Rapid7 Vulnerabilities API

openapi: 3.2.0
info:
  title: InsightAppSec Accounts Vulnerabilities API
  description: '<p>Welcome to the reference documentation for the public APIs available for InsightAppSec.</p><p>Here are a few resources to help you learn how to start using our APIs:</p><ul><li><a href=''https://insight.help.rapid7.com/docs/api-overview''>Learn about basic concepts and capabilities</a></li><li><a href=''https://insight.help.rapid7.com/docs/managing-platform-api-keys''>Get an Insight platform API key to set up authentication</a></li><li><a href=''https://insight.help.rapid7.com/docs/product-apis''>See available Insight product APIs</a></li><li><a href=''https://insightappsec.help.rapid7.com/docs''>Learn more about InsightAppSec</a></li></ul><p>After you''ve got the basics down, you can use this API guide to find examples of requests and responses.</p></p><h2>Permissions</h2><p>This API uses the platform role of a user''s API key to inherit a set of permissions.</p><p><b>Notes</b>:<li>Platform Admins do not require explicit access to an App in order to see it, or anything associated with it</li><li>Organization keys will inherit Product Admin permissions.</li></p><table><thead><tr><th>Role</th><th>Permissions</th></tr></thead><tbody><tr><td>Product Admin</td><td><li><code>Manage Apps</code></li><li><code>Read Attack Templates</code></li><li><code>Manage Targets</code><li><code>Manage Scan Configs</code><li><code>Manage Scans</code></li><li><code>Manage Vulnerabilities</code></li><li><code>Administer Vulnerability Comments</code></li><li><code>Manage Engines</code></li><li><code>Manage Engine Groups</code></li><li><code>Manage Schedules</code></li><li><code>Manage Blackouts</code></li><li><code>Manage Global Blackouts</code></li><li><code>Manage Files</code></li><li><code>Manage Tags</code></li><li><code>Manage PDF Report</code></li></td></tr><tr><td>Read Write</td><td><li><code>Manage Apps</code></li><li><code>Read Attack Templates</code></li><li><code>Read Targets</code><li><code>Manage Scan Configs</code><li><code>Manage Scans</code></li><li><code>Manage Vulnerabilities</code></li><li><code>Manage Vulnerability Comments</code></li><li><code>Read Engines</code></li><li><code>Read Engine Groups</code></li><li><code>Manage Schedules</code></li><li><code>Manage Blackouts</code></li><li><code>Manage Files</code></li><li><code>Manage Tags</code></li><li><code>Manage PDF Report</code></li></td></tr><tr><td>Read Only</td><td><li><code>Read Apps</code></li><li><code>Read Attack Templates</code></li><li><code>Read Targets</code><li><code>Read Scan Configs</code><li><code>Read Scans</code></li><li><code>Read Vulnerabilities</code></li><li><code>Read Vulnerability Comments</code></li><li><code>Read Engines</code></li><li><code>Read Engine Groups</code></li><li><code>Read Schedules</code></li><li><code>Read Blackouts</code></li><li><code>Read Files</code></li><li><code>Read Tags</code></li><li><code>Read PDF Report</code></li></td></tr></tbody><table><a href="#pagination"><h2 id="pagination">Pagination Parameters</h2></a><p>The following query parameters can be used to control the order, offset and size of the returned data</p><table><thead><tr><th>Parameter</th><th>Description</th><th>Example</th></tr></thead><tbody><tr><td><code>index</code></td><td><p>The 0-based index of the page of data desired (default: 0)<p></td><td><code>?index=2</code></td></tr><tr><td><code>size</code></td><td><p>The size of the page of data desired (min: 1, max: 1000, default: 50)<p></td><td><code>?size=10</code></td></tr><tr><td><code>sort</code></td><td><p>The sort terms and (optional) directions for the desired ordering of data (default: specific to each resource)<p></td><td><code>?sort=scan.submit_time,DESC,scan.status</code></td></tr><tr><td><code>page-token</code></td><td><p>The page token, used as an alternative to <code>index</code> (default: Not provided)<p></td><td><code>?page-token=NDM0NTk0NTIyOjo6X1M6OjpiYW5hbmFz</code></td></tr></tbody></table><h3>Paging using a page token</h3><p>When intending to page beyond the 10,000th result, or as an alternative to using the <code>index</code> query parameter, the <code>page-token</code> option may be used instead. After retrieving the first page, the <code>page_token</code> will be present in the <code>metadata</code> section of the response.