> ## Documentation Index
> Fetch the complete documentation index at: https://zeropath.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Count SCA vulnerabilities

> Return the exact number of SCA package vulnerabilities matching a filter set. This is a separate call from /vulnerabilities/search because counting visits every matching row and is substantially slower than fetching one page; request it only when you need the total.



## OpenAPI

````yaml https://zeropath.com/openapi/v1.yaml post /api/v1/sca/vulnerabilities/count
openapi: 3.1.0
info:
  title: ZeroPath API
  version: 1.0.0
  description: Public API for ZeroPath
servers:
  - url: https://zeropath.com
    description: Production server
    x-fern-server-name: Production
  - url: https://dev.branch.zeropath.com
    description: Development server
    x-fern-server-name: Development
security:
  - apiTokenId: []
    apiTokenSecret: []
tags:
  - name: Organizations
    description: Operations related to organizations
  - name: Stats
    description: Operations related to stats
  - name: Repositories
    description: Operations related to repositories
  - name: Installations
    description: Operations related to installations
  - name: Issues
    description: Operations related to issues
  - name: SCA
    description: Software Composition Analysis
  - name: Scans
    description: Operations related to scans
  - name: Rules
    description: Operations related to custom security rules
  - name: Referrals
    description: Operations related to referrals
paths:
  /api/v1/sca/vulnerabilities/count:
    post:
      tags:
        - SCA
      summary: Count SCA vulnerabilities
      description: >-
        Return the exact number of SCA package vulnerabilities matching a filter
        set. This is a separate call from /vulnerabilities/search because
        counting visits every matching row and is substantially slower than
        fetching one page; request it only when you need the total.
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CountScaVulnerabilitiesInput'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScaVulnerabilityCountResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '408':
          description: The filter set is too large to count within the query time budget.
components:
  schemas:
    CountScaVulnerabilitiesInput:
      type: object
      properties:
        organizationId:
          type: string
        repositoryIds:
          type: array
          items:
            type: string
        searchQuery:
          type: string
        ecosystems:
          type: array
          items:
            type: string
        advisoryQuery:
          type: string
          description: Filter by advisory identifier or alias (CVE, GHSA, etc.)
        dependencyNames:
          type: array
          items:
            type: string
          description: Filter by dependency/package names (contains match)
        transitivity:
          type: string
          enum:
            - direct
            - transitive
          description: >-
            Filter by direct vs transitive dependencies. When omitted, counts
            both direct and transitive.
        reachability:
          type: array
          items:
            type: string
            enum:
              - reachable
              - needs_review
              - unreachable
              - not_tested
          description: >-
            Filter by exploitability status. When omitted, defaults to all four:
            reachable, needs_review, unreachable, and not_tested.
        hasWizExposure:
          type: boolean
          enum:
            - true
          description: >-
            Filter to vulnerabilities associated with applications exposed by
            Wiz
        scanId:
          type: string
          description: >-
            Count only findings from this SCA scan, instead of the latest scan
            per repository. The scan must belong to a repository you can view.
        status:
          type: string
          enum:
            - all
            - open
            - closed
          description: >-
            Lifecycle filter. Defaults to 'all'. Pass 'open' to reproduce the
            number the posture endpoint reports as `funnel.open`.
        severities:
          type: array
          items:
            type: string
            enum:
              - critical
              - high
              - medium
              - low
              - info
          description: Filter by severity bucket.
        packageReachability:
          type: array
          items:
            type: string
            enum:
              - reachable
              - notReachable
              - notTested
          description: Filter by the package-level reachability verdict.
        isCompiled:
          type: boolean
          description: >-
            Filter to compiled assets (true) or manifest-declared dependencies
            (false). Omit to count both.
        hasFix:
          type: boolean
          description: >-
            Filter to findings with a non-empty recommended fix version — the
            same population the "fixable" posture numerator counts.
        includeEphemeral:
          type: boolean
          description: Include ephemeral repositories. Defaults to false.
      required:
        - organizationId
    ScaVulnerabilityCountResponse:
      type: object
      properties:
        totalCount:
          type: integer
          description: Number of findings matching the filters.
      required:
        - totalCount
  responses:
    BadRequest:
      description: Bad Request
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: string
    Unauthorized:
      description: Unauthorized
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: string
  securitySchemes:
    apiTokenId:
      type: apiKey
      in: header
      name: X-ZeroPath-API-Token-Id
      x-fern-header:
        name: apiTokenId
        env: ZEROPATH_API_TOKEN_ID
    apiTokenSecret:
      type: apiKey
      in: header
      name: X-ZeroPath-API-Token-Secret
      x-fern-header:
        name: apiTokenSecret
        env: ZEROPATH_API_TOKEN_SECRET

````