---
title: "List vulnerable assets"
method: GET
path: "/api/v2/security/vulnerable-assets"
tags: ["Security Monitoring"]
---

# List vulnerable assets

`GET /api/v2/security/vulnerable-assets`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security/vulnerable-assets`
- Auth: API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`

Get a list of vulnerable assets.

### Pagination

Please review the [Pagination section for the "List Vulnerabilities"](#pagination) endpoint.

### Filtering

Please review the [Filtering section for the "List Vulnerabilities"](#filtering) endpoint.

### Metadata

Please review the [Metadata section for the "List Vulnerabilities"](#metadata) endpoint.

## Query parameters

- `page[token]` string
- `page[number]` integer
- `filter[name]` string
- `filter[type]` 'Repository' | 'Service' | 'Host' | 'HostImage' | 'Image' | 'ServerlessFunction': The asset type
- `filter[version.first]` string
- `filter[version.last]` string
- `filter[repository_url]` string
- `filter[risks.in_production]` boolean
- `filter[risks.under_attack]` boolean
- `filter[risks.is_publicly_accessible]` boolean
- `filter[risks.has_privileged_access]` boolean
- `filter[risks.has_access_to_sensitive_data]` boolean
- `filter[environments]` string
- `filter[teams]` string
- `filter[arch]` string
- `filter[operating_system.name]` string
- `filter[operating_system.version]` string

## Response `200`

OK

- ListVulnerableAssetsResponse: The expected response schema when listing vulnerable assets.
  - `data` Asset[], required: List of vulnerable assets.
    - `attributes` AssetAttributes, required: The JSON:API attributes of the asset.
      - `arch` string: Asset architecture.
      - `environments` string[], required: List of environments where the asset is deployed.
      - `name` string, required: Asset name.
      - `operating_system` AssetOperatingSystem: Asset operating system.
        - `description` string: Operating system version.
        - `name` string, required: Operating system name.
      - `risks` AssetRisks, required: Asset risks.
        - `has_access_to_sensitive_data` boolean: Whether the asset has access to sensitive data or not.
        - `has_privileged_access` boolean: Whether the asset has privileged access or not.
        - `in_production` boolean, required: Whether the asset is in production or not.
        - `is_publicly_accessible` boolean: Whether the asset is publicly accessible or not.
        - `under_attack` boolean: Whether the asset is under attack or not.
      - `teams` string[]: List of teams that own the asset.
      - `type` 'Repository' | 'Service' | 'Host' | 'HostImage' | 'Image' | 'ServerlessFunction', required: The asset type
      - `version` AssetVersion: Asset version.
        - `first` string: Asset first version.
        - `last` string: Asset last version.
    - `id` string, required: The unique ID for this asset.
    - `type` 'assets', required: The JSON:API type.
  - `links` Links: The JSON:API links related to pagination.
    - `first` string, required: First page link.
    - `last` string, required: Last page link.
    - `next` string: Next page link.
    - `previous` string: Previous page link.
    - `self` string, required: Request link.
  - `meta` Metadata: The metadata related to this request.
    - `count` integer, required: Number of entities included in the response.
    - `token` string, required: The token that identifies the request.
    - `total` integer, required: Total number of entities across all pages.

## Other responses

- `400`: Bad request: The server cannot process the request due to invalid syntax in the request.
- `403`: Forbidden: Access denied
- `404`: Not found: There is no request associated with the provided token.
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/da68bf029e4c?raw)