---
title: "GET /stats/vulnerability/counts"
method: GET
path: "/stats/vulnerability/counts"
tags: ["stats"]
---

# GET /stats/vulnerability/counts

`GET /stats/vulnerability/counts`

## Request

- Base URL: `/api` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/stats/vulnerability/counts`
- Auth: API key in header `X-API-KEY`

Returns the record count per publication period.

## Query parameters

- `source` string
- `granularity` 'year' | 'month'
- `period` string
- `state` 'published' | 'reserved'
- `basis` 'date_published' | 'state_published'

## Response `200`

Success.

- StatsCounts
  - `available` boolean: False when the counters have never been prepared; counts is then empty. With basis=state_published, also false unless the source's pass writes per-source counters and maintains a lifecycle index.
  - `basis` string: date_published or state_published: whether a withdrawn record still counts in the period it was published in.
  - `counts` object: Period (YYYY or YYYY-MM) -> record count.
  - `granularity` string: year or month.
  - `prepared_at` string: When the counters that answered were derived, for a family the indexing pass alone writes: always with basis=state_published, and on the default basis for a source whose feeder does not increment per-source counters. Null means the figure is kept current on ingestion instead.
  - `source` string: The source reported on.
  - `state` string: published or reserved: the date the records are counted by.

## Other responses

- `400`: The request could not be satisfied.

## Changes

- **2026-10-28** `d8432b44794a`: 1 info
  - added the new optional `query` request parameter `basis`
- **2026-10-28** `fdfc94d2a802`: 1 warning
  - deleted the `query` request parameter `basis`
- **2026-10-19** `c3be6a902db3`: 1 info
  - added the new optional `query` request parameter `basis`
- **2026-09-25** `ef291eb7f3e9`: 1 info
  - added the new optional `query` request parameter `state`
- **2026-09-21** `a850f2cbf0bc`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api/changes/stats/vulnerability/counts/get.md)

---

[API](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api.md) - [All operations](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api/llms.txt) - [OpenAPI document](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api/revisions/b4dedf027493?raw)