--- title: "List customers with per-instance CVE exposure." method: GET path: "/app/{app_id}/security/customer-impact/customers" tags: ["customers"] --- # List customers with per-instance CVE exposure. `GET /app/{app_id}/security/customer-impact/customers` ## Request - Base URL: `https://api.replicated.com/vendor/v3` - URL: `https://api.replicated.com/vendor/v3/app/{app_id}/security/customer-impact/customers` - Auth: API key in header `Authorization` Return a paginated, customer-centric view of CVE exposure. Customers are first selected when an instance's latest reported downstream release has a matching release-image CVE posture. All instances for selected customers are then returned with per-instance CVE counts sourced from SDK-reported running images or uploaded support bundles. Each customer's top-level CVE counts come from its selected worst instance (null when no instance has data), preserving a real instance's posture instead of synthesizing counts across mixed releases. Reporting instances also include the resolved and introduced CVE counts for upgrading supported Helm and Embedded Cluster instances to the latest release currently available on their reported channel when both releases have complete scan data. Each customer includes the recommendation with the highest-severity reduction. Airgap instances without SDK reporting are returned only when another instance selects their customer; they carry the license channel's latest-release CVE posture as context. The severity filter accepts a set (repeatable and/or comma-separated) and keeps customers whose selected worst instance has at least one CVE in any selected severity; customers without CVE data are excluded while a severity filter is active. Counts in the response always cover all four severities. With includeSnapshot=true, both the customer page and an unfiltered snapshot are derived from the authorized fleet's hydrated runtime rows. The snapshot reports the total authorized app-customer population, the number impacted by critical or high CVEs, and active instances with critical CVEs by reported channel release without a second customer-impact request. Requires the Security Center team feature; teams without it receive 403. Required RBAC Policy: kots/app/[:appid]/license/[:licenseid]/read ## Path parameters - `app_id` string, required ## Query parameters - `pageSize` integer - `currentPage` integer - `search` string - `severity` string[] - `includeUnfixable` boolean - `includeSnapshot` boolean - `sortBy` string ## Response `200` ListSecurityCustomerImpactResponse contains the customer-impact list - object - `customers` SecurityImpactCustomer[] - `activeInstances` integer - `aggregateCVECountCoverage` CVECountCoverage: CVECountCoverage describes how many image summaries contributed to the fixable-only count. It is omitted for all-CVE responses, where fixability coverage is not relevant. - `availableImages` integer - `totalImages` integer - `aggregateCVECounts` SeverityCounts: SeverityCounts is the four-severity CVE count projection returned by the customer-impact APIs (securebuild VulnCounts without Total). - `critical` integer - `high` integer - `low` integer - `medium` integer - `airgapInstances` integer - `bestUpgradeRecommendation` SecurityImpactBestUpgradeRecommendation: SecurityImpactBestUpgradeRecommendation is the highest-severity CVE reduction available to any reporting instance for a customer. - `channelId` string - `channelName` string - `clusterId` string - `currentVersion` string - `cveImpact` SecurityImpactCVEUpgradeImpact: SecurityImpactCVEUpgradeImpact keeps improvements and regressions separate so the vendor can evaluate the complete security effect of an upgrade. - `introduced` SecurityCVEDiffCounts - `critical` integer - `high` integer - `low` integer - `medium` integer - `total` integer - `resolved` SecurityCVEDiffCounts - `critical` integer - `high` integer - `low` integer - `medium` integer - `total` integer - `instanceId` string - `upgradeTo` SecurityCVEDiffRelease - `sequence` integer - `version` string - `customerId` string - `customerName` string - `instances` SecurityImpactInstance[] - `appVersion` string - `architecture` string: Architecture is inferred from the architecture-specific release digest reported by the instance. It is "unknown" when that evidence is absent or ambiguous; callers must not guess from the release's supported platforms. - `attribution` SecurityImpactAttribution: SecurityImpactAttribution counts reported images by ownership. Unmatched or ambiguous images remain unresolved instead of silently becoming vendor-owned. - `replicatedImages` integer - `unresolvedImages` integer - `vendorImages` integer - `bundleUploadedAt` string, date-time - `channelId` string - `channelLatestRelease` ChannelLatestReleaseContext: ChannelLatestReleaseContext is the CVE posture of a channel's latest release, returned as context for airgap instances that have no SDK reporting data of their own. - `cveCountCoverage` CVECountCoverage: CVECountCoverage describes how many