> ## Documentation Index > Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt > Use this file to discover all available pages before exploring further. # List the security posture of every stack of an imported cluster > Every live stack of the cluster with its security posture - what the read could attribute, the CVE posture over the workloads the stack owns, the running containers with and without a bill of materials - plus the outside bucket: everything on the cluster no stack owns, so the rows add up to the cluster. Each stack is attributed exactly as its own security read attributes it. ## OpenAPI ````yaml https://platform.ankra.app/openapi.json get /org/clusters/imported/{cluster_id}/security/stacks openapi: 3.1.0 info: title: FastAPI version: 0.1.0 servers: - url: https://platform.ankra.app security: [] tags: - name: Clusters description: Create, inspect and manage clusters, and the stacks deployed on them. - name: Managed Clusters description: Provider-managed control planes, driven through one common surface. - name: Imported Clusters description: Clusters that already existed and were connected to Ankra. - name: Cluster Access description: Kubeconfigs, service-account tokens and per-cluster access grants. - name: Kubernetes description: Read and act on the Kubernetes objects inside a cluster. - name: DigitalOcean Clusters description: Provision and manage DigitalOcean Kubernetes clusters. - name: Hetzner Clusters description: Provision and manage Hetzner Kubernetes clusters. - name: OVH Clusters description: Provision and manage OVH Kubernetes clusters. - name: Scaleway Clusters description: Provision and manage Scaleway Kapsule clusters. - name: UpCloud Clusters description: Provision and manage UpCloud Kubernetes clusters. - name: Applications description: Deploy, configure and observe applications across the fleet. - name: Stack Profiles description: Reusable stack definitions, their versions and sharing. - name: Charts description: Browse the chart catalogue behind stacks and addons. - name: Helm description: Helm registries, credentials and the charts they expose. - name: Executions description: Long-running platform executions and their jobs. - name: Operations description: Cancel in-flight cluster operations and their jobs. - name: Chat description: Conversational sessions, plans and confirmable actions. - name: AI Agent Runs description: Autonomous agent runs and their outcomes. - name: AI Tickets description: The AI ticket board, its sync connections and settings. - name: AI Playbooks description: Reusable playbooks the AI lanes execute. - name: AI Conditions description: Conditions that gate AI autonomy. - name: AI Engineering Handoffs description: Work the AI lanes escalate to a human engineer. - name: AI Environment description: The environment and base stacks AI demos deploy into. - name: Security description: Findings, advisories, SBOMs, compliance and posture. - name: Cost description: Cluster and fleet cost, rate cards and cost settings. - name: Billing description: Subscription and spend caps. - name: Organisation description: Members, invitations, audit logs and organisation settings. - name: Account Tokens description: Personal access tokens for the API and CLI. - name: Credentials description: The shared credential store. - name: Azure Credentials description: Azure credentials and SSH keys. - name: DigitalOcean Credentials description: DigitalOcean credentials and SSH keys. - name: Hetzner Credentials description: Hetzner credentials and SSH keys. - name: OVH Credentials description: OVH credentials and SSH keys. - name: Scaleway Credentials description: Scaleway credentials. - name: UpCloud Credentials description: UpCloud credentials and SSH keys. - name: Data Source Credentials description: Credentials for metrics and log sources. - name: DNS Credentials description: Credentials for DNS providers. - name: DNS description: DNS zones and records, including custom organisation zones. - name: Cloudflare description: Cloudflare domains and the credentials behind them. - name: Variables description: Organisation- and cluster-scoped variables. - name: SOPS description: Encrypt and decrypt values with the organisation SOPS config. - name: Alerts description: Alert integrations and ingest credentials. - name: Notifications description: Notification routes and their delivery targets. - name: Support description: Support tickets. paths: /org/clusters/imported/{cluster_id}/security/stacks: get: tags: - Security summary: List the security posture of every stack of an imported cluster description: >- Every live stack of the cluster with its security posture - what the read could attribute, the CVE posture over the workloads the stack owns, the running containers with and without a bill of materials - plus the outside bucket: everything on the cluster no stack owns, so the rows add up to the cluster. Each stack is attributed exactly as its own security read attributes it. operationId: list_imported_cluster_security_stacks parameters: - in: path name: cluster_id required: true schema: format: uuid type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/SecurityClusterStackSecurityListResponse' description: Successful response '400': content: application/json: schema: $ref: '#/components/schemas/SecurityDetailError' description: Business validation error '403': content: application/json: schema: $ref: '#/components/schemas/SecurityPermissionDenied' description: Permission denied '404': content: application/json: schema: $ref: '#/components/schemas/SecurityDetailError' description: Cluster is not in the active organization '422': content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' description: Request validation error '500': content: application/json: schema: $ref: '#/components/schemas/SecurityDetailError' description: Internal server error components: schemas: SecurityClusterStackSecurityListResponse: properties: cluster_id: format: uuid type: string