---
title: "List security tests"
method: GET
path: "/security-tests"
tags: ["SecurityTests"]
---

# List security tests

`GET /security-tests`

## Request

- Base URL: `https://public.escape.tech/v3`
- URL: `https://public.escape.tech/v3/security-tests`
- Auth: API key in header `X-ESCAPE-API-KEY`

List the security tests of the organization catalog, with their organization configuration (enabled state and custom severity). Filter by scanner kind, asset type, enabled state and name.

## Query parameters

- `cursor` string: The cursor to start the pagination from. Returned by the previous page response. If not provided, the first page will be returned.
- `size` integer: The number of items to return per page
- `sortType` 'ISSUES_COUNT' | 'SEVERITY': The type to sort by
- `sortDirection` 'asc' | 'desc': The direction to sort by
- `scannerKinds` string[]: Filter by scanner kinds
- `assetTypes` string[]: Filter by asset types
- `enabled` 'true' | 'false': Filter by enabled state
- `search` string: Case-insensitive search on the security test name

## Response `200`

OK

- object
  - `nextCursor` string, nullable, required
  - `totalCount` integer
  - `data` object[], required
    - `id` string, required: The uid of the security test
    - `name` string, required: The human readable name of the security test
    - `category` 'ACCESS_CONTROL' | 'CONFIGURATION' | 'CUSTOM' | 'INFORMATION_DISCLOSURE' | 'INJECTION' | 'PROTOCOL' | 'REQUEST_FORGERY' | 'RESOURCE_LIMITATION' | 'SCHEMA' | 'SENSITIVE_DATA', required: The issue category this test belongs to
    - `description` string, required: The description of the security test
    - `documentationPath` string, required: Relative path to the security test documentation
    - `scanners` string[], required: Scanner kinds that can run this security test
    - `assetTypes` string[], required: Asset types this security test applies to
    - `enabled` boolean, required: Whether the test is enabled for the organization (defaults to true)
    - `defaultSeverity` 'CRITICAL' | 'HIGH' | 'INFO' | 'LOW' | 'MEDIUM' | 'null', nullable, required: The default severity of the test
    - `customSeverity` 'CRITICAL' | 'HIGH' | 'INFO' | 'LOW' | 'MEDIUM' | 'null', nullable, required: The organization override of the severity, null when not overridden
    - `severity` 'CRITICAL' | 'HIGH' | 'INFO' | 'LOW' | 'MEDIUM' | 'null', nullable, required: The effective severity: `customSeverity` when set, otherwise `defaultSeverity`
    - `cvssScore` number, nullable, required: The CVSS score of the test, when available
    - `cvssVector` string, nullable, required: The CVSS vector of the test, when available
    - `compliance` object[], required: Compliance mappings associated with the test
      - `framework` 'BITSIGHT' | 'CRA' | 'CWE' | 'DORA' | 'FEDRAMP' | 'GDPR' | 'HIPAA' | 'HITRUST_CSF' | 'IEC62443' | 'ISO27001' | 'MITRE_ATTACK' | 'NIS2' | 'NIST' | 'OWASP' | 'OWASP_ASVS' | 'OWASP_LLM' | 'PCI_DSS' | 'PSD2' | 'SECURITY_SCORECARD' | 'SOC2' | 'WASC', required: The compliance framework name
      - `item` string, required: The compliance item identifier within the framework
    - `issueCounts` object, required: Open issue counts for this test in the organization
      - `critical` integer, required: Number of open CRITICAL issues for this test
      - `high` integer, required: Number of open HIGH issues for this test
      - `medium` integer, required: Number of open MEDIUM issues for this test
      - `low` integer, required: Number of open LOW issues for this test
      - `info` integer, required: Number of open INFO issues for this test

## Other responses

- `400`: Pagination error

---

[API](https://skmtc.dev/escape/apis/escape-public-api.md) - [All operations](https://skmtc.dev/escape/apis/escape-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/escape/apis/escape-public-api/revisions/2eab35df40c7?raw)