Count SCA vulnerabilities
Return the exact number of SCA package vulnerabilities matching a filter set. This is a separate call from /vulnerabilities/search because counting visits every matching row and is substantially slower than fetching one page; request it only when you need the total.
Authorizations
Body
Filter by advisory identifier or alias (CVE, GHSA, etc.)
Filter by dependency/package names (contains match)
Filter by direct vs transitive dependencies. When omitted, counts both direct and transitive.
direct, transitive Filter by exploitability status. When omitted, defaults to all four: reachable, needs_review, unreachable, and not_tested.
reachable, needs_review, unreachable, not_tested Filter to vulnerabilities associated with applications exposed by Wiz
true Count only findings from this SCA scan, instead of the latest scan per repository. The scan must belong to a repository you can view.
Lifecycle filter. Defaults to 'all'. Pass 'open' to reproduce the number the posture endpoint reports as funnel.open.
all, open, closed Filter by severity bucket.
critical, high, medium, low, info Filter by the package-level reachability verdict.
reachable, notReachable, notTested Filter to compiled assets (true) or manifest-declared dependencies (false). Omit to count both.
Filter to findings with a non-empty recommended fix version — the same population the "fixable" posture numerator counts.
Include ephemeral repositories. Defaults to false.
Response
Successful response
Number of findings matching the filters.