Try it free

List vulnerabilities with a segment filter

  • Latest Dynatrace
  • Reference
  • Published Oct 13, 2026

List vulnerabilities in Dynatrace with the Vulnerabilities API and a segment filter, using query filters, sorting, and a time range to narrow results.

POSTSaaShttps://{your-environment-id}.apps.dynatrace.com/platform/vulnerabilities/v1/vulnerabilities:segment

Overview

You use the filter and sort query parameters, plus start-time and end-time, to narrow the vulnerability results, and you provide filterSegments in the request body. It returns an array of vulnerabilities from Dynatrace.

Authentication

To execute this request, you need a platform token or OAuth access token with vulnerability-service:vulnerabilities:read scope. To learn how to obtain and use it, see Tokens and authentication.

Parameters

ParameterTypeDescriptionInRequired
filterstring

The filter parameter, as explained here: This expression filters the returned vulnerabilities. Generally, all fields can be used for filtering. affectedEntities can only be filtered by affectedEntities.count. vulnerableComponents only supports the contains operator, requiring exact matches within any of the vulnerable component values.

queryOptional
sortstring

The sort parameter, as explained here: Fields can be prefixed with - for descending order. If no prefix is specified, ascending order is used. Multiple fields can be concatenated using a comma as a separator (e.g. resolution.status,-technology).

Generally, all fields with a single value can be used for sorting; however, sorting by fields with array values such as references.cve isn't possible. affectedEntities can only be sorted by affectedEntities.count.

If this parameter is omitted, the vulnerabilities are sorted by their ids.

queryOptional
start-timestring

The start of the requested timeframe.
It can't be in the future and the minimum time window has to be 30 minutes i.e. end-time - 30 minutes

You can use one of the following formats:

  • Absolute timestamps, conforming to ISO 8601 i.e. YYYY-MM-DD”T”HH:MM:SS.ssssss”Z”. If no time zone is specified, UTC is used.
  • Relative timeframe, back from now. The format is now-NU, where N is the amount of time and U is the unit of time.
    Supported time units for the relative timeframe are:
    • s: seconds
    • m: minutes
    • h: hours
    • d: days
queryOptional
end-timestring

The end of the requested timeframe.
Only now is supported.

queryOptional
bodySegmentRequestBody

The JSON body of the request containing the filter segments.

bodyOptional

Request body objects

The SegmentRequestBody object

ElementTypeDescriptionRequired
filterSegmentsFilterSegment[]-Optional

The FilterSegment object

Use filter segments to define the considered affected entities. For more information see the documentation.

ElementTypeDescriptionRequired
idstring-Required
variablesFilterSegmentVariable[]-Optional

The FilterSegmentVariable object

ElementTypeDescriptionRequired
namestring-Required
valuesstring[]-Required

Request body JSON model

This is a model of the request body, showing the possible elements. It has to be adjusted for usage in an actual request.

{
  "filterSegments": [
    {
      "id": "string",
      "variables": [
        {
          "name": "string",
          "values": [
            "string"
          ]
        }
      ]
    }
  ]
}

Response

Response codes

CodeTypeDescription
200Vulnerabilities

An array of vulnerabilities

400--
401--
403--
404--
429--
500--
501--
503--

Response body objects

The Vulnerabilities object

A list of vulnerabilities.

ElementTypeDescription
vulnerabilitiesVulnerability[]

A list of vulnerabilities.

The Vulnerability object

Contains detailed information about the particular vulnerability. For information on the properties see our documentation.

ElementTypeDescription
idstring-
externalIdstring

External provider's unique identifier for the vulnerability. Example: SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646

externalUrlstring

External provider's URL to the details page of the vulnerability.

displayIdstring-
typestring-
stackStack-
The element can hold these values
  • CODE
  • CODE_LIBRARY
  • SOFTWARE
  • CONTAINER_ORCHESTRATION
technologyTechnology-
The element can hold these values
  • DOTNET
  • GO
  • JAVA
  • KUBERNETES
  • NODE_JS
  • PHP
  • PYTHON
titlestring-
descriptionstring-
referencesReferences-
resolutionResolution-
cvssCvss-
riskRisk-
davisAssessmentDavisAssessment-
kevKnownExploitedVulnerabilityDetails-
codeLocationCodeLocation-
affectedEntitiesAffectedEntityStatistics-
vulnerableComponentsVulnerableComponent[]

A list of all vulnerable components.

isFixAvailableboolean-
remediationRemediation-
muteMute-
trackingLinkCoveragePercentagenumber

