is exploited. \n| Access Vector              | Description | \n| -------------------------- | ----------- | \n| Local (`\"L\"`)              | A vulnerability exploitable with only local access requires the attacker to have either physical access to the vulnerable system or a local (shell) account. | \n| Adjacent Network (`\"A\"`)   | A vulnerability exploitable with adjacent network access requires the attacker to have access to either the broadcast or collision domain of the vulnerable software. | \n| Network (`\"N\"`)            | A vulnerability exploitable with network access means the vulnerable software is bound to the network stack and the attacker does not require local network access or local access. Such a vulnerability is often termed \"remotely exploitable\". | \n"
        enum:
        - L
        - A
        - N
      authentication:
        type: string
        example: N
        description: "Authentication (Au) component which measures the number of times an attacker must authenticate to a target in order to exploit a vulnerability. \n| Authentication       | Description | \n| -------------------- | ----------- | \n| Multiple (`\"M\"`)     | Exploiting the vulnerability requires that the attacker authenticate two or more times, even if the same credentials are used each time. | \n| Single (`\"S\"`)       | The vulnerability requires an attacker to be logged into the system.                                                                     | \n| None (`\"N\"`)         | Authentication is not required to exploit the vulnerability.                                                                             |"
        enum:
        - N
        - S
        - M
      availabilityImpact:
        type: string
        example: P
        description: "Availability Impact (A) component which measures the impact to availability of a successfully exploited vulnerability. \n| Availability Impact        | Description  | \n| -------------------------- | ------------ | \n| None (`\"N\"`)               | There is no impact to the availability of the system. | \n| Partial (`\"P\"`)            | There is reduced performance or interruptions in resource availability. | \n| Complete (`\"C\"`)           | There is a total shutdown of the affected resource. The attacker can render the resource completely unavailable. |"
        enum:
        - N
        - P
        - C
      confidentialityImpact:
        type: string
        example: P
        description: "Confidentiality Impact (C) component which measures the impact on confidentiality of a successfully exploited vulnerability. \n| Confidentiality Impact     | Description  | \n| -------------------------- | ------------ | \n| None (`\"N\"`)               | There is no impact to the confidentiality of the system. | \n| Partial (`\"P\"`)            | There is considerable informational disclosure. Access to some system files is possible, but the attacker does not have control over what is obtained, or the scope of the loss is constrained. | \n| Complete (`\"C\"`)           | There is total information disclosure, resulting in all system files being revealed. The attacker is able to read all of the system's data (memory, files, etc.) | "
        enum:
        - N
        - P
        - C
      exploitScore:
        type: number
        format: double
        example: 3.3926
        description: The CVSS exploit score.
      impactScore:
        type: number
        format: double
        example: 6.443
        description: The CVSS impact score.
      integrityImpact:
        type: string
        example: P
        description: "Integrity Impact (I) component measures the impact to integrity of a successfully exploited vulnerability. \n| Integrity Impact           | Description  | \n| -------------------------- | ------------ | \n| None (`\"N\"`)               | There is no impact to the integrity of the system. | \n| Partial (`\"P\"`)            | Modification of some system files or information is possible, but the attacker does not have control over what can be modified, or the scope of what the attacker can affect is limited. | \n| Complete (`\"C\"`)           | There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the entire system being compromised. The attacker is able to modify any files on the target system. |"
        enum:
        - N
        - P
        - C
      score:
        type: number
        format: double
        example: 4.4
        description: The CVSS score, which ranges from 0-10.
      vector:
        type: string
        example: AV:L/AC:M/Au:N/C:P/I:P/A:P
        description: The <a target="_blank" rel="noopener noreferrer" href="https://www.first.org/cvss/v2/guide">CVSS v2</a> vector.
    description: ''
  NotFoundError:
    type: object
    required:
    - status
    properties:
      links:
        type: array
        description: Hypermedia links to corresponding or related resources.
        items:
          $ref: '#/definitions/Link'
      message:
        type: string
        example: An error has occurred.
        description: The messages indicating the cause or reason for failure.