scanner: $ref: '#/components/schemas/SecurityScannerSummary' intelligence: $ref: '#/components/schemas/SecurityIntelligenceStatus' coverage: $ref: '#/components/schemas/SecuritySbomCoverage' stacks: items: $ref: '#/components/schemas/SecurityClusterStackSecuritySummary' type: array outside: $ref: '#/components/schemas/SecurityClusterStackSecurityOutside' required: - cluster_id - scanner - intelligence - coverage - stacks - outside title: SecurityClusterStackSecurityListResponse type: object SecurityDetailError: properties: detail: type: string required: - detail type: object SecurityPermissionDenied: properties: detail: enum: - permission_denied type: string permission: type: string scope_type: type: string required: - detail - permission - scope_type type: object HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' title: Detail type: array title: HTTPValidationError type: object SecurityScannerSummary: properties: fresh_clusters: type: integer last_scan: anyOf: - format: date-time type: string - type: 'null' stale_after_seconds: type: integer stale_clusters: type: integer status: enum: - fresh - degraded - stale - unscanned type: string unscanned_clusters: type: integer required: - status - last_scan - fresh_clusters - stale_clusters - unscanned_clusters - stale_after_seconds type: object SecurityIntelligenceStatus: properties: epss_synced_at: anyOf: - format: date-time type: string - type: 'null' kev_listed: type: integer kev_synced_at: anyOf: - format: date-time type: string - type: 'null' required: - kev_synced_at - epss_synced_at - kev_listed type: object SecuritySbomCoverage: properties: scanned_clusters: type: integer clusters_with_sbom: description: >- Below scanned_clusters means the remaining clusters have SBOM generation switched off, not that they run nothing. type: integer images: type: integer components: type: integer workloads: type: integer latest_generated_at: anyOf: - format: date-time type: string - type: 'null' required: - scanned_clusters - clusters_with_sbom - images - components - workloads - latest_generated_at title: SecuritySbomCoverage type: object SecurityClusterStackSecuritySummary: properties: stack_name: type: string stack_resource_id: format: uuid type: string status: enum: - connected - stale - no_reports - unmatched - unscanned - empty type: string scope: $ref: '#/components/schemas/SecurityStackSecurityScope' findings: $ref: '#/components/schemas/SecurityStackSecurityFindings' containers: type: integer containers_with_sbom: type: integer containers_without_sbom: type: integer pods: type: integer sbom_images: type: integer sbom_components: type: integer required: - stack_name - stack_resource_id - status - scope - findings - containers - containers_with_sbom - containers_without_sbom - pods - sbom_images - sbom_components title: SecurityClusterStackSecuritySummary type: object SecurityClusterStackSecurityOutside: properties: workloads: type: integer observed: $ref: '#/components/schemas/SecuritySeverityCounts' actionable: $ref: '#/components/schemas/SecuritySeverityCounts' fixable_severe: type: integer known_exploited: type: integer containers: type: integer containers_with_sbom: type: integer containers_without_sbom: type: integer pods: type: integer last_scan: anyOf: - format: date-time type: string - type: 'null' required: - workloads - observed - actionable - fixable_severe - known_exploited - containers - containers_with_sbom - containers_without_sbom - pods - last_scan title: SecurityClusterStackSecurityOutside type: object ValidationError: properties: loc: items: anyOf: - type: string - type: integer title: Location type: array msg: title: Message type: string type: title: Error Type type: string required: - loc - msg - type title: ValidationError type: object SecurityStackSecurityScope: properties: addons: type: integer description: Add-on members of the stack. manifests: type: integer description: Manifest members of the stack. declared_objects: type: integer description: Kubernetes objects the manifest members declare (kind + name). matched_workloads: type: integer description: >- Distinct workload objects in the cluster's resource cache attributed to the stack, owners walked two levels down. Zero means nothing could be attributed, not that nothing runs. unmatched_members: type: integer description: Members that resolved to no cached workload object. required: - addons - manifests - declared_objects - matched_workloads - unmatched_members title: SecurityStackSecurityScope type: object description: How much of the stack the read could attribute to running objects. SecurityStackSecurityFindings: properties: observed: $ref: '#/components/schemas/SecuritySeverityCounts' actionable: $ref: '#/components/schemas/SecuritySeverityCounts' acknowledged: $ref: '#/components/schemas/SecuritySeverityCounts' accepted_risk: $ref: '#/components/schemas/SecuritySeverityCounts' findings: type: integer description: Distinct CVE-package findings behind the occurrences. fixable_severe: type: integer description: Actionable critical and high occurrences with a fixed version. known_exploited: type: integer description: >- Actionable occurrences on a CISA Known Exploited Vulnerabilities entry. known_exploited_findings: type: integer description: Distinct findings behind known_exploited. affected_images: type: integer affected_workloads: type: integer last_scan: anyOf: - format: date-time type: string - type: 'null' required: - observed - actionable - acknowledged - accepted_risk - findings - fixable_severe - known_exploited - known_exploited_findings - affected_images - affected_workloads - last_scan title: SecurityStackSecurityFindings type: object description: >- The CVE posture across the stack's workloads: live, namespaced occurrences only. SecuritySeverityCounts: properties: critical: type: integer high: type: integer low: type: integer medium: type: integer unknown: type: integer required: - critical - high - medium - low - unknown type: object ````