> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Get imported cluster stack security posture



## OpenAPI

````yaml https://platform.ankra.app/openapi.json get /org/clusters/imported/{cluster_id}/stacks/{stack_name}/security
openapi: 3.1.0
info:
  title: FastAPI
  version: 0.1.0
servers:
  - url: https://platform.ankra.app
security: []
paths:
  /org/clusters/imported/{cluster_id}/stacks/{stack_name}/security:
    get:
      tags:
        - Security
      summary: Get imported cluster stack security posture
      operationId: get_imported_cluster_stack_security
      parameters:
        - in: path
          name: cluster_id
          required: true
          schema:
            format: uuid
            type: string
        - in: path
          name: stack_name
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityStackSecurityResponse'
          description: Successful response
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityDetailError'
          description: Business validation error
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityPermissionDenied'
          description: Permission denied
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityDetailError'
          description: Cluster or stack is not in the active organization
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
          description: Request validation error
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityDetailError'
          description: Internal server error
components:
  schemas:
    SecurityStackSecurityResponse:
      properties:
        status:
          description: >-
            connected: the figures describe scanned workloads. stale: the newest
            report is older than the scanner's freshness window. no_reports:
            workloads were attributed but none carries a report or a bill of
            materials yet. unmatched: no member resolved to an object in the
            resource cache. unscanned: the scanner has never reported on this
            cluster. empty: the stack has no add-on or manifest members.
          enum:
            - connected
            - stale
            - no_reports
            - unmatched
            - unscanned
            - empty
          type: string
        cluster_id:
          format: uuid
          type: string
        stack_name:
          type: string
        stack_resource_id:
          format: uuid
          type: string
        scanner:
          $ref: '#/components/schemas/SecurityScannerSummary'
        intelligence:
          $ref: '#/components/schemas/SecurityIntelligenceStatus'
        scope:
          $ref: '#/components/schemas/SecurityStackSecurityScope'
        findings:
          $ref: '#/components/schemas/SecurityStackSecurityFindings'
        known_exploited:
          description: >-
            Every actionable finding of the stack listed in the CISA KEV
            catalog, earliest remediation due date first (capped at 50; the
            findings list with known_exploited=true carries the rest).
          items:
            $ref: '#/components/schemas/SecurityRemediationCandidate'
          type: array
        top_actionable_findings:
          description: >-
            The actionable findings to fix first: CISA-listed, then by severity,
            then fixable ones (capped at 8).
          items:
            $ref: '#/components/schemas/SecurityRemediationCandidate'
          type: array
        sbom:
          $ref: '#/components/schemas/SecurityStackSecuritySbom'
        members:
          items:
            $ref: '#/components/schemas/SecurityStackSecurityMember'
          type: array
      required:
        - status
        - cluster_id
        - stack_name
        - stack_resource_id
        - scanner
        - intelligence
        - scope
        - findings
        - known_exploited
        - top_actionable_findings
        - sbom
        - members
      title: SecurityStackSecurityResponse
      type: object
      description: >-
        The security summary of one stack of an imported cluster: CVEs,
        CISA-listed exploited vulnerabilities and bills of materials across
        every workload its add-ons and manifests deploy.
    SecurityDetailError:
      properties:
        detail:
          type: string
      required:
        - detail
      type: object
    SecurityPermissionDenied:
      properties:
        detail:
          enum:
            - permission_denied
          type: string
        permission:
          type: string
        scope_type:
          type: string
      required:
        - detail
        - permission
        - scope_type
      type: object
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          title: Detail
          type: array
      title: HTTPValidationError
      type: object
    SecurityScannerSummary:
      properties:
        fresh_clusters:
          type: integer
        last_scan:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
        stale_after_seconds:
          type: integer
        stale_clusters:
          type: integer
        status:
          enum:
            - fresh
            - degraded
            - stale
            - unscanned
          type: string
        unscanned_clusters:
          type: integer
      required:
        - status
        - last_scan
        - fresh_clusters
        - stale_clusters
        - unscanned_clusters
        - stale_after_seconds
      type: object
    SecurityIntelligenceStatus:
      properties:
        epss_synced_at:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
        kev_listed:
          type: integer
        kev_synced_at:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
      required:
        - kev_synced_at
        - epss_synced_at
        - kev_listed
      type: object
    SecurityStackSecurityScope:
      properties:
        addons:
          type: integer
          description: Add-on members of the stack.
