---
title: "Org-level SCA posture (funnel + headline counts + fixable% + direct/transitive)"
method: POST
path: "/api/v1/sca/posture"
tags: ["SCA"]
---

# Org-level SCA posture (funnel + headline counts + fixable% + direct/transitive)

`POST /api/v1/sca/posture`

## Request

- Base URL: `https://zeropath.com`
- URL: `https://zeropath.com/api/v1/sca/posture`
- Auth: API key in header `X-ZeroPath-API-Token-Id` and API key in header `X-ZeroPath-API-Token-Secret`

Return the org-level SCA posture for the caller’s viewable repos: the staged funnel (open → reachable/needs_review → likelyExploitable → kev), headline severity/KEV/exploitable counts, fixablePercent, and the direct-vs-transitive rollup. Org-scoped: findings in repos outside the caller’s access are never counted. Honest empty (zeros, null fixablePercent) when there is no access or no open findings.

## Request body

- GetScaOrgPostureInput
  - `organizationId` string, required
  - `repositoryIds` string[]: Optional subset of repositories to scope the posture to.
  - `branch` string: Read each repository as of its newest finished scan on this branch. Omit for the newest scan on any branch.
  - `includeEphemeral` boolean: Include ephemeral (PR-scan) repositories. Defaults to false.

## Response `200`

Successful response

- ScaOrgPostureResponse
  - `funnel` ScaPostureFunnel, required
    - `open` integer, required: Total open SCA findings.
    - `reachable` integer, required: Open findings with a `reachable` verdict.
    - `needsReview` integer, required: Open findings with a `needs_review` verdict.
    - `likelyExploitable` integer, required: Reachable-stage findings that are CONFIRMED-validated OR KEV. Differs from headline.exploitable (CONFIRMED only).
    - `kev` integer, required: likelyExploitable findings flagged Known Exploited.
  - `headline` ScaPostureHeadline, required
    - `critical` integer, required
    - `high` integer, required
    - `medium` integer, required
    - `low` integer, required
    - `info` integer, required
    - `kev` integer, required
    - `exploitable` integer, required: CONFIRMED-validated open findings.
  - `fixablePercent` number, nullable, required: Percentage of open findings with a recommended fix version. Null when there are no open findings.
  - `directVsTransitive` ScaPostureDirectVsTransitive, required
    - `direct` integer, required
    - `transitive` integer, required

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `408`: The posture scope is too large to compute within the query time budget. Retry with fewer repositories; retrying the same scope will not succeed.

---

[API](https://skmtc.dev/zeropath/apis/zeropath-api-2.md) - [All operations](https://skmtc.dev/zeropath/apis/zeropath-api-2/llms.txt) - [OpenAPI document](https://skmtc.dev/zeropath/apis/zeropath-api-2/revisions/ea6ae4b68cd3?raw)