---
title: "POST /vulnerability/bulk"
method: POST
path: "/vulnerability/bulk"
tags: ["vulnerability"]
---

# POST /vulnerability/bulk

`POST /vulnerability/bulk`

## Request

- Base URL: `/api` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/vulnerability/bulk`
- Auth: API key in header `X-API-KEY`

Retrieve up to 100 vulnerabilities by identifier in one request. `data` keeps the input order, one entry per identifier asked, with `vulnerability` null for an identifier that is not present; `metadata` counts the identifiers requested and found. Duplicate identifiers are looked up only once. `with_linked` serves every linked record whole, as GET /<id> does, so it is accepted for at most 10 identifiers.

## Request body

- VulnerabilityBulkLookup
  - `ids` string[], required: One to 100 vulnerability identifiers.
  - `with_bundles` boolean: Include bundles.
  - `with_comments` boolean: Include comments.
  - `with_linked` boolean: Include linked vulnerabilities. Accepted for at most 10 identifiers per request.
  - `with_meta` boolean: Include storage metadata.
  - `with_sightings` boolean: Include sightings.

## Response `200`

Success.

## Other responses

- `400`: Invalid request payload.

## Changes

- **2026-10-02** `1115ae94968b`: 1 info
  - endpoint added
- **2026-10-02** `8f1f05781c23`: 1 breaking
  - api path removed without deprecation
- **2026-10-02** `fd7574302fee`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api/changes/vulnerability/bulk/post.md)

---

[API](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api.md) - [All operations](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api/llms.txt) - [OpenAPI document](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api/revisions/b4dedf027493?raw)