--- title: "What touches the organisation's stack now, by proof." method: GET path: "/surveillance/exposure" tags: ["surveillance"] --- # What touches the organisation's stack now, by proof. `GET /surveillance/exposure` ## Request - Base URL: `https://api.ismalicious.com` - URL: `https://api.ismalicious.com/surveillance/exposure` - Auth: one of: - API key in header `X-API-KEY` - HTTP bearer - HTTP basic ## Response `200` OK - ExposureResponse - `channels` ExposureChannels, required - `chat` ChatChannel[], required - `destinationId` string, required - `lastStatus` string, nullable - `name` string, required - `type` string, required: `slack_webhook` or `teams_webhook`. - `email` EmailChannel, required - `enabled` boolean, required - `recipientCount` integer, required - `lastSentAt` string, date-time, nullable - `webhooks` WebhookChannel, required - `count` integer, required - `lastStatus` string, nullable - `counts` ExposureCounts, required - `acknowledged` integer, required - `closed` integer, required - `fixed` integer, required - `snoozed` integer, required - `toTreat` integer, required - `groups` ExposureGroup[], required - `findings` FindingDto[], required - `caseId` string, nullable - `closedAt` string, date-time, nullable - `closedReason` 'FixedVersionRead' | 'ComponentRemoved' | 'User': `ExposureFinding.closedReason`. - `commonName` string, nullable - `components` FindingComponentDto[], required - `affectedRange` string, nullable - `componentId` string, required - `distroBackport` boolean, required: A distro banner: verify the package before acting. - `fixedVersion` string, nullable - `matchSources` MatchSource[], required - `name` string, required - `observedVersion` string, nullable - `readAt` string, date-time, nullable: When the version was last read (age of the reading). - `sourceId` string, required - `sourceKind` 'Domain' | 'Lockfile' | 'Manual', required: `WatchSource.kind` — the unit of sale. - `sourceName` string, required - `versionEvidence` string, nullable - `versionSource` 'Header' | 'MetaTag' | 'ScriptPath' | 'PortBanner' | 'Lockfile' | 'Sbom' | 'Manual' | 'LegacyCpe' | 'None', required: `WatchComponent.versionSource` — where the version was read. - `versionState` 'Affected' | 'Unverified' | 'NotAffected' | 'Fixed', required: `ExposureFinding.versionState` / `ExposureFindingComponent.versionState`. - `versionVerified` boolean, required - `cveId` string, required - `cvssScore` number, double, nullable - `cvssVersion` string, nullable - `detectedAt` string, date-time, required - `epssScore` number, double, nullable - `exploitationFirstSeenAt` string, date-time, nullable - `exploitationStatus` string, nullable - `fixGroupKey` string, nullable - `fixedVersion` string, nullable - `id` string, required - `isKev` boolean, required - `kevDateAdded` string, date-time, nullable - `note` string, nullable - `notices` SourceNotice[], required: Notices the terms of a source behind its components' matches require to be shown with it, verbatim: VulnCheck's (§12) when a component carries `VULNCHECK`. Empty otherwise. - `matchSource` 'NvdCpe' | 'Osv' | 'Csaf' | 'VulnCheck' | 'OpenCve' | 'Legacy' | 'Cna', required: `ExposureFindingComponent.matchSources` entries. - `name` string, required: `VulnCheck`. - `source` string, required: The source's id in the attribution manifest (`GET /cve/attribution`): `vulncheck`. - `termsUrl` string, nullable: The terms that require the notice. - `text` string, required: Shown as is: « This product uses data from VulnCheck (https://vulncheck.com). » - `url` string, required: The publisher's site. - `notifiedAt` string, date-time, nullable - `patchAvailable` boolean, nullable - `priority` 'P1' | 'P2' | 'P3', required: `ExposureFinding.priority`: P1 immediate, P2 daily digest, P3 weekly (default cadences; the organisation's policy can change them). - `proof` 'Exploited' | 'Kev' | 'Likely' | 'Unverified' | 'Low', required: `ExposureFinding.proof` — the Exposure group, in display order. - `relatedCveIds` string[], required: Other open findings fixed by the same upgrade. - `severity` string, nullable - `signalState` SignalState, required: `ExposureFinding.signalState` / `notifiedState`. A push-worthy change is a false→true of `kev`, `exploited`, `poc` or `patch`; `epss_high` false→true reopens and goes to the