Depot vulnerabilities

Registers the exposure routes on mux.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

GET /api/v1/discovery/devices/{publicId}/vulnerabilities

GETvuln:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

List device vulnerabilities

Parameters

Name	In	Type	Required	Description
publicId	path	string	Yes	A uuid.
page	query	integer	No	One-based page number. Defaults to 1.
pageSize	query	integer	No	Rows per page, 1 to 200. Defaults to 50.

Responses

Status	Body	Description
200	application/json, PagedResultDeviceVulnerability	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold vuln:read.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
itemsrequired	array of DeviceVulnerability
items[].cveIdrequired	string
items[].cvssScorerequired	number	double.
items[].cvssSeverityrequired	string
items[].exploitKnownrequired	boolean
items[].firstSeenAtrequired	string (date-time)
items[].lastSeenAtrequired	string (date-time)
items[].matchedCperequired	string
items[].resolvedAt	string (date-time) or null
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/discovery/devices/<publicId>/vulnerabilities?page=0&pageSize=0' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/discovery/devices/<publicId>/vulnerabilities?page=0&pageSize=0' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/discovery/devices/<publicId>/vulnerabilities"
params = {
    "page": "0",
    "pageSize": "0",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/discovery/devices/<publicId>/vulnerabilities?page=0&pageSize=0", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/discovery/devices/<publicId>/vulnerabilities");
url.searchParams.set("page", "0");
url.searchParams.set("pageSize", "0");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/discovery/devices/<publicId>/vulnerabilities?page=0&pageSize=0");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/endpoints/{agentID}/vulnerabilities

GETvuln:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

listEndpointVulnerabilities is the machine’s own tab.

Always flat: on one endpoint the roll-up would be one row per CVE with a count of one.

Parameters

Name	In	Type	Required	Description
agentID	path	string	Yes	A uuid.
agentId	query	string	No
cveId	query	string	No
dir	query	string, one of asc, desc	No	Sort direction.
exploitKnown	query	string	No
includeUnverified	query	string	No
minCvss	query	string	No
page	query	integer	No	One-based page number. Defaults to 1.
pageSize	query	integer	No	Rows per page, 1 to 200. Defaults to 50.
q	query	string	No	Free-text search term.
severity	query	string	No
sort	query	string, one of cve, firstSeen, lastSeen, risk, severity	No	Sort key.
state	query	string	No

Responses

Status	Body	Description
200	application/json, VulnerabilityPageEndpointVulnerabilityView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold vuln:read.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
countsrequired	VulnerabilityCounts
counts.criticalrequired	integer
counts.highrequired	integer
counts.noFixrequired	integer
counts.unverifiedrequired	integer
itemsrequired	array of EndpointVulnerabilityView
items[].advisoryId	string
items[].advisorySource	string
items[].agentIdrequired	string
items[].cveIdrequired	string
items[].cvssScorerequired	number	double.
items[].cvssSeverityrequired	string
items[].ecosystem	string
items[].exploitKnownrequired	boolean
items[].firstSeenrequired	string (date-time)
items[].fixedVersion	string
items[].hostnamerequired	string
items[].lastSeenrequired	string (date-time)
items[].matchSourcerequired	string, one of curated, distro, fuzzy, nvd_unverified
items[].publicIdrequired	string
items[].softwareNamerequired	string
items[].softwareVersionrequired	string
items[].staterequired	string
items[].suppressedBy	string
items[].suppressedReason	string
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/endpoints/<agentID>/vulnerabilities?agentId=<agentId>&cveId=<cveId>&dir=asc&exploitKnown=<exploitKnown>&includeUnverified=<includeUnverified>&minCvss=<minCvss>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/endpoints/<agentID>/vulnerabilities?agentId=<agentId>&cveId=<cveId>&dir=asc&exploitKnown=<exploitKnown>&includeUnverified=<includeUnverified>&minCvss=<minCvss>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/endpoints/<agentID>/vulnerabilities"
params = {
    "agentId": "<agentId>",
    "cveId": "<cveId>",
    "dir": "asc",
    "exploitKnown": "<exploitKnown>",
    "includeUnverified": "<includeUnverified>",
    "minCvss": "<minCvss>",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/endpoints/<agentID>/vulnerabilities?agentId=<agentId>&cveId=<cveId>&dir=asc&exploitKnown=<exploitKnown>&includeUnverified=<includeUnverified>&minCvss=<minCvss>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/endpoints/<agentID>/vulnerabilities");
url.searchParams.set("agentId", "<agentId>");
url.searchParams.set("cveId", "<cveId>");
url.searchParams.set("dir", "asc");
url.searchParams.set("exploitKnown", "<exploitKnown>");
url.searchParams.set("includeUnverified", "<includeUnverified>");
url.searchParams.set("minCvss", "<minCvss>");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/endpoints/<agentID>/vulnerabilities?agentId=<agentId>&cveId=<cveId>&dir=asc&exploitKnown=<exploitKnown>&includeUnverified=<includeUnverified>&minCvss=<minCvss>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/reports/vulnerabilities

