DocumentationAPI Reference
Vulnerability findings

List vulnerability findings

POST
/workspaces/{workspaceId}/firmware-versions/{firmwareVersionId}/vulnerability-findings/list

Authorization

API key Vulnerabilities: read
AuthorizationBearer <token>

API key (sf_...) with any of the required scopes. Generate it in the Spotflow portal on the settings page.

In: header

Scope: Vulnerabilities: read

Path Parameters

workspaceId*string
Formatuuid
firmwareVersionId*string

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

sortColumn?null||
ascending?null|boolean
limit?||
Match^-?(?:0|[1-9]\d*)$
Formatint32
cursor?null|string
filter?null|

Response Body

application/json

application/problem+json

application/problem+json

curl -X POST "https://example.com/workspaces/00000000-0000-0000-0000-000000000001/firmware-versions/r2Kt75mXc8Vd/vulnerability-findings/list" \  -H "Content-Type: application/json" \  -d '{    "sortColumn": "Severity",    "ascending": false,    "limit": 50,    "filter": {      "severities": [        "Critical",        "High"      ],      "assessments": [        "NotAssessed",        "InTriage"      ],      "ignored": false,      "knownCisaExploit": false,      "name": [        {          "contains": "mbedtls"        }      ],      "components": [        {          "vendor": "ARM",          "packageName": "mbedtls",          "version": "3.5.2"        }      ]    }  }'

Page of vulnerability findings of the firmware version.

{  "findings": [    {      "id": "b8Qr47xVm1Zj",      "cveId": "CVE-2025-12345",      "name": "CVE-2025-12345",      "componentName": "mbedtls",      "componentVersion": "3.5.2",      "severity": "Critical",      "assessment": "InTriage",      "ignored": false,      "isKnownCisaExploit": false,      "detectedAt": "2026-01-10T15:38:00+00:00"    }  ],  "hasMore": false}