      status:
        type: string
        example: '404'
        description: The HTTP status code for the error (same as in the HTTP response).
        enum:
        - '404'
    description: ''
  PCI:
    type: object
    properties:
      adjustedCVSSScore:
        type: integer
        format: int32
        example: 4
        description: The CVSS score of the vulnerability, adjusted for PCI rules and exceptions, on a scale of 0-10.
      adjustedSeverityScore:
        type: integer
        format: int32
        example: 3
        description: The severity score of the vulnerability, adjusted for PCI rules and exceptions, on a scale of 0-10.
      fail:
        type: boolean
        example: true
        description: Whether if present on a host this vulnerability would cause a PCI failure. `true` if "status" is `"Fail"`, `false` otherwise.
      specialNotes:
        type: string
        example: ''
        description: Any special notes or remarks about the vulnerability that pertain to PCI compliance.
      status:
        type: string
        example: Fail
        description: 'The PCI compliance status of the vulnerability. One of: `"Pass"`, `"Fail"`.'
    description: ''
  InternalServerError:
    type: object
    required:
    - status
    properties:
      links:
        type: array
        description: Hypermedia links to corresponding or related resources.
        items:
          $ref: '#/definitions/Link'
      message:
        type: string
        example: An error has occurred.
        description: The messages indicating the cause or reason for failure.
      status:
        type: string
        example: '500'
        description: The HTTP status code for the error (same as in the HTTP response).
        enum:
        - '500'
    description: ''
  Solution:
    type: object
    properties:
      additionalInformation:
        example: ''
        description: Additional information or resources that can assist in applying the remediation.
        $ref: '#/definitions/AdditionalInformation'
      appliesTo:
        type: string
        example: libexpat1 on Ubuntu Linux
        description: The systems or software the solution applies to.
      estimate:
        type: string
        example: PT10M
        description: 'The estimated duration to apply the solution, in ISO 8601 format. For example: `"PT5M"`.'
      id:
        type: string
        example: ubuntu-upgrade-libexpat1
        description: The identifier of the solution.
      links:
        type: array
        description: Hypermedia links to corresponding or related resources.
        readOnly: true
        items:
          $ref: '#/definitions/Link'
      steps:
        example: ''
        description: The steps required to remediate the vulnerability.
        $ref: '#/definitions/Steps'
      summary:
        example: ''
        description: The summary of the solution.
        $ref: '#/definitions/Summary'
      type:
        type: string
        example: configuration
        description: 'The type of the solution. One of: `"Configuration"`, `"Rollup patch"`, `"Patch"`'
        enum:
        - configuration
        - rollup-patch
        - patch
        - unknown
    description: ''
  VulnerabilityCvssV3:
    type: object
    properties:
      attackComplexity:
        type: string
        example: H
        description: "Access Complexity (AC) component with measures the conditions beyond the attacker's control that must exist in order to exploit the vulnerability. \n| Access Complexity      | Description                                                              | \n| ---------------------- | ------------------------------------------------------------------------ | \n| Low (`\"L\"`)            | Specialized access conditions or extenuating circumstances do not exist. | \n| High (`\"H\"`)           | A successful attack depends on conditions beyond the attacker's control. |"
        enum:
        - L
        - H
      attackVector:
        type: string
        example: N
        description: "Attack Vector (AV) component which measures context by which vulnerability exploitation is possible. \n| Access Vector          | Description                                                              | \n| ---------------------- | ------------------------------------------------------------------------ | \n| Local (`\"L\"`)          | A vulnerability exploitable with only local access requires the attacker to have either physical access to the vulnerable system or a local (shell) account. | \n| Adjacent (`\"A\"`)       | A vulnerability exploitable with adjacent network access requires the attacker to have access to either the broadcast or collision domain of the vulnerable software. | \n| Network (`\"N\"`)        | A vulnerability exploitable with network access means the vulnerable software is bound to the network stack and the attacker does not require local network access or local access. Such a vulnerability is often termed \"remotely exploitable\". | \n"
        enum:
        - N
        - A
        - L
        - P
      availabilityImpact:
        type: string
        example: H
        description: "Availability Impact (A) measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability. \n| Availability Impact        | Description  | \n| -------------------------- | ------------ | \n| High (`\"H\"`)               | There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). | \n| Low (`\"L\"`)                | There is reduced performance or interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. | \n| None (`\"N\"`)               | There is no impact to availability within the impacted component. |"
        enum:
        - N
        - L
        - H
      confidentialityImpact:
        type: string
        example: H
        description: "Confidentiality Impact (C) component which measures the impact on confidentiality of a successfully exploited vulnerability. \n| Confidentiality Impact     | Description  | \n| -------------------------- | ------------ | \n| High (`\"H\"`)               | There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. | \n| Low (`\"L\"`)                | There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is constrained. | \n| None (`\"N\"`)               | There is no loss of confidentiality within the impacted component. |"
        enum:
        - N
        - L
        - H
      exploitScore:
        type: number
        format: double
        example: 1.6201
        description: The CVSS impact score.
