> ## Documentation Index
> Fetch the complete documentation index at: https://www.towbar.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# List workspace vulnerability findings

> List workspace vulnerability findings through the Towbar REST API.

Required permissions: alert.read. Personal keys are capped by their owner’s current team role.

See [request conventions](/docs/api/overview) and [automation workflows](/docs/api/workflows). MCP clients use the task-oriented [tool catalogue](/docs/api/mcp-tools).


## OpenAPI

````yaml api-reference/openapi.json GET /monitoring/vulnerabilities
openapi: 3.1.0
info:
  title: Towbar API
  version: 2.0.0
  description: >-
    Manage your Towbar control plane with a bearer API key. Keys inherit current
    workspace permissions.
servers:
  - url: https://api.example.com/v1/api
security: []
paths:
  /monitoring/vulnerabilities:
    get:
      tags:
        - Workspace / Monitoring
      summary: List workspace vulnerability findings
      description: >-
        Required permissions: alert.read. Personal keys are capped by the
        current member role; team keys use explicit grants.
      operationId: get_monitoring_vulnerabilities
      parameters:
        - name: appId
          in: query
          required: false
          schema:
            type: string
            format: uuid
            pattern: >-
              ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
        - name: limit
          in: query
          required: false
          schema:
            default: 20
            type: integer
            minimum: 1
            maximum: 50
        - name: page
          in: query
          required: false
          schema:
            default: 1
            type: integer
            minimum: 1
            maximum: 10000
        - name: severity
          in: query
          required: false
          schema:
            default: all
            type: string
            enum:
              - all
              - critical
              - high
              - medium
              - low
              - unknown
      responses:
        '200':
          description: >-
            Paginated advisories from the latest scanned image of each App,
            ranked by severity with app, source, and server identity, plus
            workspace severity totals. Resources are not image-scanned.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Response_55'
                  - type: object
                    properties:
                      localization:
                        $schema: https://json-schema.org/draft/2020-12/schema
                        type: object
                        properties:
                          dateFormat:
                            type: string
                            enum:
                              - day-short-month-year
                              - short-month-day-year
                              - year-month-day
                              - day-month-year
                              - month-day-year
                          timeFormat:
                            type: string
                            enum:
                              - 24-hour
                              - 12-hour
                              - 24-hour-seconds
                              - 12-hour-seconds
                          timeZone:
                            type: string
                          timestamps:
                            type: object
                            propertyNames:
                              type: string
                            additionalProperties:
                              type: object
                              properties:
                                date:
                                  type: string
                                time:
                                  type:
                                    - string
                                    - 'null'
                                dateTime:
                                  type:
                                    - string
                                    - 'null'
                                timeZone:
                                  type: string
                                zoneLabel:
                                  type: string
                                epochMilliseconds:
                                  type: number
                                inputDateTime:
                                  type:
                                    - string
                                    - 'null'
                              required:
                                - date
                                - time
                                - dateTime
                                - timeZone
                                - zoneLabel
                                - epochMilliseconds
                                - inputDateTime
                              additionalProperties: false
                        required:
                          - dateFormat
                          - timeFormat
                          - timeZone
                          - timestamps
                        additionalProperties: false
                    required:
                      - localization
        '400':
          $ref: '#/components/responses/ApiError'
        '401':
          $ref: '#/components/responses/ApiError'
        '403':
          $ref: '#/components/responses/ApiError'
        '404':
          $ref: '#/components/responses/ApiError'
        '409':
          $ref: '#/components/responses/ApiError'
        '413':
          $ref: '#/components/responses/ApiError'
        '422':
          $ref: '#/components/responses/ApiError'
        '429':
          $ref: '#/components/responses/RateLimited'
        '500':
          $ref: '#/components/responses/ApiError'
      security:
        - bearerAuth: []
components:
  schemas:
    Response_55:
      type: object
      properties:
        findings:
          type: array
          items:
            $ref: '#/components/schemas/Response_56'
        nextPage:
          anyOf:
            - type: 'null'
            - type: number
        page:
          type: number
        summary:
          $ref: '#/components/schemas/SummaryRow_57'
      required:
        - findings
        - nextPage
        - page
        - summary
    Response_56:
      type: object
      properties:
        appArchivedAt:
          anyOf:
            - type: 'null'
            - type: string
        scannedAt:
          anyOf:
            - type: 'null'
            - type: string
        advisoryId:
          type: string
        appId:
          type: string
        appName:
          type: string
        deploymentId:
          type: string
        fixedVersion:
          anyOf:
            - type: 'null'
            - type: string
        id:
          type: string
        imageDigest:
          type: string
        installedVersion:
          type: string
        packageName:
          type: string
        scanState:
          anyOf:
            - type: string
              const: running
            - type: string
              const: failed
            - type: string
              const: pending
            - type: string
              const: clean
            - type: string
              const: findings
        serverId:
          type: string
        serverName:
          type: string
        severity:
          anyOf:
            - type: string
              const: unknown
            - type: string
              const: high
            - type: string
              const: low
            - type: string
              const: critical
            - type: string
              const: medium
        sourceId:
          type: string
        sourceName:
          anyOf:
            - type: 'null'
            - type: string
        target:
          type: string
      required:
        - appArchivedAt
        - scannedAt
        - advisoryId
        - appId
        - appName
        - deploymentId
        - fixedVersion
        - id
        - imageDigest
        - installedVersion
        - packageName
        - scanState
        - serverId
        - serverName
        - severity
        - sourceId
        - sourceName
        - target
    SummaryRow_57:
      type: object
      properties:
        activeScans:
          type: number
        cleanScans:
          type: number
        critical:
          type: number
        failedScans:
          type: number
        high:
          type: number
        low:
          type: number
        medium:
          type: number
        scansWithFindings:
          type: number
        unknown:
          type: number
      required:
        - activeScans
        - cleanScans
        - critical
        - failedScans
        - high
        - low
        - medium
        - scansWithFindings
        - unknown
  responses:
    ApiError:
      description: Request failed. The error object contains code, message, and requestId.
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: object
                required:
                  - code
                  - message
                  - requestId
                properties:
                  code:
                    type: string
                  message:
                    type: string
                  requestId:
                    type: string
    RateLimited:
      description: Request failed. The error object contains code, message, and requestId.
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: object
                required:
                  - code
                  - message
                  - requestId
                properties:
                  code:
                    type: string
                  message:
                    type: string
                  requestId:
                    type: string
      headers:
        Retry-After:
          description: Seconds before retrying
          schema:
            type: integer
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: Towbar API key

````