---
title: "List SCA vulnerabilities"
method: POST
path: "/api/v2/sca/list"
tags: ["SCA"]
---

# List SCA vulnerabilities

`POST /api/v2/sca/list`

## Request

- Base URL: `https://zeropath.com`
- URL: `https://zeropath.com/api/v2/sca/list`
- Auth: API key in header `X-ZeroPath-API-Token-Id` and API key in header `X-ZeroPath-API-Token-Secret`

List dependency vulnerabilities (SCA findings) detected by ZeroPath across your repositories. Each result represents a known CVE or advisory affecting a dependency in your codebase. Results include the affected package name and version, CVE identifiers, severity, reachability status (whether the vulnerable code path is actually called), and patch summary metadata when a remediation exists or is being generated. Use `scoreLevels` to filter by severity and `statuses` to control which workflow states are included (defaults to only `PENDING_REVIEW`). For full vulnerability details including reachability analysis, dependency paths, and patch remediation data such as the proposed diff, call `issues.get` with the returned issue ID.

## Request body

- ScaListRequest: Input for listing SCA (dependency) vulnerabilities.
  - `organizationId` string: Organization to list SCA vulnerabilities for.
  - `repositoryId` string: Restrict results to a single repository. If omitted, returns SCA vulnerabilities across all repositories the caller can access.
  - `scanId` string: Restrict results to vulnerabilities found in a specific scan. If omitted, returns the latest results.
  - `scoreLevels` string[]: Filter by severity level. Only vulnerabilities matching one of the specified levels are returned. Omit to include all severity levels.
  - `statuses` string[]: Filter by issue workflow status. Defaults to `["PENDING_REVIEW"]` if omitted -- pass all statuses explicitly to see everything.
  - `searchQuery` string: Free-text search query to filter results. Matches against vulnerability title, CVE ID, package name, and description.
  - `cursor` string: Opaque pagination cursor returned as `nextCursor` from a previous response. Pass this to fetch the next page.
  - `limit` integer: Maximum number of vulnerabilities to return per page. Defaults to 25.