<br />For example, with <code>size=99</code>, <code>index=0</code> to <code>index=99</code> may be used. To load the next page, use the <code>page_token</code> value used in the response e.g. <code>?page-token=NDM0NTk0NTIyO</code> </p><h2>Creating resources</h2><p>As is generally the accepted practice with REST-ful APIs, creating a resource can be performed by sending an appropriately formatted POST request. Any ID provided for a new resource in a POST request <i>body</i> will simply be ignored (and a new one generated internally and returned as part of the resource in subsequent GET requests), and POST requests to URLs following a format similar to <code>.../resource/<ID></code> are unsupported and should respond with <code>415 Method Not Allowed</code>. All requests which successfully create a resource and respond with <code>201 Created</code> will contain a <code>Location</code> header the value of which is an absolute URI for the resource (the ID of which can be determined as the last section of the path in the given URI). For example:<br /><code>Location: https://us.api.insight.rapid7.com/ias/v1/scans/12345678-1234-5678-90AB-1234567890AB</code></p><h2>Date, Time and Timezone Support</h2><p>The value of date and date-time type properties are fixed to the common ISO-8601 format. Unless otherwise specified, all date or date-time data in response bodies are expressed in UTC, and it is also expected that data provided in request bodies are also expressed in UTC.</p><h3>Schedules and Blackouts</h3><p>The <code>first_start</code> and <code>first_end</code> properties of both Blackouts and Schedules, and the <code>last_start</code> property of Blackouts may be specified with a timezone. If the timezone is not specified, it is assumed to be UTC. For example:<br /><code>2019-08-12T14:00:00.000000Z[Asia/Tokyo]</code><br />It is also possible to specify the timezone as an offset of either <code>GMT</code> or <code>UTC</code>. For example:<br /><code>2019-09-04T15:00:00.000000Z[GMT+03:00]</code></p><table><thead><tr><th>Value</th><th>Format</th><th>Notes</th></tr></thead><tbody><tr><td>Date</td><td>YYYY-MM-DD</td><td>Defaults to 12 am UTC (if used for a date &amp; time)</td></tr><tr><td>Date &amp; time only</td><td>YYYY-MM-DD''T''hh:mm:ss[.nnn]</td><td>Defaults to UTC</td></tr><tr><td>Date &amp; time in UTC</td><td>YYYY-MM-DD''T''hh:mm:ss[.nnn]Z</td><td></td></tr><tr><td>Date &amp; time with specific timezone</td><td>YYYY-MM-DD''T''hh:mm:ss[.nnn]Z[TimeZoneId]</td><td></td></tr></tbody></table><h2>Searching and Filtering</h2><p>One characteristic of a powerful API is support for complex search and filtering of resources using a flexible query language. It is entirely possible to provide basic search and filtering functionality on standard GET resource collection operations using HTTP query parameters, but this becomes restrictive when attempting to encode boolean logic. Other solutions are also possible but come with equally restrictive compromises. The most effective way to facilitate this complex search and filtering is to provide it as a top-level API with a robust Domain-Specific Language (DSL).</p><p>For simple data retrieval that supports paging and sorting functionality, use the traditional resource-specific GET collection operations; for more complex data retrieval that supports a user-crafted query DSL, use the global Search operation.</p><h2>Errors</h2><p>Any response from the API with an HTTP Status Code in the 4xx or 5xx range indicates an error. If in the 4xx range it indicates a client-side error, where in the 5xx range it indicates a server-side error. All responses indicating an error should be JSON formatted, and contain both a "status" and a "message" property indicating the cause of the error, a "r7-correlation-id" header should also always be returned in the format of a UUID, which uniquely identifies the HTTP exchange that took place and caused the error (this header is present on <i>every</i> request). On some occasions, an "error_code" property will be included in the response body, which can provide the support team further context into the cause of the error in cases where the message is not explicitly clear.</p><p>When contacting support about error responses received from the API, please attempt to include, at minimum:<ul><li>A description of the requests intent</li><li>The request URL</li><li>The request body</li><li>The error response body</li><li>The error response "r7-correlation-id" header</li></ul></p><h3>Validation Errors</h3><p>Specifically, when a response with an HTTP Status Code of 422 is returned, this indicates a validation error, almost always received in a response from a non-idempotent request (normally PUT, POST or DELETE). In this case, there should be an additional "errors" property included in the JSON response body that should describe the cause of the validation exception; this will almost always require a modification to the request body to resolve. </p>'
  version: v1
servers:
- url: https://[region].api.insight.rapid7.com/ias/v1
tags:
- name: Vulnerabilities
  description: A Vulnerability is a resource that encapsulates any information found by any Scan over the lifetime of an App, that <i>may</i> identify where and how an App could be exploited. Each Vulnerability contains information about the Root Cause (location) and Variances (attack types and natures) which contribute to the evidence that the Vulnerability exists. A Vulnerability cannot be explicitly created or deleted via the API, as its life cycle is managed by the product; but, it can be implicitly created by submitting a Scan and can be implicitly deleted by deleting the App that owns it. There are a number of fields which are mutable and can help to control the workflow of the management of an App's Vulnerabilities.
