---
title: "Get a scan result."
method: GET
path: "/vulnerabilities/{owner}/{repo}/{package}/{identifier}/"
tags: ["vulnerabilities"]
---

# Get a scan result.

`GET /vulnerabilities/{owner}/{repo}/{package}/{identifier}/`

Get a scan result.

## Response `200`

OK

- VulnerabilityScanResults
  - `created_at` string, date-time — The time this scan result was stored.
  - `has_vulnerabilities` boolean — Do the results contain any known vulnerabilities?
  - `identifier` string, required
  - `max_severity` 'Unknown' | 'Low' | 'Medium' | 'High' | 'Critical'
  - `num_vulnerabilities` integer
  - `package` PackageVulnerability, required
    - `identifier` string, required
    - `name` string, nullable — The name of this package.
    - `url` string, uri, nullable
    - `version` string, nullable — The raw version for this package.
  - `scan_id` integer, nullable, required — Deprecated (23-05-15): Please use 'identifier' instead. Previously: A monotonically increasing number that identified a scan within a repository.
  - `scans` VulnerabilityScan[], required
    - `results` Vulnerability[], required
      - `affected_version` VulnerabilityScanVersion, required
        - `major` integer, required
        - `minor` integer, required
        - `operator` string
        - `patch` integer, required
        - `raw_version` string
        - `version` string
      - `cvss_scores` object — CVSS Scores (when available from the raw scan results)
      - `description` string, required
      - `fixed_version` VulnerabilityScanVersion, required
        - `major` integer, required
        - `minor` integer, required
        - `operator` string
        - `patch` integer, required
        - `raw_version` string
        - `version` string
      - `package_name` string, required
      - `references` string[], required
      - `severity` 'Unknown' | 'Low' | 'Medium' | 'High' | 'Critical'
      - `severity_source` string, required
      - `title` string, required
      - `vulnerability_id` string, required
    - `target` string, required
    - `type` string, required

## Other responses

- `400` — Request could not be processed (see detail).
- `422` — Missing or invalid parameters (see detail).

---

[API](https://skmtc.dev/cloudsmith/apis/cloudsmith-api-v1.md) · [All operations](https://skmtc.dev/cloudsmith/apis/cloudsmith-api-v1/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cloudsmith/cloudsmith-api-v1/revisions/d84142c9e5ad/schema)