Percent of affected entities that have a tracking link assigned. 100% coverage means that every affected entity has a tracking link assigned. Examples: [ 80.5, 30.5 ]

The Stack object

The Technology object

The References object

ElementTypeDescription
cvestring[]-
cwestring[]-
owaspstring[]-

The Resolution object

ElementTypeDescription
statusStatus-
The element can hold these values
  • OPEN
  • RESOLVED
changeDatestring-

The Status object

The Cvss object

ElementTypeDescription
baseScorenumber-
versionstring-
vectorstring-

The Risk object

ElementTypeDescription
scorenumber-
levelRiskLevel-
The element can hold these values
  • NONE
  • LOW
  • MEDIUM
  • HIGH
  • CRITICAL

The RiskLevel object

The DavisAssessment object

ElementTypeDescription
scorenumber-
levelRiskLevel-
The element can hold these values
  • NONE
  • LOW
  • MEDIUM
  • HIGH
  • CRITICAL
exposureStatusExposureStatus-
The element can hold these values
  • NOT_AVAILABLE
  • NOT_DETECTED
  • PUBLIC_NETWORK
dataAssetsStatusDataAssetsStatus-
The element can hold these values
  • NOT_AVAILABLE
  • NOT_DETECTED
  • REACHABLE
assessmentModeAssessmentMode-
The element can hold these values
  • NOT_AVAILABLE
  • REDUCED
  • FULL
exploitStatusExploitStatus-
The element can hold these values
  • NOT_AVAILABLE
  • AVAILABLE
vulnerableFunctionStatusVulnerableFunctionStatus-
The element can hold these values
  • NOT_AVAILABLE
  • NOT_IN_USE
  • IN_USE
vectorstring-

The ExposureStatus object

The DataAssetsStatus object

The AssessmentMode object

The ExploitStatus object

The VulnerableFunctionStatus object

The KnownExploitedVulnerabilityDetails object

ElementTypeDescription
isInCatalogboolean-
dueDatestring-

The CodeLocation object

ElementTypeDescription
namestring-

The AffectedEntityStatistics object

ElementTypeDescription
countinteger-
typesstring[]-
processGroupsAffectedCounts-
kubernetesNodesAffectedCounts-
hostsAffectedCounts-
affectedProcessesAffectedCounts-

The AffectedCounts object

ElementTypeDescription
countinteger-

The VulnerableComponent object

ElementTypeDescription
idstring-
namestring-
shortNamestring-
versionstring-
packageNamestring-

The Remediation object

ElementTypeDescription
descriptionstring-

The Mute object

ElementTypeDescription
statusMuteStatus-
The element can hold these values
  • MUTED
  • NOT_MUTED

The MuteStatus object

Response body JSON models

{
  "vulnerabilities": [
    {
      "id": "string",
      "externalId": "string",
      "externalUrl": "string",
      "displayId": "string",
      "type": "string",
      "stack": "CODE",
      "technology": "DOTNET",
      "title": "string",
      "description": "string",
      "references": {
        "cve": [
          "string"
        ],
        "cwe": [
          "string"
        ],
        "owasp": [
          "string"
        ]
      },
      "resolution": {
        "status": "OPEN",
        "changeDate": "string"
      },
      "cvss": {
        "baseScore": 1,
        "version": "string",
        "vector": "string"
      },
      "risk": {
        "score": 1,
        "level": "NONE"
      },
      "davisAssessment": {
        "score": 1,
        "level": "NONE",
        "exposureStatus": "NOT_AVAILABLE",
        "dataAssetsStatus": "NOT_AVAILABLE",
        "assessmentMode": "NOT_AVAILABLE",
        "exploitStatus": "NOT_AVAILABLE",
        "vulnerableFunctionStatus": "NOT_AVAILABLE",
        "vector": "string"
      },
      "kev": {
        "isInCatalog": true,
        "dueDate": "string"
      },
      "codeLocation": {
        "name": "string"
      },
      "affectedEntities": {
        "count": 1,
        "types": [
          "string"
        ],
        "processGroups": {
          "count": 1
        },
        "kubernetesNodes": {},
        "hosts": {},
        "affectedProcesses": {}
      },
      "vulnerableComponents": [
        {
          "id": "string",
          "name": "string",
          "shortName": "string",
          "version": "string",
          "packageName": "string"
        }
      ],
      "isFixAvailable": true,
      "remediation": {
        "description": "string"
      },
      "mute": {
        "status": "MUTED"
      },
      "trackingLinkCoveragePercentage": 1
    }
  ]
}
Related tags
Platform APIDynatrace PlatformApplication SecurityThreat Observability