## Response `200`

Paginated list of SCA vulnerabilities

- IssuesListResponse
  - `items` object[], required
    - `id` string, required
    - `issueStatus` 'PENDING_REVIEW' | 'REVIEWING' | 'PATCHING' | 'NON_EXPLOITABLE' | 'FALSE_POSITIVE' | 'ACCEPTED_RISK' | 'RESOLVED' | 'BACKLOG' | 'INFORMATIONAL', required
    - `severity` number, nullable, required
    - `confidence` number, required
    - `score` number, nullable, required
    - `createdAt` string, required
    - `url` string, required
    - `presentation` object
      - `lane` 'fix_now' | 'next' | 'later' | 'reviewing' | 'patching' | 'resolved' | 'non_exploitable' | 'false_positive' | 'accepted_risk' | 'informational', required
      - `category` 'traditional' | 'businessLogic' | 'customRule' | 'SCA' | 'IAC' | 'SECRETS' | 'CICD' | 'EOL' | 'CONTAINER' | 'uncategorized', required
      - `startLine` number, nullable, required
      - `updatedAt` string, date-time, required
      - `validationMethod` 'SCANNER_POLICY' | 'AGENT_TRIAGE' | 'DEEP_CONFIRMATION' | 'RESCAN_AGENT' | 'INVESTIGATION' | 'RUNTIME_VALIDATION' | 'HUMAN_REVIEW', nullable, required
      - `evidence` union, required
        - object
          - `runtimeConfirmed` boolean, required
          - `knownExploited` boolean, nullable, required
          - `reachability` 'reachable' | 'needs_review' | 'unreachable' | 'not_tested', nullable, required
          - `knownVulnerableVersion` boolean, nullable, required: A dependency finding CONFIRMED by policy (a version match, e.g. Trivy) rather than by an agent verdict; such a finding is not `reachable` on that account alone. Null, like the other dependency facts, when the finding carries no dependency occurrence.
          - `hasWizExposure` boolean, required
          - `secretVerified` boolean, required
          - `validated` true, required
          - `validationProvenance` 'recorded' | 'legacy', required: `recorded` = a validation method is stored on the finding; `legacy` = confirmed before validation methods were tracked.
        - object
          - `runtimeConfirmed` boolean, required
          - `knownExploited` boolean, nullable, required
          - `reachability` 'reachable' | 'needs_review' | 'unreachable' | 'not_tested', nullable, required
          - `knownVulnerableVersion` boolean, nullable, required: A dependency finding CONFIRMED by policy (a version match, e.g. Trivy) rather than by an agent verdict; such a finding is not `reachable` on that account alone. Null, like the other dependency facts, when the finding carries no dependency occurrence.
          - `hasWizExposure` boolean, required
          - `secretVerified` boolean, required
          - `validated` false, required
          - `validationProvenance` unknown, required
      - `assignee` object, nullable, required: The organization member currently assigned to review this finding, or null when it has no assignee. Set when an interactive (board or drawer) move to REVIEWING finds the finding unassigned; cleared by v2.issues.unassign, by undoing that move, or when the membership is removed. updateStatus never changes it.
        - `membershipId` string, required
        - `displayName` string, required
      - `acceptedRiskExpiresAt` string, date-time, nullable, required
      - `slaDueAt` string, date-time, nullable, required: When the finding falls overdue under its SLA policies (the earliest due instant, UTC); null when no enabled policy tracks it, e.g. once it is closed.
      - `allowedTransitions` string[], required: Statuses this actor may move this finding to via an interactive (board) move: source and target FGA permissions, the Patching-needs-a-patch rule, and the REVIEWING membership rule all apply. This does not describe what the public updateStatus endpoint accepts, which has no patch requirement and no REVIEWING membership rule.
      - `transitionAvailability` union[], required: Every status this actor could move this finding to via an interactive (board) move, each with why it is unavailable when it is. Same interactive-move rules as allowedTransitions (patch requirement, source/target permissions, REVIEWING membership) — not the rules of the public updateStatus endpoint.
        - union
          - object
            - `status` 'PENDING_REVIEW' | 'REVIEWING' | 'PATCHING' | 'NON_EXPLOITABLE' | 'FALSE_POSITIVE' | 'ACCEPTED_RISK' | 'RESOLVED' | 'BACKLOG' | 'INFORMATIONAL', required
            - `allowed` true, required
          - object
            - `status` 'PENDING_REVIEW' | 'REVIEWING' | 'PATCHING' | 'NON_EXPLOITABLE' | 'FALSE_POSITIVE' | 'ACCEPTED_RISK' | 'RESOLVED' | 'BACKLOG' | 'INFORMATIONAL', required
            - `allowed` false, required
            - `reason` 'permission' | 'needs_patch' | 'current', required
      - `hasClosePermission` boolean, required: Whether this actor holds the close permission (ISSUE_EDIT_CLOSE) on the repository of this finding. Requesting a re-investigation (issues.requestInvestigation) needs it, because a definitive verdict closes the finding and its ticket.
    - `generatedTitle` string, required
    - `generatedDescription` string, required
    - `vulnClass` string, required
    - `affectedFile` string, required
    - `scanTargetBranch` string, nullable, required
    - `archivedAt` string, nullable, required
    - `silencedAt` string, nullable, required
    - `falsePositiveAt` string, nullable, required
    - `noLongerDetectedAt` string, nullable, required
    - `resolvedAt` string, nullable, required
    - `unpatchable` boolean, nullable, required
    - `validated` 'CONFIRMED' | 'DISCONFIRMED' | 'UNKNOWN', nullable, required
    - `error` string, nullable, required
    - `repository` object, required
      - `id` string, required
      - `name` string, required
      - `monorepoName` string, nullable, required
      - `directoryPartitions` string[], required
      - `monorepoPartitionRole` 'none' | 'scoped' | 'fallback', required
    - `scan` object, required
      - `id` string, required
      - `repository` object, required
        - `id` string, required
      - `commitSha` string, nullable, required
    - `vulnerabilityPatch` object, nullable, required
      - `validated` 'CONFIRMED' | 'DISCONFIRMED' | 'UNKNOWN', required
      - `pullRequestStatus` 'PENDING' | 'ACCEPTED' | 'DENIED', required
      - `prLink` string, nullable, required
      - `error` string, nullable, required
    - `patchGenerationRequestView` union, required
      - object
        - `state` 'QUEUED', required
        - `request` object, required
          - `id` string, required
          - `requestedAt` string, required
          - `dependencyUpgrade` union
            - object
              - …
            - object
              - …
        - `workerAssignment` unknown, required
        - `finalResult` unknown, required
      - object
        - `state` 'IN_PROGRESS', required
        - `request` object, required
          - `id` string, required
          - `requestedAt` string, required
