Try it free

Get affected entities of a vulnerability

  • Latest Dynatrace
  • Reference
  • Published Oct 13, 2026

Get affected entities for a vulnerability in Dynatrace with the Vulnerabilities API, using filters, sorting, and a time range to refine results.

GETSaaShttps://{your-environment-id}.apps.dynatrace.com/platform/vulnerabilities/v1/vulnerabilities/{id}/affected-entities

Overview

You provide the vulnerability ID in the path and can use filter, sort, start-time, and end-time to narrow the affected entities returned. It returns the affected entities of the vulnerability from Dynatrace.

Authentication

To execute this request, you need a platform token or OAuth access token with vulnerability-service:vulnerabilities:read scope. To learn how to obtain and use it, see Tokens and authentication.

Parameters

ParameterTypeDescriptionInRequired
idstring

The ID of the related vulnerability.

pathRequired
filterstring

The filter parameter, as explained here: This expression filters the returned affected entities. Generally, all fields can be used for filtering, except for the entryPoints field. Array fields can additionally be filtered by their number of elements by suffixing with .count: affectedProcesses.count, vulnerableFunctions.count.

queryOptional
sortstring

The sort parameter, as explained here: Fields can be prefixed with - for descending order. If no prefix is specified, ascending order is used. Multiple fields can be concatenated using a comma as a separator (e.g. resolution.status,-name).

Generally, all fields with a single value can be used for sorting; array fields can only be sorted by their counts: affectedProcesses.count, vulnerableFunctions.count. The entryPoints field does not support sorting.

If this parameter is omitted, the affected entities are sorted by their id.

queryOptional
start-timestring

The start of the requested timeframe.
It can't be in the future and the minimum time window has to be 30 minutes i.e. end-time - 30 minutes

You can use one of the following formats:

  • Absolute timestamps, conforming to ISO 8601 i.e. YYYY-MM-DD”T”HH:MM:SS.ssssss”Z”. If no time zone is specified, UTC is used.
  • Relative timeframe, back from now. The format is now-NU, where N is the amount of time and U is the unit of time.
    Supported time units for the relative timeframe are:
    • s: seconds
    • m: minutes
    • h: hours
    • d: days
queryOptional
end-timestring

The end of the requested timeframe.
Only now is supported.

queryOptional

Response

Response codes

CodeTypeDescription
200AffectedEntities

The affected entities of the vulnerability

400--
401--
403--
404--
429--
500--
501--
503--

Response body objects

The AffectedEntities object

A list of affected entities.

ElementTypeDescription
affectedEntitiesAffectedEntity[]-

The AffectedEntity object

Contains detailed information about an affected entity and the related vulnerability.

ElementTypeDescription
idstring-
namestring-
typeAffectedEntityType-
The element can hold these values
  • PROCESS_GROUP
  • HOST
  • KUBERNETES_NODE
affectedProcessesstring[]-
muteMuteDetails-
cvssCvss-
riskRisk-
davisAssessmentDavisAssessment-
resolutionResolution-
vulnerableComponentVulnerableComponent-
vulnerableFunctionsVulnerableFunctions[]

A list of vulnerable functions in use.

trackingLinkTrackingLink-
entryPointsEntryPoint[]-

The AffectedEntityType object

The MuteDetails object

ElementTypeDescription
statusMuteStatus-
The element can hold these values
  • MUTED
  • NOT_MUTED
reasonMuteReason-
The element can hold these values
  • FALSE_POSITIVE
  • IGNORE
  • AFFECTED
  • CONFIGURATION_NOT_AFFECTED
  • OTHER
userstring-
commentstring-
changeDatestring-

The MuteStatus object

The MuteReason object

The Cvss object

ElementTypeDescription
baseScorenumber-
versionstring-
vectorstring-

The Risk object

ElementTypeDescription
scorenumber-
levelRiskLevel-
The element can hold these values
  • NONE
  • LOW
  • MEDIUM
  • HIGH
  • CRITICAL