digest, never to an immediate alert; numeric EPSS moves are not state (build spec §2.3.6). - `epssHigh` boolean - `exploited` boolean - `kev` boolean - `patch` boolean - `poc` boolean - `snoozedUntil` string, date-time, nullable - `status` 'Open' | 'Acknowledged' | 'Snoozed' | 'Patched' | 'Fixed' | 'NotAffected' | 'AcceptedRisk', required: `ExposureFinding.status`. `Fixed` is written by a read, never by hand. - `statusUpdatedAt` string, date-time, required - `title` string, nullable - `versionState` 'Affected' | 'Unverified' | 'NotAffected' | 'Fixed', required: `ExposureFinding.versionState` / `ExposureFindingComponent.versionState`. - `proof` 'Exploited' | 'Kev' | 'Likely' | 'Unverified' | 'Low', required: `ExposureFinding.proof` — the Exposure group, in display order. - `headline` ExposureHeadline, required - `assetCount` integer, required - `componentNames` string[], required - `exploitedCount` integer, required - `upgrade` ExposureUpgrade - `componentName` string, required - `toVersion` string, required - `level` string, required: `critical`, `high`, `medium`, `low`, `none`, `unknown`. - `lowProbability` LowProbability, required - `count` integer, required - `notices` SourceNotice[], required: Notices owed by the sources behind any of the organisation's findings (the headline, counts and groups rest on them): VulnCheck's (§12) once one of them matched on its ranges. Empty otherwise. - `matchSource` 'NvdCpe' | 'Osv' | 'Csaf' | 'VulnCheck' | 'OpenCve' | 'Legacy' | 'Cna', required: `ExposureFindingComponent.matchSources` entries. - `name` string, required: `VulnCheck`. - `source` string, required: The source's id in the attribution manifest (`GET /cve/attribution`): `vulncheck`. - `termsUrl` string, nullable: The terms that require the notice. - `text` string, required: Shown as is: « This product uses data from VulnCheck (https://vulncheck.com). » - `url` string, required: The publisher's site. - `policy` AlertPolicyDto, required - `chatDestinationIds` string[], required - `emailEnabled` boolean, required - `emailRecipients` string[], required: Empty = the organisation's OWNER/ADMIN users with a verified address. Every entry passes `contexts::cve::domain::is_notification_email`. - `includeDevDependencies` boolean, required - `lastDailyDigestAt` string, date-time, nullable - `lastWeeklyDigestAt` string, date-time, nullable - `locale` string, required: `en` or `fr`. - `p1Cadence` 'Immediate' | 'Daily' | 'Weekly' | 'Never', required: `SurveillanceAlertPolicy.p{1,2,3}Cadence`. - `p2Cadence` 'Immediate' | 'Daily' | 'Weekly' | 'Never', required: `SurveillanceAlertPolicy.p{1,2,3}Cadence`. - `p3Cadence` 'Immediate' | 'Daily' | 'Weekly' | 'Never', required: `SurveillanceAlertPolicy.p{1,2,3}Cadence`. - `updatedAt` string, date-time, nullable - `webhooksEnabled` boolean, required - `readAt` ExposureReadAt, required - `catalog` string, date-time, nullable - `stack` string, date-time, nullable - `recentlyClosed` RecentlyClosed[], required - `closedAt` string, date-time, required - `componentName` string, required - `cveId` string, required - `findingId` string, required - `sourceName` string, required - `version` string, nullable - `upgradeGroups` UpgradeGroup[], required - `componentName` string, required - `findingIds` string[], required - `fixGroupKey` string, required - `toVersion` string, required ## Other responses - `400`: Invalid request - `401`: Unauthorized ## Changes - **2026-11-01** `e802f56e895a`: 1 warning, 2 info - added the new `Cna` enum value to the `groups/items/findings/items/components/items/matchSources/items/` response property for the response status `200` - added the required property `groups/items/findings/items/notices` to the response with the `200` status - added the required property `notices` to the response with the `200` status - **2026-10-31** `a59f0651364e`: 1 warning - added the new `VulnCheck` enum value to the `groups/items/findings/items/components/items/matchSources/items/` response property for the response status `200` - **2026-10-23** `7c8ce9039cf7`: 1 info - endpoint added [Operation history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/surveillance/exposure/get.md) --- [API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) - [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/b6f45e6169a7?raw)