GETvuln:readtenant facehosteditmspremoteIdempotentdownload

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

getVulnerabilityReport answers the same table rolled up by CVE, which is what a vulnerability report is for: what is wrong across the fleet and how widely.

?format=csv and ?format=pdf render the same rows as a download, per the contracts document. A spreadsheet is where a remediation plan actually gets written, a PDF is what it gets circulated as, and the alternative to both is somebody copying CVE ids off a screen.

Parameters

Name	In	Type	Required	Description
agentId	query	string	No
cveId	query	string	No
dir	query	string, one of asc, desc	No	Sort direction.
exploitKnown	query	string	No
format	query	string	No
includeUnverified	query	string	No
minCvss	query	string	No
q	query	string	No	Free-text search term.
severity	query	string	No
sort	query	string, one of cve, firstSeen, lastSeen, risk, severity	No	Sort key.
state	query	string	No

Responses

Status	Body	Description
200	application/octet-stream, string (binary)	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold vuln:read.
500	application/problem+json, ProblemDetails	No client store in request context.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/reports/vulnerabilities?agentId=<agentId>&cveId=<cveId>&dir=asc&exploitKnown=<exploitKnown>&format=<format>&includeUnverified=<includeUnverified>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/reports/vulnerabilities?agentId=<agentId>&cveId=<cveId>&dir=asc&exploitKnown=<exploitKnown>&format=<format>&includeUnverified=<includeUnverified>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/reports/vulnerabilities"
params = {
    "agentId": "<agentId>",
    "cveId": "<cveId>",
    "dir": "asc",
    "exploitKnown": "<exploitKnown>",
    "format": "<format>",
    "includeUnverified": "<includeUnverified>",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/reports/vulnerabilities?agentId=<agentId>&cveId=<cveId>&dir=asc&exploitKnown=<exploitKnown>&format=<format>&includeUnverified=<includeUnverified>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/reports/vulnerabilities");
url.searchParams.set("agentId", "<agentId>");
url.searchParams.set("cveId", "<cveId>");
url.searchParams.set("dir", "asc");
url.searchParams.set("exploitKnown", "<exploitKnown>");
url.searchParams.set("format", "<format>");
url.searchParams.set("includeUnverified", "<includeUnverified>");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/reports/vulnerabilities?agentId=<agentId>&cveId=<cveId>&dir=asc&exploitKnown=<exploitKnown>&format=<format>&includeUnverified=<includeUnverified>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/vulnerabilities

GETvuln:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

List vulnerabilities

Parameters

Name	In	Type	Required	Description
agentId	query	string	No
cveId	query	string	No
dir	query	string, one of asc, desc	No	Sort direction.
exploitKnown	query	string	No
groupBy	query	string	No
includeUnverified	query	string	No
minCvss	query	string	No
page	query	integer	No	One-based page number. Defaults to 1.
pageSize	query	integer	No	Rows per page, 1 to 200. Defaults to 50.
q	query	string	No	Free-text search term.
severity	query	string	No
sort	query	string, one of cve, firstSeen, lastSeen, risk, severity	No	Sort key.
state	query	string	No