          - `dependencyUpgrade` union
            - object
              - …
            - object
              - …
        - `workerAssignment` object, required
          - `workerId` string, required
          - `assignedAt` string, required
          - `stage` 'ASSIGNED' | 'PREPARING_REPOSITORY' | 'GENERATING_FIX' | 'FINALIZING', required
        - `finalResult` unknown, required
      - object
        - `state` 'SUCCEEDED', required
        - `request` object, required
          - `id` string, required
          - `requestedAt` string, required
          - `dependencyUpgrade` union
            - object
              - …
            - object
              - …
        - `workerAssignment` object, nullable, required
          - `workerId` string, required
          - `assignedAt` string, required
          - `stage` 'ASSIGNED' | 'PREPARING_REPOSITORY' | 'GENERATING_FIX' | 'FINALIZING', required
        - `finalResult` object, required
          - `completedAt` string, required
          - `error` unknown, required
      - object
        - `state` 'FAILED', required
        - `request` object, required
          - `id` string, required
          - `requestedAt` string, required
          - `dependencyUpgrade` union
            - object
              - …
            - object
              - …
        - `workerAssignment` object, nullable, required
          - `workerId` string, required
          - `assignedAt` string, required
          - `stage` 'ASSIGNED' | 'PREPARING_REPOSITORY' | 'GENERATING_FIX' | 'FINALIZING', required
        - `finalResult` object, required
          - `completedAt` string, required
          - `error` string, required
    - `runtimeValidation` object, nullable, required
      - `id` string, required
      - `run` object, required
        - `id` string, required
        - `status` 'PENDING' | 'PROCESSING' | 'COMPLETED' | 'FAILED' | 'CANCELLED', required
        - `triggerReason` 'USER_REQUESTED' | 'AUTO_AFTER_SCAN', required
        - `scope` 'FULL_APPLICATION' | 'SELECTED_ISSUES'
        - `targetIssueCount` integer
        - `createdAt` string, required
        - `completedAt` string, nullable, required
      - `verdict` 'CONFIRMED' | 'DISCONFIRMED' | 'UNTESTABLE' | 'AGENT_ERROR', required
      - `isDynamicallyTestable` boolean, required
      - `testabilityReasoning` string, required
      - `validationReasoning` string, nullable, required
      - `evidenceSummary` string, nullable, required
      - `validationSteps` object[], required
        - `target` string, nullable, required
        - `action` string, required
        - `expectedResult` string, nullable, required
        - `observedResult` string, required
        - `conclusion` string, required
      - `attackReproductionSteps` string[], required
      - `error` string, nullable, required
      - `createdAt` string, required
    - `falsePositiveReason` string, nullable, required
    - `validationSecurityAssessment` string, nullable, required
    - `nonExploitableReason` string, nullable, required
    - `tickets` object[], required: The Jira and Linear tickets this finding is linked to, Jira first and at most one per provider; empty when it has none. `key` is the Jira issue key or the Linear issue identifier (Linear's internal id when no canonical browse URL was stored); `url` is the browse URL, or null when none was stored. Carries no ticket status.
      - `provider` 'jira' | 'linear', required
      - `key` string, required
      - `url` string, nullable, required
  - `totalCount` integer, required
  - `hasMore` boolean, required
  - `nextCursor` string, nullable, required
  - `effectiveFilters` object, required
    - `repositoryScope` object
      - `tagNames` string[]: Match any of up to 100 exact tag names, case-insensitively. Percent signs and underscores are literal.
      - `branchName` string: Select this exact branch for every matched repository unless repositoryBranches specifies a branch.
    - `scanId` string, required
    - `searchQuery` string, required
    - `languages` string[], required
    - `vulnerabilityClasses` string[], required
    - `vulnerabilityClassFilters` object[], required
      - `operator` 'equals' | 'contains' | 'startsWith', required
      - `value` string, required
    - `codeScanTypes` string[], required
    - `statuses` string[], required
    - `detectionTypes` string[], required
    - `showOnlyNewIssues` boolean, required
    - `lane` 'fix_now' | 'next' | 'later' | 'reviewing' | 'patching' | 'resolved' | 'non_exploitable' | 'false_positive' | 'accepted_risk' | 'informational', nullable, required
    - `boardValidation` 'validated' | 'unvalidated' | 'not_examined', nullable, required
    - `knownExploited` boolean, nullable, required
    - `kevRansomware` boolean, nullable, required
    - `epssMin` number, nullable, required
    - `dependencyReachability` string[], required
    - `hasFix` boolean, nullable, required
    - `dependencyQuery` string, required
    - `hasWizExposure` boolean, required
    - `secretVerified` boolean, required
    - `sortBy` 'priority' | 'createdAt' | 'score' | 'title' | 'repository' | 'class' | 'file' | 'patch', required
    - `sortOrder` 'asc' | 'desc', required
    - `scoreLevels` string[], required
    - `severityLevels` string[], required
    - `validationStates` string[], required
    - `runtimeValidationVerdicts` string[], required
    - `reachability` string[], required
    - `cvssAttackVectors` string[], required
    - `cvssAttackComplexities` string[], required
    - `cvssPrivilegesRequired` string[], required
    - `cvssUserInteractions` string[], required
    - `runtimeValidationSetupRequirements` string[], required
    - `scoreRangeMin` number, required
    - `scoreRangeMax` number, required
    - `excludeScore` number, nullable, required
    - `issueIds` string[], required
    - `createdAfter` string, required
    - `createdBefore` string, required
    - `resolvedAfter` string, required
    - `resolvedBefore` string, required
    - `repositoryBranches` object[]: A nonempty list limits results to these repository IDs. repositoryScope and excludedRepositoryBranches also apply; a repository in both lists is excluded. Each branchName overrides repositoryScope.branchName for that repository.
      - `repositoryId` string, required
      - `branchName` string
    - `excludedRepositoryBranches` object[]: Exclude these repository IDs, including any also present in repositoryBranches. Exclusion applies to the whole repository; branchName is ignored.
      - `repositoryId` string, required
      - `branchName` string
    - `applicationFilters` object[], required
      - `repositoryId` string, required
      - `relativePath` string, required

## Other responses

- `400`: Error Response
- `401`: Error Response

---

[API](https://skmtc.dev/zeropath/apis/zeropath-api.md) - [All operations](https://skmtc.dev/zeropath/apis/zeropath-api/llms.txt) - [OpenAPI document](https://skmtc.dev/zeropath/apis/zeropath-api/revisions/126e9c80ba0d?raw)