---
title: "List a repository's vulnerabilities by repository id"
method: GET
path: "/repositories/{repository_id}/vulnerabilities"
---

# List a repository's vulnerabilities by repository id

`GET /repositories/{repository_id}/vulnerabilities`

## Request

- Base URL: `https://app.gecko.security/api/v1`
- URL: `https://app.gecko.security/api/v1/repositories/{repository_id}/vulnerabilities`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

## Path parameters

- `repository_id` string, uuid, required

## Query parameters

- `limit` integer
- `cursor` string
- `sort` string
- `order` 'asc' | 'desc'
- `severity` string
- `status` string
- `type` string
- `cwe` string
- `created_after` string, date-time
- `created_before` string, date-time
- `expand` string
- `pull_request` integer

## Response `200`

A list of vulnerabilities

- object
  - `object` 'list', required
  - `data` Vulnerability[], required
    - `object` 'vulnerability', required
    - `id` string, uuid, required
    - `scan_id` string, uuid, required
    - `repository_id` string, uuid, nullable, required
    - `status` 'open' | 'in_progress' | 'fixed' | 'false_positive' | 'accepted_risk', required
    - `severity` number, required
    - `severity_level` 'critical' | 'high' | 'medium' | 'low', required
    - `type` string, required
    - `cwe` string, required
    - `title` string, required
    - `short_description` string, required
    - `file_path` string, required
    - `confidence_score` number, required
    - `cvss_vector` string, required
    - `created_at` string, required
    - `scan` object
      - `object` 'scan', required
      - `id` string, uuid, required
      - `name` string, required
      - `status` string, nullable, required
      - `is_done` boolean, required
      - `progress` integer, nullable, required
      - `programming_language` string, nullable, required
      - `kind` 'main' | 'pr' | 'fix', required
      - `branch` string, nullable, required
      - `commit_sha` string, nullable, required
      - `pull_request_number` integer, nullable, required
      - `repository` string, nullable, required
      - `model` string, nullable, required
      - `vulnerability_counts` object, required
        - `critical` integer, required
        - `high` integer, required
        - `medium` integer, required
        - `low` integer, required
        - `total` integer, required
      - `created_at` string, required
      - `ended_at` string, nullable, required
    - `repository` object
      - `object` 'repository', required
      - `id` string, uuid, required
      - `full_name` string, required
      - `name` string, required
      - `provider` string, required
      - `default_branch` string, required
      - `web_url` string, nullable, required
      - `last_scan_at` string, nullable, required
      - `scan_count` integer, required
      - `open_vulnerability_counts` object, required
        - `critical` integer, required
        - `high` integer, required
        - `medium` integer, required
        - `low` integer, required
      - `created_at` string, required
  - `pagination` object, required
    - `has_more` boolean, required
    - `next_cursor` string, nullable, required

## Other responses

- `401`: Authentication error
- `403`: Authorization error
- `404`: Not found
- `429`: Rate limited

---

[API](https://skmtc.dev/gecko/apis/gecko-security-api.md) - [All operations](https://skmtc.dev/gecko/apis/gecko-security-api/llms.txt) - [OpenAPI document](https://skmtc.dev/gecko/apis/gecko-security-api/revisions/9da49dae8b07?raw)