        manifests:
          type: integer
          description: Manifest members of the stack.
        declared_objects:
          type: integer
          description: Kubernetes objects the manifest members declare (kind + name).
        matched_workloads:
          type: integer
          description: >-
            Distinct workload objects in the cluster's resource cache attributed
            to the stack, owners walked two levels down. Zero means nothing
            could be attributed, not that nothing runs.
        unmatched_members:
          type: integer
          description: Members that resolved to no cached workload object.
      required:
        - addons
        - manifests
        - declared_objects
        - matched_workloads
        - unmatched_members
      title: SecurityStackSecurityScope
      type: object
      description: How much of the stack the read could attribute to running objects.
    SecurityStackSecurityFindings:
      properties:
        observed:
          $ref: '#/components/schemas/SecuritySeverityCounts'
        actionable:
          $ref: '#/components/schemas/SecuritySeverityCounts'
        acknowledged:
          $ref: '#/components/schemas/SecuritySeverityCounts'
        accepted_risk:
          $ref: '#/components/schemas/SecuritySeverityCounts'
        findings:
          type: integer
          description: Distinct CVE-package findings behind the occurrences.
        fixable_severe:
          type: integer
          description: Actionable critical and high occurrences with a fixed version.
        known_exploited:
          type: integer
          description: >-
            Actionable occurrences on a CISA Known Exploited Vulnerabilities
            entry.
        known_exploited_findings:
          type: integer
          description: Distinct findings behind known_exploited.
        affected_images:
          type: integer
        affected_workloads:
          type: integer
        last_scan:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
      required:
        - observed
        - actionable
        - acknowledged
        - accepted_risk
        - findings
        - fixable_severe
        - known_exploited
        - known_exploited_findings
        - affected_images
        - affected_workloads
        - last_scan
      title: SecurityStackSecurityFindings
      type: object
      description: >-
        The CVE posture across the stack's workloads: live, namespaced
        occurrences only.
    SecurityRemediationCandidate:
      properties:
        actionable_count:
          type: integer
        affected_clusters:
          type: integer
        affected_workloads:
          type: integer
        cve_id:
          type: string
        finding_id:
          format: uuid
          type: string
        fixable_occurrences:
          type: integer
        last_seen_at:
          format: date-time
          type: string
        package_name:
          type: string
        package_type:
          type: string
        severity:
          type: string
        title:
          anyOf:
            - type: string
            - type: 'null'
        known_exploited:
          type: boolean
        kev_date_added:
          anyOf:
            - type: string
            - type: 'null'
        kev_due_date:
          anyOf:
            - type: string
            - type: 'null'
        kev_ransomware_use:
          type: boolean
        epss_score:
          anyOf:
            - format: double
              type: number
            - type: 'null'
        epss_percentile:
          anyOf:
            - format: double
              type: number
            - type: 'null'
        kev_vendor_project:
          anyOf:
            - type: string
            - type: 'null'
        kev_product:
          anyOf:
            - type: string
            - type: 'null'
        kev_vulnerability_name:
          anyOf:
            - type: string
            - type: 'null'
        kev_required_action:
          anyOf:
            - type: string
            - type: 'null'
      required:
        - finding_id
        - cve_id
        - package_type
        - package_name
        - severity
        - title
        - actionable_count
        - affected_clusters
        - affected_workloads
        - fixable_occurrences
        - last_seen_at
        - known_exploited
        - kev_date_added
        - kev_due_date
        - kev_ransomware_use
        - epss_score
        - epss_percentile
        - kev_vendor_project
        - kev_product
        - kev_vulnerability_name
        - kev_required_action
      type: object
    SecurityStackSecuritySbom:
      properties:
        containers:
          type: integer
          description: >-
            Running containers (init containers included) of pods the stack
            owns.
