# GitLab Vulnerabilities API

**Canonical:** https://apis.io/apis/gitlab/gitlab-vulnerabilities-api/  
**Provider:** GitLab — https://apis.io/providers/gitlab/  
**Base URL:** https://gitlab.com/api/v4  
**Documentation:** https://docs.gitlab.com/api/rest/

GitLab Vulnerabilities API is one of 189 APIs that [GitLab](https://apis.io/providers/gitlab/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification and an AsyncAPI event-driven specification. This API exposes 16 JSON Schema definitions. Tagged areas include Vulnerabilities. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, authentication docs, an API reference, rate-limit docs, an AsyncAPI specification, and 16 JSON Schemas.

> [!warning] > These endpoints are in the process of being deprecated and are considered unstable. > The response payload may be subject to change or breakage across GitLab releases. Use the > [GraphQL API](https://docs.gitlab.com/api/graphql/reference/queries/#vulnerabilities) instead. > For more information, see [replace vulnerability REST API with GraphQL](https://docs.gitlab.com/api/vulnerabilities/#replace-vulnerability-rest-api-with-graphql). Use this API to manage [vulnerabilities](https://docs.gitlab.com/user/application_security/vulnerabilities/), retrieve vulnerability findings, and export [vulnerability reports](https://docs.gitlab.com/user/application_security/vulnerability_report/) for a project, group, or instance. Every call to these endpoints must be [authenticated](https://docs.gitlab.com/api/rest/authentication/). If a user isn't a member of a private project, requests return a `404 Not Found` status code. If a user does not have permission to [view the vulnerability report](https://docs.gitlab.com/user/permissions/#project-application-security), requests return a `403 Forbidden` status code. > [!note] > The former Vulnerabilities API was renamed to the Vulnerability Findings API, and the > Vulnerabilities name now serves [vulnerability objects](https://gitlab.com/gitlab-org/gitlab/-/issues/13561). > To fix a broken integration with the former API, change the `vulnerabilities` URL part to > `vulnerability_findings`.

## Operations (20)

| Method | Path | Summary |
|---|---|---|
| POST | `/api/v4/security/projects/{id}/vulnerability_exports` | Create a project-level vulnerability export |
| POST | `/api/v4/security/groups/{id}/vulnerability_exports` | Create a group-level vulnerability export |
| POST | `/api/v4/security/vulnerability_exports` | Create an instance-level vulnerability export |
| GET | `/api/v4/security/vulnerability_exports/{id}` | Retrieve a vulnerability export |
| GET | `/api/v4/security/vulnerability_exports/{id}/download` | Download a vulnerability export |
| POST | `/api/v4/security/projects/{id}/vulnerability_archive_exports` | Create an export for archived vulnerabilities |
| GET | `/api/v4/security/vulnerability_archive_exports/{id}` | Retrieve a vulnerability archive export |
| GET | `/api/v4/security/vulnerability_archive_exports/{id}/download` | Download a vulnerability archive export |
| GET | `/api/v4/vulnerabilities/{id}/issue_links` | Get related issues for a vulnerability |
| POST | `/api/v4/vulnerabilities/{id}/issue_links` | Relate an issue to a vulnerability |
| DELETE | `/api/v4/vulnerabilities/{id}/issue_links/{issue_link_id}` | Delete a link between an issue and a vulnerability |
| GET | `/api/v4/projects/{id}/vulnerability_findings` | List all project vulnerability findings |
| POST | `/api/v4/vulnerabilities/{vulnerability_id}/flags/ai_detection` | Update AI False Positive Detection results |
| GET | `/api/v4/vulnerabilities/{id}` | Retrieve a vulnerability |
| POST | `/api/v4/vulnerabilities/{id}/resolve` | Resolve a vulnerability |
| POST | `/api/v4/vulnerabilities/{id}/dismiss` | Dismiss a vulnerability |
| POST | `/api/v4/vulnerabilities/{id}/confirm` | Confirm a vulnerability |
| POST | `/api/v4/vulnerabilities/{id}/revert` | Revert a vulnerability to detected state |
| GET | `/api/v4/projects/{id}/vulnerabilities` | List all project vulnerabilities |
| POST | `/api/v4/projects/{id}/vulnerabilities` | Create a new vulnerability |

