> ## Documentation Index
> Fetch the complete documentation index at: https://zeropath.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Org-level SCA posture (funnel + headline counts + fixable% + direct/transitive)

> Return the org-level SCA posture for the caller’s viewable repos: the staged funnel (open → reachable/needs_review → likelyExploitable → kev), headline severity/KEV/exploitable counts, fixablePercent, and the direct-vs-transitive rollup. Org-scoped: findings in repos outside the caller’s access are never counted. Honest empty (zeros, null fixablePercent) when there is no access or no open findings.



## OpenAPI

````yaml https://zeropath.com/openapi/v1.yaml post /api/v1/sca/posture
openapi: 3.1.0
info:
  title: ZeroPath API
  version: 1.0.0
  description: Public API for ZeroPath
servers:
  - url: https://zeropath.com
    description: Production server
    x-fern-server-name: Production
  - url: https://dev.branch.zeropath.com
    description: Development server
    x-fern-server-name: Development
security:
  - apiTokenId: []
    apiTokenSecret: []
tags:
  - name: Organizations
    description: Operations related to organizations
  - name: Stats
    description: Operations related to stats
  - name: Repositories
    description: Operations related to repositories
  - name: Installations
    description: Operations related to installations
  - name: Issues
    description: Operations related to issues
  - name: SCA
    description: Software Composition Analysis
  - name: Scans
    description: Operations related to scans
  - name: Rules
    description: Operations related to custom security rules
  - name: Referrals
    description: Operations related to referrals
paths:
  /api/v1/sca/posture:
    post:
      tags:
        - SCA
      summary: >-
        Org-level SCA posture (funnel + headline counts + fixable% +
        direct/transitive)
      description: >-
        Return the org-level SCA posture for the caller’s viewable repos: the
        staged funnel (open → reachable/needs_review → likelyExploitable → kev),
        headline severity/KEV/exploitable counts, fixablePercent, and the
        direct-vs-transitive rollup. Org-scoped: findings in repos outside the
        caller’s access are never counted. Honest empty (zeros, null
        fixablePercent) when there is no access or no open findings.
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GetScaOrgPostureInput'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScaOrgPostureResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
components:
  schemas:
    GetScaOrgPostureInput:
      type: object
      properties:
        organizationId:
          type: string
        repositoryIds:
          type: array
          items:
            type: string
          description: Optional subset of repositories to scope the posture to.
        includeEphemeral:
          type: boolean
          description: Include ephemeral (PR-scan) repositories. Defaults to false.
      required:
        - organizationId
    ScaOrgPostureResponse:
      type: object
      properties:
        funnel:
          $ref: '#/components/schemas/ScaPostureFunnel'
        headline:
          $ref: '#/components/schemas/ScaPostureHeadline'
        fixablePercent:
          type:
            - number
            - 'null'
          description: >-
            Percentage of open findings with a recommended fix version. Null
            when there are no open findings.
        directVsTransitive:
          $ref: '#/components/schemas/ScaPostureDirectVsTransitive'
      required:
        - funnel
        - headline
        - fixablePercent
        - directVsTransitive
    ScaPostureFunnel:
      type: object
      properties:
        open:
          type: integer
          description: Total open SCA findings.
        reachable:
          type: integer
          description: Open findings with a `reachable` verdict.
        needsReview:
          type: integer
          description: Open findings with a `needs_review` verdict.
        likelyExploitable:
          type: integer
          description: >-
            Reachable-stage findings that are CONFIRMED-validated OR KEV.
            Differs from headline.exploitable (CONFIRMED only).
        kev:
          type: integer
          description: likelyExploitable findings flagged Known Exploited.
      required:
        - open
        - reachable
        - needsReview
        - likelyExploitable
        - kev
    ScaPostureHeadline:
      type: object
      properties:
        critical:
          type: integer
        high:
          type: integer
        medium:
          type: integer
        low:
          type: integer
        info:
          type: integer
        kev:
          type: integer
        exploitable:
          type: integer
          description: CONFIRMED-validated open findings.
      required:
        - critical
        - high
        - medium
        - low
        - info
        - kev
        - exploitable
    ScaPostureDirectVsTransitive:
      type: object
      properties:
        direct:
          type: integer
        transitive:
          type: integer
      required:
        - direct
        - transitive
  responses:
    BadRequest:
      description: Bad Request
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: string
    Unauthorized:
      description: Unauthorized
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: string
  securitySchemes:
    apiTokenId:
      type: apiKey
      in: header
      name: X-ZeroPath-API-Token-Id
      x-fern-header:
        name: apiTokenId
        env: ZEROPATH_API_TOKEN_ID
    apiTokenSecret:
      type: apiKey
      in: header
      name: X-ZeroPath-API-Token-Secret
      x-fern-header:
        name: apiTokenSecret
        env: ZEROPATH_API_TOKEN_SECRET

````