      impactScore:
        type: number
        format: double
        example: 5.8731
        description: The CVSS exploit score.
      integrityImpact:
        type: string
        example: H
        description: "Integrity Impact (I) measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. \n| Integrity Impact    | Description  | \n| ------------------- | ------------ | \n| High (`\"H\"`)        | There is a total loss of integrity, or a complete loss of protection. | \n| Low (`\"L\"`)         | Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is constrained. | \n| None (`\"N\"`)        | There is no loss of integrity within the impacted component. |"
        enum:
        - N
        - L
        - H
      privilegeRequired:
        type: string
        example: N
        description: "Privileges Required (PR) measures the level of privileges an attacker must possess before successfully exploiting the vulnerability. \n| Privileges Required (PR)     | Description                                                              | \n| ---------------------------- | ------------------------------------------------------------------------ | \n| None (`\"N\"`)                 | The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack. | \n| Low (`\"L\"`)                  | The attacker is authorized with (i.e. requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. | \n| High (`\"H\"`)                 | The attacker is authorized with (i.e. requires) privileges that provide significant (e.g. administrative) control over the vulnerable component that could affect component-wide settings and files. |"
        enum:
        - N
        - L
        - H
      scope:
        type: string
        example: U
        description: "Scope (S) measures the collection of privileges defined by a computing authority (e.g. an application, an operating system, or a sandbox environment) when granting access to computing resources (e.g. files, CPU, memory, etc). These privileges are assigned based on some method of identification and authorization. \n| Scope (S)            | Description                                                              | \n| -------------------- | ------------------------------------------------------------------------ | \n| Unchanged (`\"U\"`)    | An exploited vulnerability can only affect resources managed by the same authority. In this case the vulnerable component and the impacted component are the same. | \n| Changed (`\"C\"`)      | An exploited vulnerability can affect resources beyond the authorization privileges intended by the vulnerable component. In this case the vulnerable component and the impacted component are different. |"
        enum:
        - U
        - C
      score:
        type: number
        format: double
        example: 7.5
        description: The CVSS score, which ranges from 0-10.
      userInteraction:
        type: string
        example: R
        description: "User Interaction (UI) measures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component. \n| User Interaction (UI)        | Description                                                               | \n| ---------------------------- | ------------------------------------------------------------------------- | \n| None (`\"N\"`)                 | The vulnerable system can be exploited without interaction from any user. | \n| Required (`\"R\"`)             | Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited. |"
        enum:
        - N
        - R
      vector:
        type: string
        example: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
        description: The <a target="_blank" rel="noopener noreferrer" href="https://www.first.org/cvss/specification-document">CVSS v3</a> vector.
    description: ''
  PageOf«Exploit»:
    type: object
    properties:
      links:
        type: array
        description: Hypermedia links to corresponding or related resources.
        items:
          $ref: '#/definitions/Link'
      page:
        example: ''
        description: The details of pagination indicating which page was returned, and how the remaining pages can be retrieved.
