---
title: "OpenVEX from reachability — which advisories cannot be triggered"
method: POST
path: "/v1/vex"
tags: ["harden"]
---

# OpenVEX from reachability — which advisories cannot be triggered

`POST /v1/vex`

## Request

- Base URL: `https://vdb.ai.kr` (the document declares no server; this is the origin it was published from)
- URL: `https://vdb.ai.kr/v1/vex`
- Auth: none declared

Subtract the advisories no attacker-controlled data can reach.

An SBOM scan on a real project returns hundreds of findings, and a queue
nobody can triage is a queue everybody ends up ignoring. This turns the
reachability analysis into the standard vocabulary for saying which ones
do not apply, so downstream tooling can subtract them too.

What it will not do is guess. See vdb/harden/vex.py for the justification
mapping and, more importantly, for what is deliberately absent from it.

## Request body

- VexRequest: Reachability + an advisory list -> an OpenVEX document. `ir` should come from the WHOLE source tree, not one file. A not_affected statement is only as wide as the code behind it, and vex.build_vex withholds every such statement when the analysis looks like a spot check.
  - `ir` object, required
  - `manifest` string, required
  - `manifest_filename` string
  - `findings` object[]
  - `as_user_id` string, nullable
  - `share` boolean

## Response `200`

Successful Response

- object

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/vdb/apis/vdb-api.md) · [All operations](https://skmtc.dev/vdb/apis/vdb-api/llms.txt) · [OpenAPI document](https://skmtc.dev/vdb/apis/vdb-api/revisions/5d5edc23ea71?raw)