> ## Documentation Index > Fetch the complete documentation index at: https://gecko.security/docs/llms.txt > Use this file to discover all available pages before exploring further. # List vulnerabilities across the active team > Returns vulnerabilities across all scans that belong to the team attached to your API key. ## OpenAPI ````yaml /api-reference/openapi.json get /api/v1/vulnerabilities openapi: 3.1.0 info: title: Gecko SAST Scanner API version: v1 description: >- Use the Gecko API to launch scans and read scan, repository, and vulnerability data for your active team. servers: - url: https://app.gecko.security description: Production security: - ApiKeyAuth: [] tags: - name: Scans description: Launch scans and read scan-level data. - name: Repositories description: Read repository inventory and repository vulnerability data. - name: Vulnerabilities description: Read vulnerability data across your active team. - name: Utility description: Service health and utility endpoints. paths: /api/v1/vulnerabilities: get: tags: - Vulnerabilities summary: List vulnerabilities across the active team description: >- Returns vulnerabilities across all scans that belong to the team attached to your API key. operationId: getApiV1Vulnerabilities parameters: - $ref: '#/components/parameters/severityMinimum' - $ref: '#/components/parameters/type' - $ref: '#/components/parameters/cwe' - $ref: '#/components/parameters/scanIdFilter' - $ref: '#/components/parameters/days' - $ref: '#/components/parameters/limit' - $ref: '#/components/parameters/offset' responses: '200': description: A paginated list of vulnerabilities across the active team. headers: X-RateLimit-Remaining: $ref: '#/components/headers/XRateLimitRemaining' X-RateLimit-Reset: $ref: '#/components/headers/XRateLimitReset' content: application/json: schema: $ref: '#/components/schemas/VulnerabilityListResponse' example: version: v1 data: - id: 2a7c9f10-3b1e-4f2d-9a33-1dcf8c7a1d01 scanId: 00000000-0000-0000-0000-000000000001 scanName: My Repository Scan scanCreatedAt: '2025-08-01T10:00:00.000Z' severity: 9.4 confidenceScore: 8.5 title: SQL Injection in User Search type: SQLI cwe: CWE-89 filePath: api/users/search.py shortDescription: User input directly concatenated into SQL query. cvssVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H pagination: total: 42 limit: 100 offset: 0 hasMore: false filters: severity: null type: null cwe: null scan_id: null days: 14 '400': description: The query parameters are invalid. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: badSeverity: value: error: Severity must be a number between 0 and 10 badDays: value: error: Days must be a positive integer badLimit: value: error: Limit cannot exceed 1000 '401': $ref: '#/components/responses/UnauthorizedError' '429': $ref: '#/components/responses/RateLimitedError' '500': $ref: '#/components/responses/InternalServerError' components: parameters: severityMinimum: name: severity in: query required: false description: >- Filter to vulnerabilities with a severity greater than or equal to this value. schema: type: number minimum: 0 maximum: 10 example: 9 type: name: type in: query required: false description: >- Filter vulnerabilities by type. Gecko performs a case-insensitive substring match. schema: type: string example: sqli cwe: name: cwe in: query required: false description: >- Filter vulnerabilities by CWE. Gecko performs a case-insensitive substring match. schema: type: string example: CWE-89 scanIdFilter: name: scan_id in: query required: false description: Filter cross-scan vulnerability results to a single scan UUID. schema: type: string format: uuid days: name: days in: query required: false description: Filter results to scans created within the last `N` days. schema: type: integer minimum: 1 example: 14 limit: name: limit in: query required: false description: >- Maximum number of results to return. Gecko defaults to `100` and caps the value at `1000`. schema: type: integer default: 100 minimum: 1 maximum: 1000 example: 50 offset: name: offset in: query required: false description: Number of results to skip before Gecko starts returning rows. schema: type: integer default: 0 minimum: 0 example: 0 headers: XRateLimitRemaining: description: Requests remaining in the current one-hour window for the API key. schema: type: integer XRateLimitReset: description: >- ISO 8601 timestamp for when the current one-hour rate-limit window resets. schema: type: string format: date-time RetryAfter: description: Seconds to wait before retrying the request. schema: type: integer schemas: VulnerabilityListResponse: type: object required: - version - data - pagination - filters properties: version: type: string const: v1 data: type: array items: $ref: '#/components/schemas/VulnerabilitySummary' pagination: $ref: '#/components/schemas/Pagination' filters: $ref: '#/components/schemas/TeamVulnerabilityFilters' ErrorResponse: type: object required: - error properties: error: type: string details: type: - string - 'null' hint: type: - string - 'null' VulnerabilitySummary: type: object required: - id - scanId - severity - title - type - cwe - filePath - shortDescription properties: id: type: string format: uuid scanId: type: string format: uuid scanName: type: - string - 'null' scanCreatedAt: type: - string - 'null' format: date-time severity: type: number minimum: 0 maximum: 10 confidenceScore: type: - number - 'null' minimum: 0 maximum: 10 title: type: string type: type: string cwe: type: string filePath: type: string shortDescription: type: string cvssVector: type: - string - 'null' createdAt: type: - string - 'null' format: date-time Pagination: type: object required: - total - limit - offset - hasMore properties: total: type: integer limit: type: integer offset: type: integer hasMore: type: boolean TeamVulnerabilityFilters: type: object required: - severity - type - cwe - scan_id - days properties: severity: type: - number - 'null' type: type: - string - 'null' cwe: type: - string - 'null' scan_id: type: - string - 'null' format: uuid days: type: - integer - 'null' responses: UnauthorizedError: description: The API key is missing, malformed, or invalid. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: missingKey: value: error: API key is required badFormat: value: error: Invalid API key format badKey: value: error: Invalid API key RateLimitedError: description: The API key reached the per-hour request limit. headers: Retry-After: $ref: '#/components/headers/RetryAfter' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: Rate limit exceeded InternalServerError: description: Gecko failed to process the request. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: Internal server error securitySchemes: ApiKeyAuth: type: apiKey in: header name: X-API-Key description: Team-scoped Gecko API key. Keys start with `gk_`. ````