> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# List the vulnerabilities on one image

> List the vulnerabilities (CVEs) named on one image: one row per CVE and installed package version, aggregated across every workload container running the image, with the fixed version when one exists, the CISA KEV / EPSS intelligence, how the occurrences are dispositioned and where it runs. The summary totals the image's active occurrences before search and severity narrow the rows. Answers for an image with or without a bill of materials (image.sbom_status); an image the platform has never seen is not found.



## OpenAPI

````yaml https://platform.ankra.app/openapi.json get /api/v1/org/security/sbom/image/findings
openapi: 3.1.0
info:
  title: FastAPI
  version: 0.1.0
servers:
  - url: https://platform.ankra.app
security: []
paths:
  /api/v1/org/security/sbom/image/findings:
    get:
      tags:
        - security
      summary: List the vulnerabilities on one image
      description: >-
        List the vulnerabilities (CVEs) named on one image: one row per CVE and
        installed package version, aggregated across every workload container
        running the image, with the fixed version when one exists, the CISA KEV
        / EPSS intelligence, how the occurrences are dispositioned and where it
        runs. The summary totals the image's active occurrences before search
        and severity narrow the rows. Answers for an image with or without a
        bill of materials (image.sbom_status); an image the platform has never
        seen is not found.
      operationId: list_security_sbom_image_findings_api_v1
      parameters:
        - description: >-
            The image identity: its digest, or repository:tag when the scanner
            knew no digest.
          in: query
          name: image
          required: true
          schema:
            type: string
        - in: query
          name: page
          required: false
          schema:
            default: 1
            minimum: 1
            type: integer
        - in: query
          name: page_size
          required: false
          schema:
            default: 50
            maximum: 100
            minimum: 1
            type: integer
        - description: Match CVE id, package name or title.
          in: query
          name: search
          required: false
          schema:
            type: string
        - description: >-
            Only these severities (repeatable): critical, high, medium, low,
            unknown.
          in: query
          name: severity
          required: false
          schema:
            items:
              type: string
            type: array
        - description: >-
            exploitability (default), severity, epss, cve_id, package_name,
            last_seen_at, occurrences.
          in: query
          name: sort
          required: false
          schema:
            default: exploitability
            type: string
        - in: query
          name: order
          required: false
          schema:
            default: desc
            enum:
              - asc
              - desc
            type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecuritySbomImageFindingListResponse'
          description: Successful Response
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityDetailError'
          description: Business validation error
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityPermissionDenied'
          description: Permission denied
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityDetailError'
          description: Organization-scoped resource not found
components:
  schemas:
    SecuritySbomImageFindingListResponse:
      properties:
        image:
          $ref: '#/components/schemas/SecuritySbomImageFindingImage'
        result:
          items:
            $ref: '#/components/schemas/SecuritySbomImageFinding'
          type: array
        pagination:
          $ref: '#/components/schemas/SecurityPagination'
        summary:
          $ref: '#/components/schemas/SecuritySbomImageFindingSummary'
        intelligence:
          $ref: '#/components/schemas/SecurityIntelligenceStatus'
      required:
        - image
        - result
        - pagination
        - summary
        - intelligence
      title: SecuritySbomImageFindingListResponse
      type: object
    SecurityDetailError:
      properties:
        detail:
          type: string
      required:
        - detail
      type: object
    SecurityPermissionDenied:
      properties:
        detail:
          enum:
            - permission_denied
          type: string
        permission:
          type: string
        scope_type:
          type: string
      required:
        - detail
        - permission
        - scope_type
      type: object
    SecuritySbomImageFindingImage:
      properties:
        image_identity:
          type: string
        image_ref:
          type: string
        image_digest:
          anyOf:
            - type: string
            - type: 'null'
        sbom_status:
          description: >-
            present when the platform holds a bill of materials for the image;
