# API & Vulnerability Data

**URL:** <https://community.limacharlie.com/t/api-vulnerability-data/809>\
**Category:** General\
**Created:** [October 15, 2026, 2:50pm UTC](https://community.limacharlie.com/t/api-vulnerability-data/809 "2026-10-15T14:50:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Brandon\_Poole](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/brandon_poole/32/444_2.png) [@Brandon\_Poole](https://community.limacharlie.com/u/Brandon_Poole)\
**Post date:** [October 15, 2026, 2:50pm UTC](https://community.limacharlie.com/t/api-vulnerability-data/809/1 "2026-10-15T14:50:45Z")

</div>

Is there a way to pull vulnerability data via the API? I didn’t see anything in the swagger file for vulnerability.

---

<div class="post-metadata">

**Author:** ![maximelb](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/maximelb/32/13_2.png) [@maximelb](https://community.limacharlie.com/u/maximelb)\
**Post date:** [October 15, 2026, 3:10pm UTC](https://community.limacharlie.com/t/api-vulnerability-data/809/2 "2026-10-15T15:10:01Z")

</div>

Hi Brandon,

Yes, you can pull it through the API. It isn’t listed separately in the swagger because vulnerability data comes from the Vulnerability Reporting extension (`ext-vulnerability-reporting`). You get it through the generic extension request endpoint, `POST /v1/extension/request/{extensionName}`, which the swagger lists under Extensions. You pick the query with the `action` field.

Example: list the org’s CVEs, highest risk first:

```bash
curl -s -X POST \
  "https://api.limacharlie.io/v1/extension/request/ext-vulnerability-reporting" \
  -H "Authorization: Bearer $LC_JWT" \
  -d oid="YOUR_OID" \
  -d action="query_cves" \
  -d data='{"limit": 100, "sort_by": "lc_risk", "filters": {"severity": ["critical", "high"]}}'

```

The read actions you’re most likely to want:

- `query_cves`: CVEs across the org, with affected host count, severity, LC Risk score and optional KEV/EPSS data
- `query_endpoints`: each endpoint with its vulnerability counts
- `query_host_vuln_packages`: vulnerable packages and their CVEs on one sensor (pass `sid`), including fix versions
- `query_cve_vuln_hosts` / `query_cve_vuln_packages`: hosts or packages affected by a given CVE (pass `cve`)
- `query_cve`: full details for one CVE
- `query_dashboard`, `query_daily_snapshots`: summary counts and daily trends

List results are paginated. Pass the `next_cursor` from each response back as `cursor` to get the next page. Your API key needs the `ext.request` permission, and the org has to be subscribed to the extension.

The CLI wraps the same actions, which is often the easier option for scripting:

```bash
pip install --upgrade limacharlie
limacharlie vulnerability cve list --sort-by lc_risk --filter severity=critical
limacharlie vulnerability host list
limacharlie vulnerability host packages <SID>

```

The full request and response reference for each action is here: [Vulnerability Reporting - LimaCharlie Documentation](https://docs.limacharlie.io/5-integrations/extensions/limacharlie/vulnerability-reporting/#api-actions)