Vulnerabilities API
Introduced in GitLab Ultimate 12.6.
Every API call to vulnerabilities must be authenticated.
Vulnerability permissions inherit permissions from their project. If a project is
private, and a user isn’t a member of the project to which the vulnerability
belongs, requests to that project will return a 404 Not Found
status code.
Single vulnerability
Gets a single vulnerability
GET /vulnerabilities/:id
Attribute | Type | Required | Description |
---|---|---|---|
id
| integer or string | yes | The ID of a Vulnerability to get |
curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/vulnerabilities/1"
Example response:
{
"id": 1,
"title": "Predictable pseudorandom number generator",
"description": null,
"state": "opened",
"severity": "medium",
"confidence": "medium",
"report_type": "sast",
"project": {
"id": 32,
"name": "security-reports",
"full_path": "/gitlab-examples/security/security-reports",
"full_name": "gitlab-examples / security / security-reports"
},
"author_id": 1,
"updated_by_id": null,
"last_edited_by_id": null,
"closed_by_id": null,
"start_date": null,
"due_date": null,
"created_at": "2019-10-13T15:08:40.219Z",
"updated_at": "2019-10-13T15:09:40.382Z",
"last_edited_at": null,
"closed_at": null
}
Confirm vulnerability
Confirms a given vulnerability. Returns status code 304
if the vulnerability is already confirmed.
If an authenticated user does not have permission to
confirm vulnerabilities,
this request will result in a 403
status code.
POST /vulnerabilities/:id/confirm
Attribute | Type | Required | Description |
---|---|---|---|
id
| integer or string | yes | The ID of a vulnerability to confirm |
curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/vulnerabilities/5/confirm"
Example response:
{
"id": 2,
"title": "Predictable pseudorandom number generator",
"description": null,
"state": "confirmed",
"severity": "medium",
"confidence": "medium",
"report_type": "sast",
"project": {
"id": 32,
"name": "security-reports",
"full_path": "/gitlab-examples/security/security-reports",
"full_name": "gitlab-examples / security / security-reports"
},
"author_id": 1,
"updated_by_id": null,
"last_edited_by_id": null,
"closed_by_id": null,
"start_date": null,
"due_date": null,
"created_at": "2019-10-13T15:08:40.219Z",
"updated_at": "2019-10-13T15:09:40.382Z",
"last_edited_at": null,
"closed_at": null
}
Resolve vulnerability
Resolves a given vulnerability. Returns status code 304
if the vulnerability is already resolved.
If an authenticated user does not have permission to
resolve vulnerabilities,
this request will result in a 403
status code.
POST /vulnerabilities/:id/resolve
Attribute | Type | Required | Description |
---|---|---|---|
id
| integer or string | yes | The ID of a Vulnerability to resolve |
curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/vulnerabilities/5/resolve"
Example response:
{
"id": 2,
"title": "Predictable pseudorandom number generator",
"description": null,
"state": "resolved",
"severity": "medium",
"confidence": "medium",
"report_type": "sast",
"project": {
"id": 32,
"name": "security-reports",
"full_path": "/gitlab-examples/security/security-reports",
"full_name": "gitlab-examples / security / security-reports"
},
"author_id": 1,
"updated_by_id": null,
"last_edited_by_id": null,
"closed_by_id": null,
"start_date": null,
"due_date": null,
"created_at": "2019-10-13T15:08:40.219Z",
"updated_at": "2019-10-13T15:09:40.382Z",
"last_edited_at": null,
"closed_at": null
}
Dismiss vulnerability
Dismisses a given vulnerability. Returns status code 304
if the vulnerability is already dismissed.
If an authenticated user does not have permission to
dismiss vulnerabilities,
this request will result in a 403
status code.
POST /vulnerabilities/:id/dismiss
Attribute | Type | Required | Description |
---|---|---|---|
id
| integer or string | yes | The ID of a vulnerability to dismiss |
curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/vulnerabilities/5/dismiss"
Example response:
{
"id": 2,
"title": "Predictable pseudorandom number generator",
"description": null,
"state": "closed",
"severity": "medium",
"confidence": "medium",
"report_type": "sast",
"project": {
"id": 32,
"name": "security-reports",
"full_path": "/gitlab-examples/security/security-reports",
"full_name": "gitlab-examples / security / security-reports"
},
"author_id": 1,
"updated_by_id": null,
"last_edited_by_id": null,
"closed_by_id": null,
"start_date": null,
"due_date": null,
"created_at": "2019-10-13T15:08:40.219Z",
"updated_at": "2019-10-13T15:09:40.382Z",
"last_edited_at": null,
"closed_at": null
}