API & Vulnerability Data

General
1

Is there a way to pull vulnerability data via the API? I didn’t see anything in the swagger file for vulnerability.

2

Hi Brandon,

Yes, you can pull it through the API. It isn’t listed separately in the swagger because vulnerability data comes from the Vulnerability Reporting extension (ext-vulnerability-reporting). You get it through the generic extension request endpoint, POST /v1/extension/request/{extensionName}, which the swagger lists under Extensions. You pick the query with the action field.

Example: list the org’s CVEs, highest risk first:

curl -s -X POST \
  "https://api.limacharlie.io/v1/extension/request/ext-vulnerability-reporting" \
  -H "Authorization: Bearer $LC_JWT" \
  -d oid="YOUR_OID" \
  -d action="query_cves" \
  -d data='{"limit": 100, "sort_by": "lc_risk", "filters": {"severity": ["critical", "high"]}}'

The read actions you’re most likely to want:

  • query_cves: CVEs across the org, with affected host count, severity, LC Risk score and optional KEV/EPSS data
  • query_endpoints: each endpoint with its vulnerability counts
  • query_host_vuln_packages: vulnerable packages and their CVEs on one sensor (pass sid), including fix versions
  • query_cve_vuln_hosts / query_cve_vuln_packages: hosts or packages affected by a given CVE (pass cve)
  • query_cve: full details for one CVE
  • query_dashboard, query_daily_snapshots: summary counts and daily trends

List results are paginated. Pass the next_cursor from each response back as cursor to get the next page. Your API key needs the ext.request permission, and the org has to be subscribed to the extension.

The CLI wraps the same actions, which is often the easier option for scripting:

pip install --upgrade limacharlie
limacharlie vulnerability cve list --sort-by lc_risk --filter severity=critical
limacharlie vulnerability host list
limacharlie vulnerability host packages <SID>

The full request and response reference for each action is here: Vulnerability Reporting - LimaCharlie Documentation