The RiskLevel object

The DavisAssessment object

ElementTypeDescription
scorenumber-
levelRiskLevel-
The element can hold these values
  • NONE
  • LOW
  • MEDIUM
  • HIGH
  • CRITICAL
exposureStatusExposureStatus-
The element can hold these values
  • NOT_AVAILABLE
  • NOT_DETECTED
  • PUBLIC_NETWORK
dataAssetsStatusDataAssetsStatus-
The element can hold these values
  • NOT_AVAILABLE
  • NOT_DETECTED
  • REACHABLE
assessmentModeAssessmentMode-
The element can hold these values
  • NOT_AVAILABLE
  • REDUCED
  • FULL
exploitStatusExploitStatus-
The element can hold these values
  • NOT_AVAILABLE
  • AVAILABLE
vulnerableFunctionStatusVulnerableFunctionStatus-
The element can hold these values
  • NOT_AVAILABLE
  • NOT_IN_USE
  • IN_USE
vectorstring-

The ExposureStatus object

The DataAssetsStatus object

The AssessmentMode object

The ExploitStatus object

The VulnerableFunctionStatus object

The Resolution object

ElementTypeDescription
statusStatus-
The element can hold these values
  • OPEN
  • RESOLVED
changeDatestring-

The Status object

The VulnerableComponent object

ElementTypeDescription
idstring-
namestring-
shortNamestring-
versionstring-
packageNamestring-

The VulnerableFunctions object

A list of vulnerable functions in use.

The TrackingLink object

ElementTypeDescription
urlstring

The tracking link URL set for the affected entities, e.g. https://example.com/ISSUE-123. Note that only valid URLs with 'http' or 'https' protocols are supported.

textstring

The tracking link text set for the affected entities, e.g. 'ISSUE-123'.

The EntryPoint object

ElementTypeDescription
urlEntryPointUrl-
payloadstring-
functionEntryPointFunction-
userControlledInputsUserControlledInput[]-

The EntryPointUrl object

ElementTypeDescription
pathstring-

The EntryPointFunction object

ElementTypeDescription
namestring-

The UserControlledInput object

ElementTypeDescription
typestring-
keystring-
valuestring-
payloadUserControlledInputPayload-
isMaliciousboolean-

The UserControlledInputPayload object

ElementTypeDescription
startinteger-
endinteger-

Response body JSON models

{
  "affectedEntities": [
    {
      "id": "string",
      "name": "string",
      "type": "PROCESS_GROUP",
      "affectedProcesses": [
        "string"
      ],
      "mute": {
        "status": "MUTED",
        "reason": "FALSE_POSITIVE",
        "user": "string",
        "comment": "string",
        "changeDate": "string"
      },
      "cvss": {
        "baseScore": 1,
        "version": "string",
        "vector": "string"
      },
      "risk": {
        "score": 1,
        "level": "NONE"
      },
      "davisAssessment": {
        "score": 1,
        "level": "NONE",
        "exposureStatus": "NOT_AVAILABLE",
        "dataAssetsStatus": "NOT_AVAILABLE",
        "assessmentMode": "NOT_AVAILABLE",
        "exploitStatus": "NOT_AVAILABLE",
        "vulnerableFunctionStatus": "NOT_AVAILABLE",
        "vector": "string"
      },
      "resolution": {
        "status": "OPEN",
        "changeDate": "string"
      },
      "vulnerableComponent": {
        "id": "string",
        "name": "string",
        "shortName": "string",
        "version": "string",
        "packageName": "string"
      },
      "vulnerableFunctions": [
        "string"
      ],
      "trackingLink": {
        "url": "string",
        "text": "string"
      },
      "entryPoints": [
        {
          "url": {
            "path": "string"
          },
          "payload": "string",
          "function": {
            "name": "string"
          },
          "userControlledInputs": [
            {
              "type": "string",
              "key": "string",
              "value": "string",
              "payload": {
                "start": 1,
                "end": 1
              },
              "isMalicious": true
            }
          ]
        }
      ]
    }
  ]
}
Related tags
Platform APIDynatrace PlatformApplication SecurityThreat Observability