Org-level SCA posture (funnel + headline counts + fixable% + direct/transitive)
curl --request POST \
--url https://zeropath.com/api/v1/sca/posture \
--header 'Content-Type: application/json' \
--header 'X-ZeroPath-API-Token-Id: <api-key>' \
--header 'X-ZeroPath-API-Token-Secret: <api-key>' \
--data '
{
"organizationId": "<string>",
"repositoryIds": [
"<string>"
],
"branch": "<string>",
"includeEphemeral": true
}
'import requests
url = "https://zeropath.com/api/v1/sca/posture"
payload = {
"organizationId": "<string>",
"repositoryIds": ["<string>"],
"branch": "<string>",
"includeEphemeral": True
}
headers = {
"X-ZeroPath-API-Token-Id": "<api-key>",
"X-ZeroPath-API-Token-Secret": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'X-ZeroPath-API-Token-Id': '<api-key>',
'X-ZeroPath-API-Token-Secret': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({
organizationId: '<string>',
repositoryIds: ['<string>'],
branch: '<string>',
includeEphemeral: true
})
};
fetch('https://zeropath.com/api/v1/sca/posture', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://zeropath.com/api/v1/sca/posture",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'organizationId' => '<string>',
'repositoryIds' => [
'<string>'
],
'branch' => '<string>',
'includeEphemeral' => true
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-ZeroPath-API-Token-Id: <api-key>",
"X-ZeroPath-API-Token-Secret: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://zeropath.com/api/v1/sca/posture"
payload := strings.NewReader("{\n \"organizationId\": \"<string>\",\n \"repositoryIds\": [\n \"<string>\"\n ],\n \"branch\": \"<string>\",\n \"includeEphemeral\": true\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-ZeroPath-API-Token-Id", "<api-key>")
req.Header.Add("X-ZeroPath-API-Token-Secret", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://zeropath.com/api/v1/sca/posture")
.header("X-ZeroPath-API-Token-Id", "<api-key>")
.header("X-ZeroPath-API-Token-Secret", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"organizationId\": \"<string>\",\n \"repositoryIds\": [\n \"<string>\"\n ],\n \"branch\": \"<string>\",\n \"includeEphemeral\": true\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://zeropath.com/api/v1/sca/posture")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-ZeroPath-API-Token-Id"] = '<api-key>'
request["X-ZeroPath-API-Token-Secret"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"organizationId\": \"<string>\",\n \"repositoryIds\": [\n \"<string>\"\n ],\n \"branch\": \"<string>\",\n \"includeEphemeral\": true\n}"
response = http.request(request)
puts response.read_body{
"funnel": {
"open": 123,
"reachable": 123,
"needsReview": 123,
"likelyExploitable": 123,
"kev": 123
},
"headline": {
"critical": 123,
"high": 123,
"medium": 123,
"low": 123,
"info": 123,
"kev": 123,
"exploitable": 123
},
"fixablePercent": 123,
"directVsTransitive": {
"direct": 123,
"transitive": 123
}
}{
"error": "<string>"
}{
"error": "<string>"
}SCA
Org-level SCA posture (funnel + headline counts + fixable% + direct/transitive)
Return the org-level SCA posture for the caller’s viewable repos: the staged funnel (open → reachable/needs_review → likelyExploitable → kev), headline severity/KEV/exploitable counts, fixablePercent, and the direct-vs-transitive rollup. Org-scoped: findings in repos outside the caller’s access are never counted. Honest empty (zeros, null fixablePercent) when there is no access or no open findings.
POST
/
api
/
v1
/
sca
/
posture
Org-level SCA posture (funnel + headline counts + fixable% + direct/transitive)
curl --request POST \
--url https://zeropath.com/api/v1/sca/posture \
--header 'Content-Type: application/json' \
--header 'X-ZeroPath-API-Token-Id: <api-key>' \
--header 'X-ZeroPath-API-Token-Secret: <api-key>' \
--data '
{
"organizationId": "<string>",
"repositoryIds": [
"<string>"
],
"branch": "<string>",
"includeEphemeral": true
}
'import requests
url = "https://zeropath.com/api/v1/sca/posture"
payload = {
"organizationId": "<string>",
"repositoryIds": ["<string>"],
"branch": "<string>",
"includeEphemeral": True
}
headers = {
"X-ZeroPath-API-Token-Id": "<api-key>",
"X-ZeroPath-API-Token-Secret": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'X-ZeroPath-API-Token-Id': '<api-key>',
'X-ZeroPath-API-Token-Secret': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({
organizationId: '<string>',
repositoryIds: ['<string>'],
branch: '<string>',
includeEphemeral: true
})
};
fetch('https://zeropath.com/api/v1/sca/posture', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://zeropath.com/api/v1/sca/posture",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'organizationId' => '<string>',
'repositoryIds' => [
'<string>'
],
'branch' => '<string>',
'includeEphemeral' => true
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-ZeroPath-API-Token-Id: <api-key>",
"X-ZeroPath-API-Token-Secret: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://zeropath.com/api/v1/sca/posture"
payload := strings.NewReader("{\n \"organizationId\": \"<string>\",\n \"repositoryIds\": [\n \"<string>\"\n ],\n \"branch\": \"<string>\",\n \"includeEphemeral\": true\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-ZeroPath-API-Token-Id", "<api-key>")
req.Header.Add("X-ZeroPath-API-Token-Secret", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://zeropath.com/api/v1/sca/posture")
.header("X-ZeroPath-API-Token-Id", "<api-key>")
.header("X-ZeroPath-API-Token-Secret", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"organizationId\": \"<string>\",\n \"repositoryIds\": [\n \"<string>\"\n ],\n \"branch\": \"<string>\",\n \"includeEphemeral\": true\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://zeropath.com/api/v1/sca/posture")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-ZeroPath-API-Token-Id"] = '<api-key>'
request["X-ZeroPath-API-Token-Secret"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"organizationId\": \"<string>\",\n \"repositoryIds\": [\n \"<string>\"\n ],\n \"branch\": \"<string>\",\n \"includeEphemeral\": true\n}"
response = http.request(request)
puts response.read_body{
"funnel": {
"open": 123,
"reachable": 123,
"needsReview": 123,
"likelyExploitable": 123,
"kev": 123
},
"headline": {
"critical": 123,
"high": 123,
"medium": 123,
"low": 123,
"info": 123,
"kev": 123,
"exploitable": 123
},
"fixablePercent": 123,
"directVsTransitive": {
"direct": 123,
"transitive": 123
}
}{
"error": "<string>"
}{
"error": "<string>"
}Authorizations
Body
application/json
Optional subset of repositories to scope the posture to.
Read each repository as of its newest finished scan on this branch. Omit for the newest scan on any branch.
Minimum string length:
1Include ephemeral (PR-scan) repositories. Defaults to false.
Response
Successful response
Was this page helpful?