            absent when only the vulnerability scanner named it.
          enum:
            - present
            - absent
          type: string
      required:
        - image_identity
        - image_ref
        - image_digest
        - sbom_status
      title: SecuritySbomImageFindingImage
      type: object
    SecuritySbomImageFinding:
      properties:
        finding_id:
          format: uuid
          type: string
        cve_id:
          type: string
        severity:
          type: string
        title:
          anyOf:
            - type: string
            - type: 'null'
        package_type:
          type: string
        package_name:
          type: string
        installed_version:
          type: string
        fixed_version:
          anyOf:
            - type: string
            - type: 'null'
        fixable:
          type: boolean
        disposition:
          description: >-
            The worst disposition across the image's occurrences of this CVE:
            open before acknowledged before accepted_risk.
          enum:
            - open
            - acknowledged
            - accepted_risk
          type: string
        dispositions:
          $ref: '#/components/schemas/SecurityDispositionCounts'
        occurrences:
          type: integer
        workloads:
          type: integer
        clusters:
          type: integer
        last_seen_at:
          format: date-time
          type: string
        known_exploited:
          type: boolean
        kev_date_added:
          anyOf:
            - type: string
            - type: 'null'
        kev_due_date:
          anyOf:
            - type: string
            - type: 'null'
        kev_ransomware_use:
          type: boolean
        epss_score:
          anyOf:
            - format: double
              type: number
            - type: 'null'
        epss_percentile:
          anyOf:
            - format: double
              type: number
            - type: 'null'
        kev_vendor_project:
          anyOf:
            - type: string
            - type: 'null'
        kev_product:
          anyOf:
            - type: string
            - type: 'null'
        kev_vulnerability_name:
          anyOf:
            - type: string
            - type: 'null'
        kev_required_action:
          anyOf:
            - type: string
            - type: 'null'
      required:
        - finding_id
        - cve_id
        - severity
        - title
        - package_type
        - package_name
        - installed_version
        - fixed_version
        - fixable
        - disposition
        - dispositions
        - occurrences
        - workloads
        - clusters
        - last_seen_at
        - known_exploited
        - kev_date_added
        - kev_due_date
        - kev_ransomware_use
        - epss_score
        - epss_percentile
        - kev_vendor_project
        - kev_product
        - kev_vulnerability_name
        - kev_required_action
      title: SecuritySbomImageFinding
      type: object
    SecurityPagination:
      properties:
        page:
          type: integer
        page_size:
          type: integer
        total_count:
          type: integer
        total_pages:
          type: integer
      required:
        - page
        - page_size
        - total_pages
        - total_count
      type: object
    SecuritySbomImageFindingSummary:
      properties:
        observed:
          type: integer
        actionable:
          $ref: '#/components/schemas/SecuritySeverityCounts'
        actionable_total:
          type: integer
        accepted_risk:
          type: integer
        fixable:
          type: integer
        known_exploited:
          type: integer
        findings:
          description: Distinct CVE and installed-version pairs on the image.
          type: integer
      required:
        - observed
        - actionable
        - actionable_total
        - accepted_risk
        - fixable
        - known_exploited
        - findings
      title: SecuritySbomImageFindingSummary
      type: object
    SecurityIntelligenceStatus:
      properties:
        epss_synced_at:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
        kev_listed:
          type: integer
        kev_synced_at:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
      required:
        - kev_synced_at
        - epss_synced_at
        - kev_listed
      type: object
    SecurityDispositionCounts:
      properties:
        accepted_risk:
          type: integer
        acknowledged:
          type: integer
        open:
          type: integer
        resolved:
          type: integer
      required:
        - open
        - acknowledged
        - accepted_risk
        - resolved
      type: object
    SecuritySeverityCounts:
      properties:
        critical:
          type: integer
        high:
          type: integer
        low:
          type: integer
        medium:
          type: integer
        unknown:
          type: integer
      required:
        - critical
        - high
        - medium
        - low
        - unknown
      type: object

````