Security issues

Fetch a single security issue

Returns the full record for one issue. 404 not_found if the id doesn't exist or belongs to another account.

get/v1/security-issues/{security_issue_id}

Request

Base URL: https://api.sourcery.ai/api
URL: https://api.sourcery.ai/api/v1/security-issues/{security_issue_id}
Auth: HTTP bearer

Path parameters

security_issue_idinteger required

Response

Successful Response

idinteger required

issue_group_idinteger required

The group this issue belongs to (same rule, same package, etc.).

repository_idinteger required

repository_namestring required

issue_type'SAST' | 'IAC' | 'SECRET' | 'DEPENDENCY' | 'LICENSE' required

Category of finding the scanner produced.

rule_idstring required

Identifier of the rule or finding from the upstream scanner. For DEPENDENCY findings this is the CVE or GHSA id; for SAST / IAC / SECRET it's the scanner-emitted rule id. Stability is bounded by the upstream scanner — we pass through what the scanner produces.

documentation_urlstring nullable required

Public catalog URL for the rule. Populated for DEPENDENCY findings (NVD / GitHub Advisories); null otherwise — OpenGrep / Checkov / BetterLeaks don't have a stable per-rule URL convention. NVD URLs may return 403 for non-browser user agents; prefer the GHSA URL when both ids are available.

titlestring required

descriptionstring nullable required

file_pathstring nullable required

Path the scanner flagged. For DEPENDENCY findings this is the lockfile — see manifest_file_path for the manifest a fix should edit.

line_startinteger nullable required

line_endinteger nullable required

commit_shastring required

Git commit at which the issue was last seen.

source_codestring nullable required

Source snippet flagged by the scanner. The first line of the snippet is source_code_line_start (1-based, in the file).

source_code_line_startinteger nullable required

1-based line number of the snippet's first line in the file.

package_namestring nullable required

Vulnerable package (DEPENDENCY findings).

package_versionstring nullable required

package_typestring nullable required

Ecosystem of the package (e.g. npm, pypi, go).

package_licensesstring[] nullable required

Licenses detected for the package (LICENSE findings).

fixed_versionsstring[] nullable required

Versions that resolve the vulnerability — typically one per release track (e.g. ["5.3.5", "4.5.4"] for backports). Pick the version on the same major/minor track as package_version.

manifest_file_pathstring nullable required

Manifest a fix should edit (e.g. package.json for a package-lock.json finding). null when no convention applies.

status'ACTIVE' | 'IGNORED' | 'SNOOZED' | 'SOLVED' required

Status of a security issue.

severity'NO_RISK' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL' required

original_severity'NO_RISK' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL' required

severity_override'NO_RISK' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL' required

snoozed_untilstring date-time nullable required

first_seen_atstring date-time required

last_seen_atstring date-time required

Example response

{
  "snoozed_until": "2026-04-28T12:34:56Z",
  "first_seen_at": "2026-04-28T12:34:56Z",
  "last_seen_at": "2026-04-28T12:34:56Z"
}

Changes

No recorded changes to this operation across all 1 revision of this API.