---
title: "Security status for one release"
method: GET
path: "/api/v1/{distribution}/versions/{version}/security"
tags: ["security"]
---

# Security status for one release

`GET /api/v1/{distribution}/versions/{version}/security`

## Request

- Base URL: `https://magento.watch`
- URL: `https://magento.watch/api/v1/{distribution}/versions/{version}/security`
- Auth: none required

Which security bulletins affect this version, which patch fixes each one, and the recommended version in the same release line.

## Path parameters

- `distribution` 'magento-community' | 'magento-commerce' | 'mage-os', required
- `version` string, required

## Response `200`

Security status for the requested release

- VersionSecurityResponse
  - `data` VersionSecurityReport, required
    - `distribution` 'magento-community' | 'magento-commerce' | 'mage-os', required
    - `version` string, required
    - `status` 'vulnerable' | 'secure' | 'eol' | 'unknown', required
    - `vulnerableTo` VersionSecurityBulletinRef[], required
      - `id` string, required
      - `severity` 'critical' | 'important' | 'moderate', required
      - `publishedDate` string, date, required
      - `cves` string[], required
      - `fixedIn` string, nullable, required
      - `isolatedPatches` IsolatedPatch[]
        - `id` string, required
        - `appliesTo` string[], required
        - `url` string, uri, required
    - `fixedBy` VersionSecurityBulletinRef[], required: Bulletins already fixed in this release, shipped in it or inherited from an earlier patch of the line. Nothing to install.
      - `id` string, required
      - `severity` 'critical' | 'important' | 'moderate', required
      - `publishedDate` string, date, required
      - `cves` string[], required
      - `fixedIn` string, nullable, required
      - `isolatedPatches` IsolatedPatch[]
        - `id` string, required
        - `appliesTo` string[], required
        - `url` string, uri, required
    - `recommendedVersion` string, nullable, required: Newest release of the same line, or this release when it is the newest. Not a verified safe target: it can have open bulletins of its own.
  - `_documentation` string, uri, required
  - `_description` string, required

## Other responses

- `404`: Unknown distribution slug or unknown version

---

[API](https://skmtc.dev/magento/apis/magento-watch-api.md) · [All operations](https://skmtc.dev/magento/apis/magento-watch-api/llms.txt) · [OpenAPI document](https://skmtc.dev/magento/apis/magento-watch-api/revisions/e542302fb8a0?raw)