SOsocket-dev
full-scans

Export OpenVEX Document (Beta)

Changed on

Export vulnerability exploitability data as an OpenVEX v0.2.0 document.

OpenVEX (Vulnerability Exploitability eXchange) documents communicate the exploitability status of vulnerabilities in software products. This export includes:

  • Patch data: Vulnerabilities fixed by applied Socket patches are marked as "fixed"
  • Reachability analysis: Code reachability determines if vulnerable code is exploitable:
  • Unreachable code → "not_affected" with justification
  • Reachable code → "affected"
  • Unknown/pending → "under_investigation"

Each statement in the document represents a single artifact-vulnerability pair for granular reachability information.

This endpoint consumes 1 unit of your quota.

This endpoint requires the following org token scopes:

  • report:read
get/orgs/{org_slug}/export/openvex/{id}

Request

  • Base URL
    https://api.socket.dev/v0
  • URL
    https://api.socket.dev/v0/orgs/{org_slug}/export/openvex/{id}
  • Auth
    • HTTP bearer
    • or HTTP basic

Path parameters

org_slugstring required

The slug of the organization

idstring required

The full scan OR sbom report ID

Query parameters

authorstring

The author of the VEX document. Should be an individual or organization.

rolestring

The role of the document author (e.g., "VEX Generator", "Security Team").

document_idstring

Custom IRI for the VEX document. If not provided, a default IRI will be generated.

Response

OpenVEX v0.2.0 document

@contextstring required
@idstring required
authorstring required
timestampstring required
versionnumber required
rolestring
last_updatedstring
toolingstring

Changes

  • 5ad8bf36b1e7Revision changes
    • info

      added the non-success response with the status

    • info

      added the non-success response with the status

    • info

      added the non-success response with the status