Responses

Status	Body	Description
200	application/json, VulnerabilityPageVulnerabilitySummaryView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold vuln:read.
500	application/problem+json, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
countsrequired	VulnerabilityCounts
counts.criticalrequired	integer
counts.highrequired	integer
counts.noFixrequired	integer
counts.unverifiedrequired	integer
itemsrequired	array of VulnerabilitySummaryView
items[].advisoriesrequired	array of VulnerabilityAdvisory
items[].advisories[].advisoryId	string
items[].advisories[].advisorySource	string
items[].advisories[].ecosystem	string
items[].cveIdrequired	string
items[].cvssScorerequired	number	double.
items[].cvssSeverityrequired	string
items[].endpointCountrequired	integer
items[].exploitKnownrequired	boolean
items[].firstSeenrequired	string (date-time)
items[].lastSeenrequired	string (date-time)
items[].noFixCountrequired	integer
items[].softwareNamesrequired	array of string
items[].unverifiedCountrequired	integer
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/vulnerabilities?agentId=<agentId>&cveId=<cveId>&dir=asc&exploitKnown=<exploitKnown>&groupBy=<groupBy>&includeUnverified=<includeUnverified>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/vulnerabilities?agentId=<agentId>&cveId=<cveId>&dir=asc&exploitKnown=<exploitKnown>&groupBy=<groupBy>&includeUnverified=<includeUnverified>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/vulnerabilities"
params = {
    "agentId": "<agentId>",
    "cveId": "<cveId>",
    "dir": "asc",
    "exploitKnown": "<exploitKnown>",
    "groupBy": "<groupBy>",
    "includeUnverified": "<includeUnverified>",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/vulnerabilities?agentId=<agentId>&cveId=<cveId>&dir=asc&exploitKnown=<exploitKnown>&groupBy=<groupBy>&includeUnverified=<includeUnverified>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/vulnerabilities");
url.searchParams.set("agentId", "<agentId>");
url.searchParams.set("cveId", "<cveId>");
url.searchParams.set("dir", "asc");
url.searchParams.set("exploitKnown", "<exploitKnown>");
url.searchParams.set("groupBy", "<groupBy>");
url.searchParams.set("includeUnverified", "<includeUnverified>");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/vulnerabilities?agentId=<agentId>&cveId=<cveId>&dir=asc&exploitKnown=<exploitKnown>&groupBy=<groupBy>&includeUnverified=<includeUnverified>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/vulnerabilities/{vulnId}/suppress

POSTalert:managetenant facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

suppressVulnerability records an accepted risk.

Under “alert:manage” rather than a vuln code, per the contracts document. IDEMPOTENT in the store, which preserves the ORIGINAL decider and reason: a retried POST from a flaky connection must not rewrite who accepted the risk.

Parameters

Name	In	Type	Required	Description
vulnId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
reasonrequired	string

Responses

Status	Body	Description
200	application/json, EndpointVulnerabilityView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	Only a signed-in user can accept a vulnerability risk.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
advisoryId	string
advisorySource	string
agentIdrequired	string
cveIdrequired	string
cvssScorerequired	number	double.
cvssSeverityrequired	string
ecosystem	string
exploitKnownrequired	boolean
firstSeenrequired	string (date-time)
fixedVersion	string
hostnamerequired	string
lastSeenrequired	string (date-time)
matchSourcerequired	string, one of curated, distro, fuzzy, nvd_unverified
publicIdrequired	string
softwareNamerequired	string
softwareVersionrequired	string
staterequired	string
suppressedBy	string
suppressedReason	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/vulnerabilities/<vulnId>/suppress' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "reason": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "reason": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/vulnerabilities/<vulnId>/suppress' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/vulnerabilities/<vulnId>/suppress"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "reason": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "reason": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/vulnerabilities/<vulnId>/suppress", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/vulnerabilities/<vulnId>/suppress";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "reason": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "reason": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/vulnerabilities/<vulnId>/suppress");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/vulnerabilities/sync-state

GETvuln:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

getNvdSyncState answers the mirror’s status, which the console reads to decide whether to show the “no API key” setup notice.

It is CONTROL-PLANE data on a per-client route, which is the one thing to notice here: there is one mirror per Depot, so every client’s console reads the same row. That is correct - a client’s exposure list is only as fresh as the Depot’s mirror - and it is why the response carries no client-specific numbers.

Responses

Status	Body	Description
200	application/json, NvdSyncStateView	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold vuln:read.
500	application/problem+json, ProblemDetails	No control store.

200 response body

Field	Type	Description
configuredrequired	boolean
cveCountrequired	integer	int64.
lastSyncedAt	string (date-time) or null
statusrequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/vulnerabilities/sync-state' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/vulnerabilities/sync-state' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/vulnerabilities/sync-state"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/vulnerabilities/sync-state", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/vulnerabilities/sync-state";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/vulnerabilities/sync-state");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());