        $ref: '#/definitions/PageInfo'
      resources:
        type: array
        description: The page of resources returned.
        items:
          $ref: '#/definitions/Exploit'
    description: ''
  ReferencesWith«VulnerabilityNaturalID,Link»:
    type: object
    properties:
      links:
        type: array
        description: Hypermedia links to corresponding or related resources.
        items:
          $ref: '#/definitions/Link'
      resources:
        type: array
        description: The identifiers of the associated resources.
        items:
          type: string
    description: ''
  PageOf«Vulnerability»:
    type: object
    properties:
      links:
        type: array
        description: Hypermedia links to corresponding or related resources.
        items:
          $ref: '#/definitions/Link'
      page:
        example: ''
        description: The details of pagination indicating which page was returned, and how the remaining pages can be retrieved.
        $ref: '#/definitions/PageInfo'
      resources:
        type: array
        description: The page of resources returned.
        items:
          $ref: '#/definitions/Vulnerability'
    description: ''
  Exploit:
    type: object
    properties:
      id:
        type: integer
        format: int32
        example: 4924
        description: The identifier of the exploit.
      links:
        type: array
        description: Hypermedia links to corresponding or related resources.
        readOnly: true
        items:
          $ref: '#/definitions/Link'
      skillLevel:
        type: string
        example: expert
        description: The level of skill required to use the exploit.
        enum:
        - novice
        - intermediate
        - expert
      source:
        example: ''
        description: Details about where the exploit is defined.
        $ref: '#/definitions/ExploitSource'
      title:
        type: string
        example: Microsoft IIS WebDav ScStoragePathFromUrl Overflow
        description: The title (short summary) of the exploit.
    description: ''
  VulnerabilityCvss:
    type: object
    properties:
      links:
        type: array
        description: Hypermedia links to corresponding or related resources.
        readOnly: true
        items:
          $ref: '#/definitions/Link'
      v2:
        example: ''
        description: The Common Vulnerability Scoring System (<a href="https://www.first.org/cvss/v2/guide">CVSS v2</a>) information for the vulnerability.
        $ref: '#/definitions/VulnerabilityCvssV2'
      v3:
        example: ''
        description: The Common Vulnerability Scoring System (<a target="_blank" rel="noopener noreferrer" href="https://www.first.org/cvss/specification-document">CVSS v3</a>) information for the vulnerability.
        $ref: '#/definitions/VulnerabilityCvssV3'
    description: ''
  PageOf«VulnerabilityReference»:
    type: object
    properties:
      links:
        type: array
        description: Hypermedia links to corresponding or related resources.
        items:
          $ref: '#/definitions/Link'
      page:
        example: ''
        description: The details of pagination indicating which page was returned, and how the remaining pages can be retrieved.
        $ref: '#/definitions/PageInfo'
      resources:
        type: array
        description: The page of resources returned.
        items:
          $ref: '#/definitions/VulnerabilityReference'
    description: ''
  Steps:
    type: object
    properties:
      html:
        type: string
        example: "<p>\n    Use `apt-get upgrade` to upgrade libexpat1 to the latest version.\n  </p>"
        description: Textual representation of the content.
      text:
        type: string
        example: Use `apt-get upgrade` to upgrade libexpat1 to the latest version.
        description: Textual representation of the content.
    description: ''
  Summary:
    type: object
    properties:
      html:
        type: string
        example: Upgrade libexpat1
        description: Textual representation of the content.
      text:
        type: string
        example: Upgrade libexpat1
        description: Textual representation of the content.
    description: ''
  VulnerabilityReference:
    type: object
    properties:
      advisory:
        example: ''
        description: Hypermedia link to the destination of the vulnerability reference.
