Skip to main content
GET
Get imported cluster stack security posture

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

cluster_id
string<uuid>
required
stack_name
string
required

Response

Successful response

The security summary of one stack of an imported cluster: CVEs, CISA-listed exploited vulnerabilities and bills of materials across every workload its add-ons and manifests deploy.

status
enum<string>
required

connected: the figures describe scanned workloads. stale: the newest report is older than the scanner's freshness window. no_reports: workloads were attributed but none carries a report or a bill of materials yet. unmatched: no member resolved to an object in the resource cache. unscanned: the scanner has never reported on this cluster. empty: the stack has no add-on or manifest members.

Available options:
connected,
stale,
no_reports,
unmatched,
unscanned,
empty
cluster_id
string<uuid>
required
stack_name
string
required
stack_resource_id
string<uuid>
required
scanner
object
required
intelligence
object
required
scope
SecurityStackSecurityScope · object
required

How much of the stack the read could attribute to running objects.

findings
SecurityStackSecurityFindings · object
required

The CVE posture across the stack's workloads: live, namespaced occurrences only.

known_exploited
object[]
required

Every actionable finding of the stack listed in the CISA KEV catalog, earliest remediation due date first (capped at 50; the findings list with known_exploited=true carries the rest).

top_actionable_findings
object[]
required

The actionable findings to fix first: CISA-listed, then by severity, then fixable ones (capped at 8).

sbom
SecurityStackSecuritySbom · object
required

The bill-of-materials picture of the stack; coverage is the cluster's opt-in state so an absent inventory can be read against it.

members
SecurityStackSecurityMember · object[]
required