paths:
  /modules:
    get:
      tags:
      - Vulnerabilities
      summary: Get Modules
      description: Get the metadata of all modules
      operationId: get-modules
      responses:
        '415':
          description: Unsupported Media Type
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ModuleMetadata'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthenticated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Resource not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /modules/{module-id}:
    get:
      tags:
      - Vulnerabilities
      summary: Get Module
      description: Get the metadata of a module
      operationId: get-module
      parameters:
      - name: module-id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '415':
          description: Unsupported Media Type
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ModuleMetadata'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthenticated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Resource not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /modules/{module-id}/attacks/{attack-id}:
    get:
      tags:
      - Vulnerabilities
      summary: Get Attack
      description: Get the metadata of an attack
      operationId: get-attack
      parameters:
      - name: module-id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: attack-id
        in: path
        required: true
        schema:
          type: string
      responses:
        '415':
          description: Unsupported Media Type
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AttackMetadata'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthenticated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Resource not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /modules/{module-id}/attacks/{attack-id}/documentation:
    get:
      tags:
      - Vulnerabilities
      summary: Get Attack Documentation
      description: Get the documentation of an attack
      operationId: get-attack-documentation
      parameters:
      - name: module-id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: attack-id
        in: path
        required: true
        schema:
          type: string
      responses:
        '415':
          description: Unsupported Media Type
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AttackDocumentation'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthenticated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Resource not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /vulnerabilities:
    get:
      tags:
      - Vulnerabilities
      summary: Get Vulnerabilities
      description: Get a page of Vulnerabilities, based on supplied <a href="#pagination">pagination parameters</a>. <p>The default sort for Vulnerabilities is "severity" (descending); for a full list of sortable properties, refer to the Search Catalog detailed in the Search API.</p>
      operationId: get-vulnerabilities
      parameters:
      - name: index
        in: query
        schema:
          type: integer
          format: int32
      - name: size
        in: query
        schema:
          type: integer
          format: int32
      - name: sort
        in: query
        schema:
          type: string
      - name: page-token
        in: query
        schema:
          type: string
      responses:
        '415':
          description: Unsupported Media Type
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PageVulnerability'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthenticated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Resource not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /vulnerabilities/{vuln-id}:
    get:
      tags:
      - Vulnerabilities
      summary: Get Vulnerability
      description: Get a Vulnerability
      operationId: get-vulnerability
      parameters:
      - name: vuln-id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '415':
          description: Unsupported Media Type
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EntityModelVulnerability'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthenticated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Resource not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    put:
      tags:
      - Vulnerabilities
      summary: Update Vulnerability
      description: Update a Vulnerability
      operationId: update-vulnerability
      parameters:
      - name: vuln-id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Vulnerability'
        required: true
      responses:
        '415':
          description: Unsupported Media Type
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '200':
          description: OK
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthenticated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Resource not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: Action conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '422':
          description: Resource validation error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationErrors'
  /vulnerabilities/{vuln-id}/discoveries:
    get:
      tags:
      - Vulnerabilities
      summary: Get Vulnerability Discoveries
      description: Get a page of Vulnerability Discoveries, based on supplied <a href="#pagination">pagination parameters</a>. <p>The default sort for Vulnerability Discoveries is "discovered" (descending) </p>
      operationId: get-vulnerability-discoveries
      parameters:
      - name: vuln-id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: index
        in: query
        schema:
          type: integer
          format: int32
      - name: size
        in: query
        schema:
          type: integer
          format: int32
      - name: sort
        in: query
        schema:
          type: string
      - name: page-token
        in: query
        schema:
          type: string
      responses:
        '415':
          description: Unsupported Media Type
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PageVulnerabilityDiscovery'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthenticated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Resource not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /vulnerabilities/{vuln-id}/discoveries/{vuln-discovery-id}:
    get:
      tags:
      - Vulnerabilities
      summary: Get Vulnerability Discovery
      description: Get a Vulnerability Discovery
      operationId: get-vulnerability-discovery
      parameters:
      - name: vuln-id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: vuln-discovery-id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '415':
          description: Unsupported Media Type
