> ## Documentation Index > Fetch the complete documentation index at: https://gecko.security/docs/llms.txt > Use this file to discover all available pages before exploring further. # List vulnerabilities for a scan > Returns vulnerabilities for a specific scan in the team attached to your API key. ## OpenAPI ````yaml /api-reference/openapi.json get /api/v1/scans/{scanId}/vulnerabilities openapi: 3.1.0 info: title: Gecko SAST Scanner API version: v1 description: >- Use the Gecko API to launch scans and read scan, repository, and vulnerability data for your active team. servers: - url: https://app.gecko.security description: Production security: - ApiKeyAuth: [] tags: - name: Scans description: Launch scans and read scan-level data. - name: Repositories description: Read repository inventory and repository vulnerability data. - name: Vulnerabilities description: Read vulnerability data across your active team. - name: Utility description: Service health and utility endpoints. paths: /api/v1/scans/{scanId}/vulnerabilities: get: tags: - Scans summary: List vulnerabilities for a scan description: >- Returns vulnerabilities for a specific scan in the team attached to your API key. operationId: getApiV1ScansByScanIdVulnerabilities parameters: - $ref: '#/components/parameters/scanId' - $ref: '#/components/parameters/severityExact' - $ref: '#/components/parameters/type' - $ref: '#/components/parameters/cwe' - $ref: '#/components/parameters/limit' - $ref: '#/components/parameters/offset' responses: '200': description: A paginated list of vulnerabilities for the scan. headers: X-RateLimit-Remaining: $ref: '#/components/headers/XRateLimitRemaining' X-RateLimit-Reset: $ref: '#/components/headers/XRateLimitReset' content: application/json: schema: $ref: '#/components/schemas/ScanVulnerabilityListResponse' example: version: v1 data: - id: 2a7c9f10-3b1e-4f2d-9a33-1dcf8c7a1d01 scanId: 00000000-0000-0000-0000-000000000001 severity: 9.4 confidenceScore: 8.5 title: Unbounded command template allows shell injection type: Command Execution cwe: CWE-78 filePath: services/reports/run_report.ts shortDescription: >- User input is interpolated into a shell command without proper quoting. cvssVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H pagination: total: 1 limit: 100 offset: 0 hasMore: false filters: severity: null type: null cwe: null '400': description: The path or query parameters are invalid. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: missingScanId: value: error: Scan ID is required badSeverity: value: error: Severity must be a number between 0 and 10 badLimit: value: error: Limit cannot exceed 1000 '401': $ref: '#/components/responses/UnauthorizedError' '403': description: The API key is not attached to an active team. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: No active team associated with API key '404': description: >- The scan does not exist or is outside the team scope for the API key. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: Scan not found '429': $ref: '#/components/responses/RateLimitedError' '500': $ref: '#/components/responses/InternalServerError' components: parameters: scanId: name: scanId in: path required: true description: Scan UUID. schema: type: string format: uuid severityExact: name: severity in: query required: false description: Filter to vulnerabilities whose severity matches this value exactly. schema: type: number minimum: 0 maximum: 10 example: 9.4 type: name: type in: query required: false description: >- Filter vulnerabilities by type. Gecko performs a case-insensitive substring match. schema: type: string example: sqli cwe: name: cwe in: query required: false description: >- Filter vulnerabilities by CWE. Gecko performs a case-insensitive substring match. schema: type: string example: CWE-89 limit: name: limit in: query required: false description: >- Maximum number of results to return. Gecko defaults to `100` and caps the value at `1000`. schema: type: integer default: 100 minimum: 1 maximum: 1000 example: 50 offset: name: offset in: query required: false description: Number of results to skip before Gecko starts returning rows. schema: type: integer default: 0 minimum: 0 example: 0 headers: XRateLimitRemaining: description: Requests remaining in the current one-hour window for the API key. schema: type: integer XRateLimitReset: description: >- ISO 8601 timestamp for when the current one-hour rate-limit window resets. schema: type: string format: date-time RetryAfter: description: Seconds to wait before retrying the request. schema: type: integer schemas: ScanVulnerabilityListResponse: type: object required: - version - data - pagination - filters properties: version: type: string const: v1 data: type: array items: $ref: '#/components/schemas/ScanVulnerability' pagination: $ref: '#/components/schemas/Pagination' filters: $ref: '#/components/schemas/ScanArtifactFilters' ErrorResponse: type: object required: - error properties: error: type: string details: type: - string - 'null' hint: type: - string - 'null' ScanVulnerability: allOf: - $ref: '#/components/schemas/VulnerabilitySummary' - type: object additionalProperties: true Pagination: type: object required: - total - limit - offset - hasMore properties: total: type: integer limit: type: integer offset: type: integer hasMore: type: boolean ScanArtifactFilters: type: object required: - severity - type - cwe properties: severity: type: - number - 'null' type: type: - string - 'null' cwe: type: - string - 'null' VulnerabilitySummary: type: object required: - id - scanId - severity - title - type - cwe - filePath - shortDescription properties: id: type: string format: uuid scanId: type: string format: uuid scanName: type: - string - 'null' scanCreatedAt: type: - string - 'null' format: date-time severity: type: number minimum: 0 maximum: 10 confidenceScore: type: - number - 'null' minimum: 0 maximum: 10 title: type: string type: type: string cwe: type: string filePath: type: string shortDescription: type: string cvssVector: type: - string - 'null' createdAt: type: - string - 'null' format: date-time responses: UnauthorizedError: description: The API key is missing, malformed, or invalid. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: missingKey: value: error: API key is required badFormat: value: error: Invalid API key format badKey: value: error: Invalid API key RateLimitedError: description: The API key reached the per-hour request limit. headers: Retry-After: $ref: '#/components/headers/RetryAfter' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: Rate limit exceeded InternalServerError: description: Gecko failed to process the request. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: Internal server error securitySchemes: ApiKeyAuth: type: apiKey in: header name: X-API-Key description: Team-scoped Gecko API key. Keys start with `gk_`. ````