Cross-project vulnerability findings (admin, install-scoped).

GET

/v1/inventory/findings

Code sample: Shell / cURL

curl --request GET \
  --url 'https://stratum.example.com/v1/inventory/findings?state=open&sort=priority&limit=100' \
  --header 'Authorization: Bearer <token>'

• A Stratum cluster endpoint.

. Findings across ALL projects — the operator’s install-wide posture lens. Same InventoryFinding shape (carries projectId + instanceId) and filters as the per-project list, plus optional projectId/organizationId narrowing, paginated. Requires the install-scoped inventory:ReadAll action.

Authorizations

• bearerAuth

Parameters

Query Parameters

state

string

Allowed values: open acknowledged suppressed resolved

priority

Array<string>

Allowed values: critical high medium low info

Filter by ladder-v1 priority (repeatable).

knownExploited

boolean

sort

string

Allowed values: priority

projectId

string

Narrow to a single project.

organizationId

string

Narrow to a single organization.

limit

integer

default: 100 >= 1 <= 500

pageToken

string

Opaque cursor from a previous response’s nextPageToken.

A keyset cursor: it names the last row of the previous page, so pages stay stable while findings are inserted or resolved underneath the caller. Findings are written in bulk by the vulnerability feed, so that happens routinely.

A token issued before encoded an offset. Those are not accepted and fall back to the first page rather than resuming at a wrong position.

Responses

200

Cross-project findings page.

Media typeapplication/json

object

items

required

Array<object>

object

id

required

string

/^vf-[a-z0-9]+$/

projectId

required

string

instanceId

required

string

purl

required

string

vulnId

required

CVE / GHSA / OSV id

string

severity

string

fixedVersion

string

state

required

Open/acknowledged/suppressed are operator-facing; resolved is matcher-owned (package no longer matches).

string

Allowed values: open acknowledged suppressed resolved

firstSeen

required

string format: date-time

lastSeen

required

string format: date-time

sourceFeed

string

priority

required

ladder-v1 rank derived from CVSS x EPSS x KEV. KEV membership forces critical; missing enrichment degrades to a severity-derived score, never unranked.

string

Allowed values: critical high medium low info

knownExploited

required

CISA KEV membership — exploited in the wild.

boolean

epssScore

FIRST EPSS 30-day exploit probability (0.0-1.0), null if unknown.

number format: double

nullable

cvssBase

Normalized CVSS base score (0.0-10.0), null if unknown.

number format: double

nullable

nextPageToken

Opaque cursor for the next page; absent when there are no more.

string

Example

{
  "items": [
    {
      "state": "open",
      "priority": "critical"
    }
  ]
}

403

Authenticated but not authorized.

Media typeapplication/problem+json

object

type

required

string format: uri

title

required

string

status

required

integer

>= 400 <= 599

detail

string

instance

string format: uri-reference

requestId

required

string

code

required

string

issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object

code

required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string

statement

required

Index of the statement at fault; -1 for the document as a whole.

integer

>= -1

detail

required

string

action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string

errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object

field

required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string

message

required

string

details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object

key

additional properties

any

Example

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}