---
title: "Export OpenVEX Document (Beta)"
method: GET
path: "/orgs/{org_slug}/export/openvex/{id}"
tags: ["full-scans"]
---

# Export OpenVEX Document (Beta)

`GET /orgs/{org_slug}/export/openvex/{id}`

Export vulnerability exploitability data as an OpenVEX v0.2.0 document.

OpenVEX (Vulnerability Exploitability eXchange) documents communicate the
exploitability status of vulnerabilities in software products. This export
includes:

- **Patch data**: Vulnerabilities fixed by applied Socket patches are marked as "fixed"
- **Reachability analysis**: Code reachability determines if vulnerable code is exploitable:
- Unreachable code → "not_affected" with justification
- Reachable code → "affected"
- Unknown/pending → "under_investigation"

Each statement in the document represents a single artifact-vulnerability pair
for granular reachability information.

This endpoint consumes 1 unit of your quota.

This endpoint requires the following org token scopes:
- report:read

## Path parameters

- `org_slug` string, required
- `id` string, required

## Query parameters

- `author` string
- `role` string
- `document_id` string

## Response `200`

OpenVEX v0.2.0 document

- OpenVEXDocumentSchema
  - `@context` string, required
  - `@id` string, required
  - `author` string, required
  - `timestamp` string, required
  - `version` number, required
  - `statements` OpenVEXStatementSchema[], required
    - `vulnerability` OpenVEXVulnerabilitySchema, required
      - `name` string, required
      - `@id` string
      - `description` string
      - `aliases` string[]
    - `products` OpenVEXProductSchema[], required
      - `@id` string, required
      - `identifiers` OpenVEXIdentifiersSchema
        - `purl` string
        - `cpe23` string
        - `cpe22` string
      - `hashes` OpenVEXHashesSchema
        - `md5` string
        - `sha1` string
        - `sha-256` string
        - `sha-384` string
        - `sha-512` string
        - `sha3-224` string
        - `sha3-256` string
        - `sha3-384` string
        - `sha3-512` string
        - `blake2s-256` string
        - `blake2b-256` string
        - `blake2b-512` string
      - `subcomponents` OpenVEXComponentSchema[]
        - `@id` string
        - `identifiers` OpenVEXIdentifiersSchema
          - `purl` string
          - `cpe23` string
          - `cpe22` string
        - `hashes` OpenVEXHashesSchema
          - `md5` string
          - `sha1` string
          - `sha-256` string
          - `sha-384` string
          - `sha-512` string
          - `sha3-224` string
          - `sha3-256` string
          - `sha3-384` string
          - `sha3-512` string
          - `blake2s-256` string
          - `blake2b-256` string
          - `blake2b-512` string
    - `status` string, required
    - `@id` string
    - `version` number
    - `timestamp` string
    - `last_updated` string
    - `supplier` string
    - `status_notes` string
    - `justification` string
    - `impact_statement` string
    - `action_statement` string
    - `action_statement_timestamp` string
  - `role` string
  - `last_updated` string
  - `tooling` string

## Other responses

- `400` — Bad request
- `401` — Unauthorized
- `403` — Insufficient max_quota for API method
- `404` — Resource not found
- `429` — Insufficient quota for API route

---

[API](https://skmtc.dev/socket-dev/apis/socket.md) · [All operations](https://skmtc.dev/socket-dev/apis/socket/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/socket-dev/socket/revisions/bf994b75d33f/schema)