Contrast Security Vulnerabilities API
Vulnerabilities detected in runtime by Contrast Assess are weaknesses in the application code that allow an attacker to cause harm.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/contrast-security:contrast-security-vulnerabilities-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Contrast Assess Vulnerabilities API
description: Contrast Assess API for viewing and managing data, including vulnerabilities and libraries, for your organization in Contrast via your API key. See Contrast Documentation ( https://docs.contrastsecurity.com/en/assess.html) for more information.
version: 4.0.0
x-logo:
url: /logo.svg
href: /
servers:
- url: https://{baseUrl}
variables:
baseUrl:
default: app.contrastsecurity.com
description: The base URL of your Contrast instance
security:
- Contrast-API-Key: []
Authorization: []
tags:
- name: Vulnerabilities
description: Vulnerabilities detected in runtime by Contrast Assess are weaknesses in the application code that allow an attacker to cause harm.
paths:
/organizations/{organizationId}/vulnerabilities:
get:
tags:
- Vulnerabilities
summary: Get vulnerabilities
description: Returns all vulnerabilities from the applications your user role has access to in the organization.
operationId: getVulnerabilities
parameters:
- name: organizationId
in: path
required: true
schema:
type: string
format: uuid
example: 2411f46c-7f57-426e-be61-82d583722c8d
responses:
'401':
$ref: '#/components/responses/Unauthorized401'
'403':
$ref: '#/components/responses/Forbidden403'
'200':
description: Request successful
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/V4Vulnerability'
/organizations/{organizationId}/vulnerabilities/{vulnerabilityId}:
get:
tags:
- Vulnerabilities
summary: Get vulnerability
description: Gets a vulnerability by ID.
operationId: getVulnerability
parameters:
- name: organizationId
in: path
required: true
schema:
type: string
format: uuid
example: 2411f46c-7f57-426e-be61-82d583722c8d
- name: vulnerabilityId
in: path
required: true
schema:
type: string
example: UPF2-Z0YH-O121-IWBX
responses:
'401':
$ref: '#/components/responses/Unauthorized401'
'403':
$ref: '#/components/responses/Forbidden403'
'404':
$ref: '#/components/responses/NotFound404'
'200':
description: Request successful
content:
application/json:
schema:
$ref: '#/components/schemas/V4Vulnerability'
/organizations/{organizationId}/applications/{applicationId}/vulnerabilities:
get:
tags:
- Vulnerabilities
summary: Get application vulnerabilities
description: Returns all vulnerabilities for an application.
operationId: getVulnerabilitiesForApplication
parameters:
- name: organizationId
in: path
required: true
schema:
type: string
format: uuid
example: 2411f46c-7f57-426e-be61-82d583722c8d
- name: applicationId
in: path
required: true
schema:
type: string
format: uuid
example: 2411f46c-7f57-426e-be61-82d583722c8d
responses:
'401':
$ref: '#/components/responses/Unauthorized401'
'403':
$ref: '#/components/responses/Forbidden403'
'200':
description: Request successful
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/V4Vulnerability'
/organizations/{organizationId}/applications/{applicationId}/vulnerabilities/{vulnerabilityId}:
get:
tags:
- Vulnerabilities
summary: Get application vulnerability
description: Gets a specific vulnerability in an application.
operationId: getVulnerabilityForApplication
parameters:
- name: organizationId
in: path
required: true
schema:
type: string
format: uuid
example: 2411f46c-7f57-426e-be61-82d583722c8d
- name: applicationId
in: path
required: true
schema:
type: string
format: uuid
example: 2411f46c-7f57-426e-be61-82d583722c8d
- name: vulnerabilityId
in: path
required: true
schema:
type: string
example: UPF2-Z0YH-O121-IWBX
responses:
'401':
$ref: '#/components/responses/Unauthorized401'
'403':
$ref: '#/components/responses/Forbidden403'
'200':
description: Request successful
content:
application/json:
schema:
$ref: '#/components/schemas/V4Vulnerability'
components:
schemas:
V4Vulnerability:
type: object
properties:
id:
type: string
description: Vulnerability ID
applicationId:
type: string
description: Application ID.
format: uuid
title:
type: string
description: The display title of this vulnerability as shown in the Contrast web interface. This description is auto-generated and is guaranteed to be unique for each vulnerability in an application.
severity:
type: string
description: The level of severity of this vulnerability. The severity is auto-assigned based on the violated rule when the vulnerability is first created. However, it can be changed from within the Contrast web interface.
enum:
- CRITICAL
- HIGH
- MEDIUM
- LOW
- NOTE
ruleName:
type: string
description: The name of the rule that detected this vulnerability.
tags:
type: array
description: Tags associated with the vulnerability.
items:
type: string
firstSeenTime:
type: string
description: The first time this vulnerability was seen.
format: date-time
lastSeenTime:
type: string
description: The last time this vulnerability was seen.
format: date-time
closedTime:
type: string
description: The time this vulnerability was marked as remediated.
format: date-time
status:
type: string
description: The current status assigned to this vulnerability.
enum:
- REPORTED
- SUSPICIOUS
- CONFIRMED
- NOT_A_PROBLEM
- FIXED
- REMEDIATED
- AUTO_REMEDIATED
substatus:
type: string
description: The substatus of the vulnerability.
enum:
- EMPTY
- FALSE_POSITIVE
- SECURITY_CONTROL
- EXTERNAL_CONTROL
- TRUSTED
- OTHER
category:
type: string
description: Vulnerability category.
enum:
- ACCESS_CONTROL
- AUTHENTICATION
- CONFIGURATION
- AVAILABILITY
- CACHING
- CVE
- CRYPTOGRAPHY
- ERROR_HANDLING
- INJECTION
- SECURE_COMMUNICATION
- SESSION_MANAGEMENT
- INPUT_VALIDATION
- XSS
defaultSeverity:
type: string
description: The original severity of this vulnerability. You can change the severity of the vulnerability. This indicates the original value was assigned based on the rule and your organization's settings.
enum:
- CRITICAL
- HIGH
- MEDIUM
- LOW
- NOTE
confidence:
type: string
description: The level of confidence that this is a true positive result.
enum:
- LOW
- MEDIUM
- HIGH
likelihood:
type: string
description: Likelihood of this vulnerability to actually be exploited.
enum:
- LOW
- MEDIUM
- HIGH
impact:
type: string
description: The level of negative impact an exploit of this vulnerability would have.
enum:
- LOW
- MEDIUM
- HIGH
programmingLanguage:
type: string
description: Programming language with a detected vulnerability.
enum:
- JAVA
- DOTNET
- NODE
- RUBY
- PROXY
- PYTHON
- DOTNET_CORE
- GO
- PHP
description: A vulnerability represents a weakness in the application code that allows an attacker to cause harm. In the Contrast Platform, the term vulnerability specifically refers to an instance of a weakness in an application found by the Contrast Asses Agent at runtime.
responses:
Unauthorized401:
description: Unauthorized
content:
application/json:
examples:
Unauthorized:
description: Unauthorized
value:
message: Authorization failure
details: []
Forbidden403:
description: Forbidden
content:
application/json:
examples:
Forbidden:
description: Forbidden
value:
message: Authorization failure
details: []
NotFound404:
description: Resource not found
content:
application/json:
examples:
Resource not found:
description: Resource not found
value:
message:
- Entity not found
details: []
securitySchemes:
Contrast-API-Key:
type: apiKey
in: header
name: API-Key
Authorization:
type: apiKey
in: header
name: Authorization