---
title: "Get libraries security findings"
method: GET
path: "/api/v3.0/projects/{projectUuid}/dependencies/findings/security/groupBy/library"
tags: ["Findings - Project"]
---

# Get libraries security findings

`GET /api/v3.0/projects/{projectUuid}/dependencies/findings/security/groupBy/library`

Returns only the open source libraries with known vulnerabilities detected in a specified project.

## Path parameters

- `projectUuid` string, required

## Query parameters

- `limit` string
- `cursor` string

## Response `200`

OK

- DWRResponsePageableV3CollectionLibrarySecurityFindingDTOV3
  - `additionalData` object — + **totalItems**: The total count of data points returned in an API response.
  - `supportToken` string
  - `response` LibrarySecurityFindingDTOV3[]
    - `uuid` string
    - `name` string
    - `component` LibraryComponentDTO
      - `uuid` string
      - `name` string
      - `description` string
      - `componentType` 'Library'
      - `type` string
      - `libraryType` string
      - `directDependency` boolean
      - `dependencyType` string
      - `references` ComponentReferencesDTO
        - `url` string
        - `homePage` string
        - `downloadLink` string
        - `issueUrl` string
        - `pomUrl` string
        - `scmUrl` string
        - `genericPackageIndex` string
        - `nugetGallery` string
        - `tags` string
        - `copyright` string
        - `hasNotice` boolean
      - `groupId` string
      - `artifactId` string
      - `version` string
      - `dependencyFile` string
      - `localPath` string
    - `language` string
    - `severity` string
    - `criticalNum` integer
    - `highNum` integer
    - `mediumNum` integer
    - `lowNum` integer
    - `total` integer
    - `suppressedNum` integer
    - `detectedAt` string, date-time
    - `modifiedAt` string, date-time
    - `publishedAt` string, date-time
    - `lastCveUpdatedAt` string, date-time
    - `subRowsIds` string[]
    - `project` ProjectDTOV3 — Project information
      - `uuid` string
      - `name` string
      - `path` string
      - `applicationName` string
      - `applicationUuid` string
    - `application` ApplicationDTOV3
      - `uuid` string
      - `name` string
    - `status` 'UNREVIEWED' | 'IN_REVIEW' | 'SUPPRESSED' | 'ISSUE_CREATED' | 'REMEDIATED'
    - `comment` string
    - `directName` string — One of the direct dependencies this library is pulled in under
    - `directNames` string[]
    - `lastScan` string, date-time
    - `transitiveDependency` boolean
    - `exploitCodeMaturity` string[]
    - `exploitable` boolean
    - `numOfReachable` integer
    - `numOfPotentiallyReachable` integer
    - `numOfUnreachable` integer
    - `reachability` 'REACHABLE' | 'POTENTIALLY_REACHABLE' | 'UNREACHABLE' | 'REACHABILITY_UNAVAILABLE'
    - `numOfMalicious` integer
    - `malicious` boolean
    - `violations` integer
    - `workflowUuids` string[]
    - `violatingFindings` integer

## Other responses

- `400` — Bad Request
- `403` — Forbidden

## Changes

- **2026-08-26** `3cb30ea6174e` — 1 info
  - added the optional property `response/items/directNames` to the response with the `200` status

[Change history](https://skmtc.dev/mend/apis/mend-api/changes/api/v3.0/projects/:projectUuid/dependencies/findings/security/groupBy/library/get.md)

---

[API](https://skmtc.dev/mend/apis/mend-api.md) · [All operations](https://skmtc.dev/mend/apis/mend-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/mend/mend-api/revisions/b2302e1b6c4c/schema)