image summaries contributed to the fixable-only count. It is omitted for all-CVE responses, where fixability coverage is not relevant. - `availableImages` integer - `totalImages` integer - `cveCounts` SeverityCounts: SeverityCounts is the four-severity CVE count projection returned by the customer-impact APIs (securebuild VulnCounts without Total). - `critical` integer - `high` integer - `low` integer - `medium` integer - `sequence` integer - `version` string - `channelName` string - `clusterId` string: ClusterID disambiguates rows sharing an instanceId across clusters. Running images are reported per instanceId only, so such rows show identical CVE counts. - `cveCountCoverage` CVECountCoverage: CVECountCoverage describes how many image summaries contributed to the fixable-only count. It is omitted for all-CVE responses, where fixability coverage is not relevant. - `availableImages` integer - `totalImages` integer - `cveCounts` SeverityCounts: SeverityCounts is the four-severity CVE count projection returned by the customer-impact APIs (securebuild VulnCounts without Total). - `critical` integer - `high` integer - `low` integer - `medium` integer - `cveDataAvailable` boolean: CVEDataAvailable is false when counts for the selected view are not available; cveCountCoverage distinguishes missing fixability data from an instance with no usable scan result (zero ≠ unknown). - `cveDataSource` string: CVEDataSource is sdk_reporting, support_bundle, or none. - `cveImpact` SecurityImpactCVEUpgradeImpact: SecurityImpactCVEUpgradeImpact keeps improvements and regressions separate so the vendor can evaluate the complete security effect of an upgrade. - `introduced` SecurityCVEDiffCounts - `critical` integer - `high` integer - `low` integer - `medium` integer - `total` integer - `resolved` SecurityCVEDiffCounts - `critical` integer - `high` integer - `low` integer - `medium` integer - `total` integer - `evidenceCapturedAt` string, date-time: EvidenceCapturedAt is when the running-image evidence was captured. For live SDK reports this is the instance check-in; for support bundles it is the bundle collection time. BundleUploadedAt is deliberately separate. - `installType` string - `instanceId` string - `instanceName` string - `lastCheckIn` string, date-time - `reportingCoverage` SecurityImpactReportingCoverage: SecurityImpactReportingCoverage describes the two coverage questions a vendor needs answered: how much of the applicable release the instance reported, and how much of that reported set SecureBuild scanned. - `applicableImages` integer - `missingImages` string[] - `notScannedImages` integer - `reportedImages` integer - `scanCompletedAt` string, date-time - `status` string: Status is active, inactive, or airgap - `upgradeAvailable` boolean: UpgradeAvailable is true only when the instance reports a release, its channel has another latest release, and both releases have complete scan data. Missing scan data never produces a recommendation. - `upgradeRecommendationStatus` string: Explains why upgrade impact is or is not available for this instance. - `upgradeTo` SecurityCVEDiffRelease - `sequence` integer - `version` string - `totalInstances` integer - `worstClusterId` string - `worstInstanceId` string - `snapshot` SecurityImpactSnapshot: TotalCustomers covers every authorized, non-archived customer for the app; customer and release impact are derived from the same resolved SDK scan data used by the detailed rows. - `criticalHighImpactedCustomers` integer - `cveCountCoverage` CVECountCoverage: CVECountCoverage describes how many image summaries contributed to the fixable-only count. It is omitted for all-CVE responses, where fixability coverage is not relevant. - `availableImages` integer - `totalImages` integer - `cveDataState` string: CVEDataState describes the selected view across the entire authorized customer population: complete, partial, or unavailable. - `releaseImpacts` SecurityImpactReleaseSnapshot[] - `channelId` string - `cveCountCoverage` CVECountCoverage: CVECountCoverage describes how many image summaries contributed to the fixable-only count. It is omitted for all-CVE responses, where fixability coverage is not relevant. - `availableImages` integer - `totalImages` integer - `instancesEvaluated` integer - `instancesWithCriticalCVEs` integer - `releaseSequence` integer - `totalCustomers` integer - `totalCustomers` integer ## Other responses - `400`: Returned on bad input - `401`: Return if the caller is not authorized - `403`: Returned if the caller does not have the needed permission - `404`: Returned on resource not found ## Changes - **2026-11-03** `a36c6aead22f`: 1 info - endpoint added [Operation history](https://skmtc.dev/replicated/apis/vendor-api-v3-2/changes/app/:app_id/security/customer-impact/customers/get.md) --- [API](https://skmtc.dev/replicated/apis/vendor-api-v3-2.md) - [All operations](https://skmtc.dev/replicated/apis/vendor-api-v3-2/llms.txt) - [OpenAPI document](https://skmtc.dev/replicated/apis/vendor-api-v3-2/revisions/a36c6aead22f?raw)