        containers_with_sbom:
          type: integer
        containers_without_sbom:
          type: integer
        pods:
          type: integer
        images:
          type: integer
          description: >-
            Distinct images with a stored bill of materials linked to a stack
            workload.
        components:
          type: integer
          description: Components across those images.
        workloads:
          type: integer
          description: Workloads carrying a bill-of-materials link.
        latest_generated_at:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
        coverage:
          $ref: '#/components/schemas/SecuritySbomCoverage'
      required:
        - containers
        - containers_with_sbom
        - containers_without_sbom
        - pods
        - images
        - components
        - workloads
        - latest_generated_at
        - coverage
      title: SecurityStackSecuritySbom
      type: object
      description: >-
        The bill-of-materials picture of the stack; coverage is the cluster's
        opt-in state so an absent inventory can be read against it.
    SecurityStackSecurityMember:
      properties:
        resource_id:
          format: uuid
          type: string
        kind:
          enum:
            - addon
            - manifest
          type: string
        name:
          type: string
        namespace:
          anyOf:
            - type: string
            - type: 'null'
        release_name:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The Helm release an add-on member is attributed by; null for a
            manifest.
        chart_name:
          anyOf:
            - type: string
            - type: 'null'
        declared_objects:
          type: integer
          description: Objects a manifest member declares; zero for an add-on.
        workloads:
          type: integer
          description: >-
            Cached workload objects attributed to the member. Zero means the
            member could not be attributed and its other figures are absent, not
            clean.
        observed:
          $ref: '#/components/schemas/SecuritySeverityCounts'
        actionable:
          $ref: '#/components/schemas/SecuritySeverityCounts'
        fixable_severe:
          type: integer
        known_exploited:
          type: integer
        affected_images:
          type: integer
        containers:
          type: integer
        containers_with_sbom:
          type: integer
        containers_without_sbom:
          type: integer
        sbom_images:
          type: integer
        sbom_components:
          type: integer
        last_scan:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
      required:
        - resource_id
        - kind
        - name
        - namespace
        - release_name
        - chart_name
        - declared_objects
        - workloads
        - observed
        - actionable
        - fixable_severe
        - known_exploited
        - affected_images
        - containers
        - containers_with_sbom
        - containers_without_sbom
        - sbom_images
        - sbom_components
        - last_scan
      title: SecurityStackSecurityMember
      type: object
      description: >-
        One add-on or manifest of the stack with the figures attributed to the
        objects it deploys. An object two members both own counts for each, so
        member rows need not sum to the stack total.
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          title: Location
          type: array
        msg:
          title: Message
          type: string
        type:
          title: Error Type
          type: string
      required:
        - loc
        - msg
        - type
      title: ValidationError
      type: object
    SecuritySeverityCounts:
      properties:
        critical:
          type: integer
        high:
          type: integer
        low:
          type: integer
        medium:
          type: integer
        unknown:
          type: integer
      required:
        - critical
        - high
        - medium
        - low
        - unknown
      type: object
    SecuritySbomCoverage:
      properties:
        scanned_clusters:
          type: integer
        clusters_with_sbom:
          description: >-
            Below scanned_clusters means the remaining clusters have SBOM
            generation switched off, not that they run nothing.
          type: integer
        images:
          type: integer
        components:
          type: integer
        workloads:
          type: integer
        latest_generated_at:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
      required:
        - scanned_clusters
        - clusters_with_sbom
        - images
        - components
        - workloads
        - latest_generated_at
      title: SecuritySbomCoverage
      type: object

````