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EntityModelVulnerabilityDiscovery'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthenticated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Resource not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    EntityModelVulnerabilityDiscovery:
      properties:
        id:
          type: string
          format: uuid
          description: The ID of the Vulnerability Discovery
          readOnly: true
        vulnerability:
          $ref: '#/components/schemas/ReadOnlyIdResource'
        scan:
          $ref: '#/components/schemas/ReadOnlyIdResource'
        discovered:
          type: string
          description: The time the Vulnerability Discovery was discovered
          example: '2021-08-03T14:07:37'
          readOnly: true
        links:
          type: array
          items:
            $ref: '#/components/schemas/Link'
          readOnly: true
    RootCause:
      description: A descriptor for the location of the Vulnerability
      properties:
        url:
          type: string
          description: The URL
          readOnly: true
        parameter:
          type: string
          description: The parameter from the URL
          readOnly: true
        method:
          type: string
          description: The HTTP method
          readOnly: true
      readOnly: true
      title: RootCause
    Link:
      properties:
        rel:
          type: string
        href:
          type: string
        profile:
          type: string
        name:
          type: string
      readOnly: true
    EntityModelVulnerability:
      properties:
        id:
          type: string
          format: uuid
          description: The ID of the Vulnerability
          readOnly: true
        app:
          $ref: '#/components/schemas/ReadOnlyIdResource'
        root_cause:
          $ref: '#/components/schemas/RootCause'
        severity:
          type: string
          description: The severity of the Vulnerability
          enum:
          - SAFE
          - INFORMATIONAL
          - LOW
          - MEDIUM
          - HIGH
          - CRITICAL
        status:
          type: string
          description: The status of the Vulnerability
          enum:
          - UNREVIEWED
          - FALSE_POSITIVE
          - VERIFIED
          - IGNORED
          - REMEDIATED
          - DUPLICATE
        first_discovered:
          type: string
          description: The time the Vulnerability was first discovered
          example: '2021-08-03T14:07:37'
          readOnly: true
        last_discovered:
          type: string
          description: The time the Vulnerability was last discovered
          example: '2021-08-03T14:07:37'
          readOnly: true
        newly_discovered:
          type: boolean
          description: 'Indicates that the vulnerability has been found in the latest scan and has not been discovered before '
          readOnly: true
        variances:
          type: array
          description: Evidence found that indicates the presence of a Vulnerability
          items:
            $ref: '#/components/schemas/Variance'
          readOnly: true
        vector_string:
          type: string
          description: Textual representation of the metric values used to determine the CVSS score
          readOnly: true
        vulnerability_score:
          type: number
          format: double
          description: CVSS score which represents the severity of an information security vulnerability
          readOnly: true
        insight_ui_url:
          type: string
          description: Direct link to the Vulnerability on InsightAppSec UI. <b>Require InsightAppSec login before use.<b>
          readOnly: true
        updated_time:
          type: string
          format: date-time
          description: ${public-api.docs.models.vulnerability.properties.updated-time}
          readOnly: true
        links:
          type: array
          items:
            $ref: '#/components/schemas/Link'
          readOnly: true
    StringReferenceResource:
      description: The ID of the attack
      properties:
        id:
          type: string
      readOnly: true
    AttackMetadata:
      properties:
        id:
          type: string
          description: The ID of the attack
          readOnly: true
        type:
          type: string
          description: The type of the attack
          readOnly: true
        class:
          type: string
          description: The class of the attack
          readOnly: true
        description:
          type: string
          description: The description of the attack
          readOnly: true
      title: AttackMetadata
    ModuleMetadata:
      properties:
        id:
          type: string
          format: uuid
          description: The ID of the module
          readOnly: true
        name:
          type: string
          description: The name of the module
          readOnly: true
        description:
          type: string
          description: The description of the module
          readOnly: true
      title: ModuleMetadata
    ValidationError:
      properties:
        type:
          type: string
          description: The type of the validation error
          enum:
          - OBJECT
          - PROPERTY
          readOnly: true
        context:
          type: string
          description: An optional contextual indicator of a part of the request which failed validation
          readOnly: true
        explanation:
          type: string
          description: Details of the validation error
          readOnly: true
    PageMetadata:
      properties:
        index:
          type: integer
          format: int64
        size:
          type: integer
          format: int64
        sort:
          type: string
        total_data:
          type: integer
          format: int64
        total_pages:
          type: integer
          format: int64
        page_token:
          type: string
    Exchange:
      description: The HTTP exchange executed as part of the attack
      properties:
        id:
          type: string
          format: uuid
          description: The ID of the Exchange
          readOnly: true
        request:
          type: string
          description: The critical section of the request payload
          readOnly: true
        response:
          type: string
          description: The critical section of the response payload
          readOnly: true
      readOnly: true
      title: Exchange
    Vulnerability:
      properties:
        id:
          type: string
          format: uuid
          description: The ID of the Vulnerability
          readOnly: true
        app:
          $ref: '#/components/schemas/ReadOnlyIdResource'
        root_cause:
          $ref: '#/components/sc

# --- truncated at 32 KB (43 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/rapid7/refs/heads/main/openapi/rapid7-vulnerabilities-api-openapi.yml