Coolify logoCoolify
Cloud

List vulnerabilities

API server

https://app.coolify.io/api/v1

Choose where to send API requests

This changes the request URL and code examples on every endpoint page.

API server type

Requests will use

https://app.coolify.io/api/v1

Use only a Coolify URL you trust. Sending a test request also sends the API token you enter.

GET
/vulnerabilities

List the applications, services, and databases of the authenticated team with their stored security status from image scanning.

Authorization

bearerAuth
AuthorizationBearer <token>

Go to Keys & Tokens / API tokens and create a new token. Use the token as the bearer token.

In: header

Query Parameters

status?string

Comma-separated statuses to return.

Response Body

application/json

application/json

application/json

curl -X GET "https://app.coolify.io/api/v1/vulnerabilities"
{  "resources": [    {      "uuid": "string",      "name": "string",      "type": "application",      "project_uuid": "string",      "environment_uuid": "string",      "server_uuid": "string",      "images": {        "update": 0,        "total": 0      },      "security": {        "status": "update_now",        "label": "string",        "action": "string",        "check_reason": "string",        "problem_count": 0,        "exploited_count": 0,        "any_exploited": true,        "critical_count": 0,        "high_count": 0,        "medium_count": 0,        "eol": {},        "checked_at": "2019-08-24T14:15:22Z",        "actions": [          {            "type": "string",            "sentence": "string",            "target": "string",            "copy": "string",            "image": "string",            "ref": "string"          }        ]      }    }  ]}
{  "message": "Invalid token."}
{  "message": "Unauthenticated."}

Get service vulnerabilities GET

Get the security status, the scanned images, and the vulnerabilities of the applications and databases of a service.

Create Vultr Server POST

Create a Vultr instance and link it as a Coolify server. A cloud-init script or extra SSH key IDs need a token with the deploy permission.