Vulnerabilities & Risk API

Everything in this section is available over the REST API. API Reference covers authentication and conventions; Vulnerabilities API and Alerts API carry full request/response examples; Swagger at https://<your-host>/api/docs is exhaustive.

export OFFLOAD_HOST="https://your-instance.example.com"
export OFFLOAD_API_KEY="osk_xxxxxxxxxxxxxxxxxxxx"

Send the key as X-API-Key; calls are scoped to the key's team.

Findings and occurrences

Task	Endpoint	Notes
Grouped vulnerabilities (Raw findings)	GET /api/vulnerabilities/grouped?source=&status=&severity=&search=&sort_by=&sort_dir=&skip=&limit=	One row per vulnerability with affected-asset count, open/total, SLA and top assets.
Occurrences	GET /api/vulnerabilities/occurrences?status=&severity=&priority=&asset_id=&limit=&skip= · GET …/occurrences/{occurrence_id}	One row per vulnerability per asset (VPR, priority, SLA due).
Update / assign an occurrence	PUT …/occurrences/{id}/status (open · triaged · in_progress · resolved · verified · closed · false_positive · accepted_risk) · PUT …/occurrences/{id}/assign · POST …/occurrences/bulk-status · POST …/occurrences/bulk-assign
Unified findings	GET /api/vulnerabilities/findings · GET …/findings/{fingerprint} · POST …/findings/{fingerprint}/triage	The fingerprinted lake records the Triage Engine scores.
Per-asset view	GET /api/vulnerabilities/assets/{asset_id}	Every vulnerability on one asset.
Catalog and stats	GET /api/vulnerabilities/catalog · GET /api/vulnerabilities/stats	Dashboard numbers.
Sync	POST /api/vulnerabilities/sync?force_resync= · GET …/sync/status	Pull the latest from every module (Sync All Sources).
Jira	GET /api/vulnerabilities/jira/ticket-candidates · POST …/jira/create-tickets	Requires a Jira integration.

Triage

Task	Endpoint	Notes
Score	POST /api/triage/score	Runs the Triage Engine over open findings (also daily). Needs Manage Triage.
Summary	GET /api/triage/summary	Work items and findings by priority, action-now count, confidence, triage state.
Work items	GET /api/triage/work-items?priority=P1,P2&module=&severity=&status=&category=&scope_key=&kev=&internet_exposed=&environment=&min_age_days=&untriaged=&confidence=	priority=P1,P2 is the Action queue.
Findings queue	GET /api/triage/queue	Same filters, one row per finding.
Bulk decision	POST /api/triage/bulk	{ check_id / title, decision: confirm_tp | mark_fp | accept_risk | suppress | investigate | resolve | assign, scope_key?, fingerprints?, reason, expires_at, assignee, preview } — preview: true returns counts without writing.
Single finding	POST /api/triage/finding/{fingerprint}/decision · GET …/remediation · POST …/explain · POST / GET …/comment(s) · POST / GET …/evidence	Remediation is the curated recipe / fixed version / scanner guidance.
Exceptions and changes	GET /api/triage/exceptions?include_inactive= · GET /api/triage/changes?hours=24	Sticky work-item exceptions; what changed recently.

SLA

Task	Endpoint	Notes
Policies	GET · POST /api/sla/policies · GET · PUT · DELETE /api/sla/policies/{policy_id} · POST /api/sla/policies/defaults	Body: name, description, conditions {severity_min, severity_max, environments[], criticalities[]}, response_hours, resolution_days, priority, default_owner, escalation_rules[].
Breaches	GET /api/sla/breaches · POST /api/sla/check-breaches	The Breach Dashboard; run enforcement now (otherwise every 15 min).

Alerts

Task	Endpoint	Notes
List / summary	GET /api/alerts?severity=&source=&category=&status=&open_only=&search=&limit=&skip= · GET /api/alerts/summary
One alert	GET /api/alerts/{alert_id}	Includes the audit trail.
Act	POST /api/alerts/{id}/acknowledge · PUT /api/alerts/{id}/assign · PUT /api/alerts/{id}/status (new · acknowledged · investigating · escalated · resolved · false_positive · closed) · POST /api/alerts/{id}/comment
Bulk	POST /api/alerts/acknowledge-all · POST /api/alerts/bulk-action	Filter-scoped.

Risks

Task	Endpoint	Notes
Register	GET · POST /api/risk-management/risks · GET · PUT · DELETE …/risks/{risk_id} · GET …/risks/summary · GET …/risks/{id}/history · …/linkages · …/velocity · POST …/risks/bulk · POST …/risks/merge-duplicates	Business risk: likelihood 1–5 × impact 1–5; system risk: initial_magnitude / current_magnitude 0–100.
Import from findings	GET /api/risk-management/auto-import/preview?finding_type=all|vulnerability|cspm_finding&severity_threshold=critical|high|medium · POST …/auto-import/scan-findings	Already-linked findings are skipped.
Treatment plans	GET · POST …/treatment-plans · GET · PUT …/treatment-plans/{id} · actions POST …/{id}/actions · PUT …/{id}/actions/{action_id} · POST …/{id}/submit · /approve · /reject	Strategies mitigate · accept · transfer · avoid · share.
Approvals	GET …/workflows/pending · POST …/workflows/{workflow_id}/approve
Controls	GET · POST …/controls · POST …/controls/{control_id}/tests	Test: tester, test_type (design / operating / both), sample_size, exceptions_found, result.
Heat map & analytics	GET …/heat-map · GET …/dashboard · GET …/analytics/inherent-vs-residual · …/risk-trend · …/appetite-overlay
Appetite	GET · POST …/appetite · POST …/appetite/check	Statement with overall_appetite, overall_tolerance_score, category_appetites[], thresholds[].
KRIs	GET · POST …/kris · POST …/kris/{kri_id}/measurements · GET …/kris/dashboard	Thresholds green_max / amber_max / red_max (/ critical_max), direction.
Scenarios	GET · POST …/scenarios	risk_id, scenario_type, likelihood_adjustment, impact_adjustment, parameters[].
Reports	GET …/reports/executive-summary · GET …/reports/executive-pdf-data · GET …/reports/export
AI assistant	POST /api/risk-management/ai/{endpoint}	Auto-fill, KRI recommendations, scenario generation.

Permissions

Action	Permission key
Read vulnerabilities, occurrences, SLA policies and breaches	vulnerability_view
Update occurrence status / assignment, sync, Jira tickets, SLA policies	vulnerability_management
Read the triage queue and summary	view_triage
Score, record triage decisions, manage exceptions	manage_triage
Read alerts	view_alerts
Acknowledge, assign, comment · bulk actions and status changes	acknowledge_alerts · manage_alerts
Read risks, heat map, appetite, KRIs, scenarios, reports	view_risks
Create risks and import from findings · edit, treat, control, measure · approve and delete	create_risks · edit_risks · manage_risks

Team roles bundle these — see RBAC & team management, Authentication for key scopes and Conventions for pagination, error shapes and rate limits.