---
title: "Count SCA vulnerabilities"
method: POST
path: "/api/v1/sca/vulnerabilities/count"
tags: ["SCA"]
---

# Count SCA vulnerabilities

`POST /api/v1/sca/vulnerabilities/count`

## Request

- Base URL: `https://zeropath.com`
- URL: `https://zeropath.com/api/v1/sca/vulnerabilities/count`
- Auth: API key in header `X-ZeroPath-API-Token-Id` and API key in header `X-ZeroPath-API-Token-Secret`

Return the exact number of SCA package vulnerabilities matching a filter set. This is a separate call from /vulnerabilities/search because counting visits every matching row and is substantially slower than fetching one page; request it only when you need the total.

## Request body

- CountScaVulnerabilitiesInput
  - `organizationId` string, required
  - `repositoryIds` string[]
  - `branch` string: Read each repository as of its newest finished scan on this branch. Omit for the newest scan on any branch.
  - `searchQuery` string
  - `ecosystems` string[]
  - `advisoryQuery` string: Filter by advisory identifier or alias (CVE, GHSA, etc.)
  - `dependencyNames` string[]: Filter by dependency/package names (contains match)
  - `transitivity` 'direct' | 'transitive': Filter by direct vs transitive dependencies. When omitted, counts both direct and transitive.
  - `reachability` string[]: Filter by exploitability status. When omitted, defaults to all four: reachable, needs_review, unreachable, and not_tested.
  - `hasWizExposure` true: Filter to vulnerabilities associated with applications exposed by Wiz
  - `scanId` string: Count only findings from this SCA scan, instead of the latest scan per repository. The scan must belong to a repository you can view.
  - `status` 'all' | 'open' | 'closed': Patch PR acceptance filter: 'open' means no accepted patch PR, 'closed' means an accepted patch PR, and 'all' includes both. Defaults to 'all'. This is independent of current issue workflow. Pass 'open' to reproduce `funnel.open` from posture.
  - `severities` string[]: Filter by severity bucket.
  - `packageReachability` string[]: Filter by the package-level reachability verdict.
  - `isCompiled` boolean: Filter to compiled assets (true) or manifest-declared dependencies (false). Omit to count both.
  - `hasFix` boolean: Filter to findings with a non-empty recommended fix version — the same population the "fixable" posture numerator counts.
  - `includeEphemeral` boolean: Include ephemeral repositories. Defaults to false.

## Response `200`

Successful response

- ScaVulnerabilityCountResponse
  - `totalCount` integer, required: Number of findings matching the filters.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `408`: The filter set is too large to count within the query time budget.

---

[API](https://skmtc.dev/zeropath/apis/zeropath-api-2.md) - [All operations](https://skmtc.dev/zeropath/apis/zeropath-api-2/llms.txt) - [OpenAPI document](https://skmtc.dev/zeropath/apis/zeropath-api-2/revisions/ea6ae4b68cd3?raw)