        $ref: '#/definitions/AdvisoryLink'
      id:
        type: integer
        format: int32
        example: 157986
        description: The identifier of the vulnerability reference.
      links:
        type: array
        description: Hypermedia links to corresponding or related resources.
        readOnly: true
        items:
          $ref: '#/definitions/Link'
      reference:
        type: string
        example: '4041689'
        description: 'The contents of the reference, typically an identifier or hyperlink. Example: `"CVE-2011-0762"`'
      source:
        type: string
        example: mskb
        description: 'The originating source of the reference. Examples: `"url"`, `"cve"`, `"bid"`, `"redhat"`'
    description: ''
  ExploitSourceLink:
    type: object
    properties:
      href:
        type: string
        example: http://www.metasploit.com/modules/exploit/windows/iis/iis_webdav_scstoragepathfromurl
        description: The hypertext reference for the exploit source.
      id:
        type: string
        example: exploit/windows/iis/iis_webdav_scstoragepathfromurl
        description: Hypermedia link to the destination of the exploit source.
      rel:
        type: string
        example: Source
        description: The relation of the hypermedia link, `"Source"`.
    description: ''
  Vulnerability:
    type: object
    properties:
      added:
        type: string
        example: '2017-10-10'
        description: The date the vulnerability coverage was added. The format is an ISO 8601 date, `YYYY-MM-DD`.
      categories:
        type: array
        description: All vulnerability categories assigned to this vulnerability.
        items:
          type: string
      cves:
        type: array
        description: All <a target="_blank" rel="noopener noreferrer" href="https://cve.mitre.org/">CVE</a>s assigned to this vulnerability.
        items:
          type: string
      cvss:
        example: ''
        description: The CVSS vector(s) for the vulnerability.
        $ref: '#/definitions/VulnerabilityCvss'
      denialOfService:
        type: boolean
        example: false
        description: Whether the vulnerability can lead to Denial of Service (DoS).
      description:
        example: ''
        description: The description of the vulnerability.
        $ref: '#/definitions/ContentDescription'
      exploits:
        type: integer
        format: int32
        example: ''
        description: The exploits that can be used to exploit a vulnerability.
      id:
        type: string
        example: msft-cve-2017-11804
        description: The identifier of the vulnerability.
      links:
        type: array
        description: Hypermedia links to corresponding or related resources.
        readOnly: true
        items:
          $ref: '#/definitions/Link'
      malwareKits:
        type: integer
        format: int32
        example: ''
        description: The malware kits that are known to be used to exploit the vulnerability.
      modified:
        type: string
        example: '2017-10-10'
        description: The last date the vulnerability was modified. The format is an ISO 8601 date, `YYYY-MM-DD`.
      pci:
        example: ''
        description: Details the <a target="_blank" rel="noopener noreferrer" href="https://www.pcisecuritystandards.org/">Payment Card Industry (PCI)</a> details of the vulnerability.
        $ref: '#/definitions/PCI'
      published:
        type: string
        example: '2017-10-10'
        description: The date the vulnerability was first published or announced. The format is an ISO 8601 date, `YYYY-MM-DD`.
      riskScore:
        type: number
        format: double
        example: 123.69
        description: The risk score of the vulnerability, rounded to a maximum of to digits of precision. If using the default Rapid7 Real Risk™ model, this value ranges from 0-1000.
      severity:
        type: string
        example: Severe
        description: 'The severity of the vulnerability, one of: `"Moderate"`, `"Severe"`, `"Critical"`.'
      severityScore:
        type: integer
        format: int32
        example: 4
        description: The severity score of the vulnerability, on a scale of 0-10.
      title:
        type: string
        example: 'Microsoft CVE-2017-11804: Scripting Engine Memory Corruption Vulnerability'
        description: The title (summary) of the vulnerability.
    description: ''
  UnauthorizedError:
    type: object
    required:
    - status
    properties:
      links:
        type: array
        description: Hypermedia links to corresponding or related resources.
        items:
          $ref: '#/definitions/Link'
      message:
        type: string
        example: An error has occurred.
        description: The messages indicating the cause or reason for failure.
      status:
        type: string
        example: '401'
        description: The HTTP status code for the error (same as in the HTTP response).
        enum:
        - '401'
    description: ''
  AdditionalInformation:
    type: object
    properties:
      html:
        type: string
        example: ''
        description: Hypertext Markup Language (HTML) representation of the content.
      text:
        type: string
        example: ''
        description: Textual representation of the content.
    description: ''
  ServiceUnavailableError:
    type: object
    required:
    - status
    properties:
      links:
        type: array
        description: Hypermedia links to corresponding or related resources.