## Machine-readable artifacts (65)

- **OpenAPI** — https://artifacts.apis.io/gitlab/openapi/gitlab-vulnerabilities-api-openapi.yml
- **Documentation** — https://docs.gitlab.com/api/openapi/
- **Documentation** — https://docs.gitlab.com/api/issues/
- **Authentication** — https://docs.gitlab.com/api/rest/authentication/
- **JSONSchema** — https://artifacts.apis.io/gitlab/json-schema/gitlab-put-api-v4-application-settings-request-schema.json
- **JSONSchema** — https://artifacts.apis.io/gitlab/json-schema/gitlab-apientities-geo-node-status-schema.json
- **JSONSchema** — https://artifacts.apis.io/gitlab/json-schema/gitlab-apientities-geo-site-status-schema.json
- **JSONSchema** — https://artifacts.apis.io/gitlab/json-schema/gitlab-apientities-application-setting-schema.json
- **JSONSchema** — https://artifacts.apis.io/gitlab/json-schema/gitlab-post-api-v4-geo-status-request-schema.json
- **JSONSchema** — https://artifacts.apis.io/gitlab/json-schema/gitlab-put-api-v4-projects-id-request-schema.json
- **Documentation** — https://docs.gitlab.com/api/merge_requests/
- **Documentation** — https://docs.gitlab.com/api/pipelines/
- **Documentation** — https://docs.gitlab.com/api/jobs/
- **Documentation** — https://docs.gitlab.com/api/runners/
- **Documentation** — https://docs.gitlab.com/api/users/
- **Documentation** — https://docs.gitlab.com/api/repositories/
- **Documentation** — https://docs.gitlab.com/api/commits/
- **Documentation** — https://docs.gitlab.com/api/branches/
- **Documentation** — https://docs.gitlab.com/api/tags/
- **Documentation** — https://docs.gitlab.com/api/releases/
- **Documentation** — https://docs.gitlab.com/api/environments/
- **Documentation** — https://docs.gitlab.com/api/deployments/
- **Documentation** — https://docs.gitlab.com/api/pipeline_schedules/
- **Documentation** — https://docs.gitlab.com/api/labels/
- **Documentation** — https://docs.gitlab.com/api/milestones/
- **Documentation** — https://docs.gitlab.com/api/notes/
- **Documentation** — https://docs.gitlab.com/api/snippets/
- **Documentation** — https://docs.gitlab.com/api/packages/
- **Documentation** — https://docs.gitlab.com/api/container_registry/
- **Documentation** — https://docs.gitlab.com/api/vulnerabilities/
- **Documentation** — https://docs.gitlab.com/api/deploy_keys/
- **Documentation** — https://docs.gitlab.com/api/protected_branches/
- **Documentation** — https://docs.gitlab.com/api/wikis/
- **Documentation** — https://docs.gitlab.com/api/events/
- **Documentation** — https://docs.gitlab.com/api/search/
- **Documentation** — https://docs.gitlab.com/api/namespaces/
- **Documentation** — https://docs.gitlab.com/api/groups/
- **Documentation** — https://docs.gitlab.com/api/projects/
- **Documentation** — https://docs.gitlab.com/api/applications/
- **Documentation** — https://docs.gitlab.com/api/avatar/
- …and 25 more, listed in full on the page.

## Other GitLab APIs (12)

- [GitLab Orbit gRPC API](https://apis.io/apis/gitlab/gitlab-orbit-api/)
- [GitLab GraphQL API](https://apis.io/apis/gitlab/gitlab-graphql-api/)
- [GitLab Applications API](https://apis.io/apis/gitlab/gitlab-applications-api/)
- [GitLab Authorization API](https://apis.io/apis/gitlab/gitlab-authorization-api/)
- [GitLab Broadcast Messages API](https://apis.io/apis/gitlab/gitlab-broadcast-messages-api/)
- [GitLab Groups API](https://apis.io/apis/gitlab/gitlab-groups-api/)
- [GitLab Metadata API](https://apis.io/apis/gitlab/gitlab-metadata-api/)
- [GitLab Project Webhooks API](https://apis.io/apis/gitlab/gitlab-project-webhooks-api/)
- [GitLab Projects API](https://apis.io/apis/gitlab/gitlab-projects-api/)
- [GitLab Tokens API](https://apis.io/apis/gitlab/gitlab-tokens-api/)
- [GitLab User Info API](https://apis.io/apis/gitlab/gitlab-user-info-api/)
- [GitLab Webhook Configuration API](https://apis.io/apis/gitlab/gitlab-webhook-configuration-api/)

## Tags

Vulnerabilities

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/gitlab/gitlab-vulnerabilities-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/gitlab/.