SecurityScorecard · Schema
FindingsList
CompanyEnterpriseCybersecuritySecurity RatingsThird-Party Risk ManagementRisk ManagementAttack SurfaceCompliance
Properties
| Name | Type | Description |
|---|---|---|
| entries | array | |
| size | integer | The number of records to be returned per page |
| page | integer | The page number to be returned |
| total | integer | The total number of records matching the given query |
JSON Schema
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://raw.githubusercontent.com/api-evangelist/security-scorecard/main/json-schema/security-scorecard-findings-list-schema.json",
"title": "FindingsList",
"x-generated": "2026-10-14",
"x-method": "derived",
"x-generator": "derive-json-schema.py",
"x-source": "openapi/security-scorecard-securityscorecard-openapi.yml#/components/schemas/FindingsList",
"type": "object",
"additionalProperties": false,
"properties": {
"entries": {
"type": "array",
"items": {
"allOf": [
{
"type": "object",
"properties": {
"vendor_id": {
"pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
"description": "vendor identifier",
"type": "string"
},
"vendor_domain": {
"type": "string",
"description": "domain of the vendor"
},
"vendor_name": {
"type": "string",
"description": "name of the vendor"
},
"customers": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
"description": "id of the customer",
"type": "string"
},
"domain": {
"type": "string",
"description": "domain of the customer"
},
"name": {
"type": "string",
"description": "name of the customer"
}
},
"required": [
"id",
"domain",
"name"
]
}
},
"report": {
"type": "boolean",
"description": "is reported"
},
"triaged": {
"type": "boolean",
"description": "is triaged"
},
"is_active_breach": {
"type": "boolean",
"description": "vendor has breach"
},
"edited_at": {
"type": "string",
"pattern": "^(?:\\d{4}-\\d{2}-\\d{2}[T ]\\d{2}:\\d{2}:\\d{2}\\.{0,1}\\d*Z)?$",
"description": "last edition of report or trigger fields"
}
},
"required": [
"vendor_id",
"vendor_domain",
"vendor_name",
"customers",
"report",
"triaged",
"is_active_breach",
"edited_at"
]
},
{
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "description of the finding"
},
"finding_id": {
"pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
"description": "an uuid of an existing finding",
"type": "string"
},
"information": {
"type": "array",
"description": "Finding information of the finding",
"items": {
"type": "object",
"properties": {
"title": {
"type": "string",
"description": "Title of the field"
},
"value": {
"type": "string",
"description": "value of the field"
}
},
"required": [
"title",
"value"
]
}
},
"extra_information": {
"type": "array",
"description": "extra information fields with not empty value",
"items": {
"type": "object",
"properties": {
"title": {
"type": "string",
"description": "Title of the field"
},
"value": {
"type": "string",
"description": "value of the field"
}
},
"required": [
"title",
"value"
]
}
},
"first_observed_at": {
"format": "date-time",
"type": "string",
"pattern": "^\\d{4}-\\d{2}-\\d{2}[T ]\\d{2}:\\d{2}:\\d{2}\\.{0,1}[0-9]*Z$",
"description": "first observed date time"
},
"last_observed_at": {
"format": "date-time",
"type": "string",
"pattern": "^\\d{4}-\\d{2}-\\d{2}[T ]\\d{2}:\\d{2}:\\d{2}\\.{0,1}[0-9]*Z$",
"description": "last observed date time"
},
"issue_name": {
"type": "string",
"description": "Issue Name"
},
"issue_type": {
"type": "string",
"description": "Issue Type"
},
"category": {
"type": "string",
"description": "Max Finding category"
},
"max_severity": {
"type": "string",
"description": "Max severity"
},
"breach_risk": {
"type": "string",
"description": "Breach risk"
},
"threat_level": {
"type": "string",
"description": "Threat level"
},
"hostname": {
"type": "string",
"description": "Asset hostname"
},
"ip_address": {
"type": "string",
"description": "the asset IP address"
},
"product_name": {
"type": "string",
"description": "Product Name"
},
"product_version": {
"type": "string",
"description": "Product Version"
},
"port": {
"type": "number",
"description": "Port number"
},
"cve": {
"type": "object",
"description": "CVE information",
"properties": {
"id": {
"type": "string",
"description": "CVE ID"
},
"known_exploit": {
"type": "boolean",
"description": "true if it is known the CVE was exploited"
},
"last_modified_date": {
"format": "date-time",
"type": "string",
"pattern": "^\\d{4}-\\d{2}-\\d{2}[T ]\\d{2}:\\d{2}:\\d{2}\\.{0,1}[0-9]*Z$",
"description": "Last modified date"
},
"severity": {
"type": "string",
"description": "Nvd severity"
},
"score": {
"type": "number",
"description": "Nvd score"
},
"description": {
"type": "string",
"description": "CVE description"
}
},
"required": [
"id",
"known_exploit",
"last_modified_date",
"severity",
"score",
"description"
]
},
"malware": {
"type": "object",
"description": "Malware information",
"properties": {
"family": {
"type": "string",
"description": "Malware family"
},
"detection_method": {
"type": "string",
"description": "Malware Detection Methods"
}
},
"required": [
"family",
"detection_method"
]
},
"last_breach": {
"type": "object",
"description": "Last breach information",
"properties": {
"description": {
"type": "string",
"description": "Breach description"
},
"source_type": {
"type": "string",
"description": "Source type"
},
"news_source": {
"type": "string",
"description": "Source url (news)"
},
"source": {
"type": "string",
"description": "Source url (official)"
},
"published_at": {
"type": "string",
"format": "date",
"pattern": "^\\d{4}-\\d{2}-\\d{2}$",
"description": "Breach published date"
}
},
"required": [
"description",
"published_at"
]
}
},
"required": [
"max_severity",
"category",
"issue_type",
"issue_name",
"last_observed_at",
"first_observed_at",
"information",
"finding_id",
"description"
]
}
]
}
},
"size": {
"description": "The number of records to be returned per page",
"type": "integer"
},
"page": {
"description": "The page number to be returned",
"type": "integer"
},
"total": {
"description": "The total number of records matching the given query",
"type": "integer"
}
},
"required": [
"entries",
"size",
"page",
"total"
]
}Work with this as data
Every JSON Schema here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for schemas
4 MCP tools reach this
find_json_schemasBrowse and filter every JSON Schema in the catalog.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This JSON Schema
curl "https://apis.io/api/v1/json-schemas/security-scorecard-findings-list"
All schemas
curl "https://apis.io/api/v1/json-schemas?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.