Get Version Vulnerabilities

GET https://api.repoflow.io/1/workspaces/<workspace-ref>/repositories/<repository-ref>/packages/versions/<version-id>/vulnerabilities

Retrieve the latest vulnerability scan result for a package version, including a severity summary and the detected CVEs.

This endpoint works for local and remote repositories.

Authentication: Optional (required if repository is private)

Path Parameters

workspace-refstringRequired

Workspace ID or name.

repository-refstringRequired

Repository ID or name.

version-idstringRequired

Package version UUID.

Request

Command Line

curl -sS -X GET "https://api.repoflow.io/1/workspaces/<workspace-ref>/repositories/<repository-ref>/packages/versions/<version-id>/vulnerabilities" \
  -H "Authorization: Bearer <accessToken>" \
  -H "Accept: application/json"

Response

{
  "version": {
      "id": "63edca5d-8890-4413-8a0c-7cf0ec2bd2df",
      "packageId": "52cab49e-86a4-4d5a-a301-38cc40a4579a",
      "packageName": "left-pad",
      "version": "1.3.0",
      "cveSummary": {
          "isScanned": true,
          "scannedAt": "2026-05-04T12:00:00.000Z",
          "scanTool": "grype",
          "cveCount": 1,
          "criticalCveCount": 0,
          "highCveCount": 1,
          "mediumCveCount": 0,
          "lowCveCount": 0,
          "negligibleCveCount": 0,
          "unknownCveCount": 0
      }
  },
  "vulnerabilities": [
      {
          "id": "8b10d2b7-e4a2-4d35-b206-3a21d3d9a45a",
          "cveId": "CVE-2026-0001",
          "severity": "HIGH",
          "description": "Example vulnerability description.",
          "url": "https://example.com/CVE-2026-0001",
          "packageName": "dependency-name",
          "packageVersion": "1.0.0",
          "fileName": "left-pad-1.3.0.tgz"
      }
  ]
}