Skip to main content
POST
Count SCA vulnerabilities

Authorizations

X-ZeroPath-API-Token-Id
string
header
required
X-ZeroPath-API-Token-Secret
string
header
required

Body

application/json
organizationId
string
required
repositoryIds
string[]
searchQuery
string
ecosystems
string[]
advisoryQuery
string

Filter by advisory identifier or alias (CVE, GHSA, etc.)

dependencyNames
string[]

Filter by dependency/package names (contains match)

transitivity
enum<string>

Filter by direct vs transitive dependencies. When omitted, counts both direct and transitive.

Available options:
direct,
transitive
reachability
enum<string>[]

Filter by exploitability status. When omitted, defaults to all four: reachable, needs_review, unreachable, and not_tested.

Available options:
reachable,
needs_review,
unreachable,
not_tested
hasWizExposure
enum<boolean>

Filter to vulnerabilities associated with applications exposed by Wiz

Available options:
true
scanId
string

Count only findings from this SCA scan, instead of the latest scan per repository. The scan must belong to a repository you can view.

status
enum<string>

Lifecycle filter. Defaults to 'all'. Pass 'open' to reproduce the number the posture endpoint reports as funnel.open.

Available options:
all,
open,
closed
severities
enum<string>[]

Filter by severity bucket.

Available options:
critical,
high,
medium,
low,
info
packageReachability
enum<string>[]

Filter by the package-level reachability verdict.

Available options:
reachable,
notReachable,
notTested
isCompiled
boolean

Filter to compiled assets (true) or manifest-declared dependencies (false). Omit to count both.

hasFix
boolean

Filter to findings with a non-empty recommended fix version — the same population the "fixable" posture numerator counts.

includeEphemeral
boolean

Include ephemeral repositories. Defaults to false.

Response

Successful response

totalCount
integer
required

Number of findings matching the filters.