        items:
          $ref: '#/definitions/Link'
      message:
        type: string
        example: An error has occurred.
        description: The messages indicating the cause or reason for failure.
      status:
        type: string
        example: '503'
        description: The HTTP status code for the error (same as in the HTTP response).
        enum:
        - '503'
    description: ''
  AdvisoryLink:
    type: object
    properties:
      href:
        type: string
        example: https://support.microsoft.com/en-us/kb/4041689
        description: The hypertext reference for the vulnerability reference.
      rel:
        type: string
        example: Advisory
        description: The relation of the hypermedia link, `"Advisory"`.
    description: ''
  ReferencesWith«AssetID,Link»:
    type: object
    properties:
      links:
        type: array
        description: Hypermedia links to corresponding or related resources.
        items:
          $ref: '#/definitions/Link'
      resources:
        type: array
        description: The identifiers of the associated resources.
        items:
          type: integer
          format: int64
    description: ''
  VulnerabilityCategory:
    type: object
    properties:
      id:
        type: integer
        format: int32
        example: 23
        description: The identifier of the vulnerability category.
      links:
        type: array
        description: Hypermedia links to corresponding or related resources.
        readOnly: true
        items:
          $ref: '#/definitions/Link'
      name:
        type: string
        example: Microsoft
        description: The name of the category.
    description: ''
  Resources«Solution»:
    type: object
    properties:
      links:
        type: array
        description: Hypermedia links to corresponding or related resources.
        items:
          $ref: '#/definitions/Link'
      resources:
        type: array
        description: The resources returned.
        items:
          $ref: '#/definitions/Solution'
    description: ''
  PageOf«VulnerabilityCategory»:
    type: object
    properties:
      links:
        type: array
        description: Hypermedia links to corresponding or related resources.
        items:
          $ref: '#/definitions/Link'
      page:
        example: ''
        description: The details of pagination indicating which page was returned, and how the remaining pages can be retrieved.
        $ref: '#/definitions/PageInfo'
      resources:
        type: array
        description: The page of resources returned.
        items:
          $ref: '#/definitions/VulnerabilityCategory'
    description: ''
  PageOf«MalwareKit»:
    type: object
    properties:
      links:
        type: array
        description: Hypermedia links to corresponding or related resources.
        items:
          $ref: '#/definitions/Link'
      page:
        example: ''
        description: The details of pagination indicating which page was returned, and how the remaining pages can be retrieved.
        $ref: '#/definitions/PageInfo'
      resources:
        type: array
        description: The page of resources returned.
        items:
          $ref: '#/definitions/MalwareKit'
    description: ''
  PageInfo:
    type: object
    properties:
      number:
        type: integer
        format: int64
        example: 6
        description: The index (zero-based) of the current page returned.
      size:
        type: integer
        format: int64
        example: 10
        description: The maximum size of the page returned.
      totalPages:
        type: integer
        format: int64
        example: 13
        description: The total number of pages available.
      totalResources:
        type: integer
        format: int64
        example: 123
        description: The total number of resources available across all pages.
    description: ''
  MalwareKit:
    type: object
    properties:
      id:
        type: integer
        format: int32
        example: 152
        description: The identifier of the malware kit.
      links:
        type: array
        description: Hypermedia links to corresponding or related resources.
        readOnly: true
        items:
          $ref: '#/definitions/Link'
      name:
        type: string
        example: Alpha Pack
        description: The name of the malware kit.
      popularity:
        type: string
        example: Rare
        description: 'The name of the malware kit. One of: `"Rare"`, `"Uncommon"`, `"Occasional"`, `"Common"`, `"Popular"`, `"Favored"`, `"Unknown"`'
    description: ''
  Link:
    type: object
    properties:
      href:
        type: string
        example: https://hostname:3780/api/3/...
        description: 'A hypertext reference, which is either a URI (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc3986">RFC 3986</a>) or URI template (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc6570">RFC 6570</a>). '
      rel:
        type: string
        example: self
        description: The link relation type. This value is one from the <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc5988#section-6.2">Link Relation Type Registry</a> or is the type of resource being linked to.
    description: ''