Inventory API

The Inventory API is the primary API for most integration use cases. Use it to manage applications, assets, vulnerabilities, and collections programmatically.

For authentication and general Swagger UI navigation, refer to Get started with the Invicti Platform API. Open this API definition directly in Swagger UI.

Common examples

List applications

Use this to retrieve all applications in your organization. Applications group related assets together.

View list applications example

Endpoint: GET /api/inventory/v1/applications

Try it in Swagger UI:

1. Expand Applications and select GET /api/inventory/v1/applications.
2. Click Try it out.
3. Set pageSize to 10 and pageNumber to 1.
4. Optionally set includeAssetCounts to true to see how many assets belong to each application.
5. Click Execute.

Example response:

{
  "items": [
    {
      "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
      "organizationId": "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy",
      "collectionIds": [
        "zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz"
      ],
      "assetIds": [
        "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
      ],
      "name": "Barnaby Stores App South",
      "description": null,
      "tags": [],
      "assetCounts": {
        "targets": 3,
        "repositories": 0
      }
    }
  ],
  "pageInfo": {
    "totalCount": 1,
    "pageSize": 10,
    "currentPage": 1,
    "totalPages": 1
  }
}

Create an application

Use this to create a new application programmatically, for example as part of an onboarding pipeline.

View create application example

Endpoint: POST /api/inventory/v1/applications

Try it in Swagger UI:

1. Expand Applications and select POST /api/inventory/v1/applications.
2. Click Try it out.
3. Replace the example request body with your values:

{
  "name": "string",
  "description": "string",
  "tags": ["string"]
}

4. Click Execute.

A successful response returns HTTP 201 Created with a Location header containing the URL of the new application.

Field	Required	Notes
name	Yes	1-255 characters
description	No	Up to 1,023 characters
tags	No	Array of strings

List assets

Use this to retrieve all assets in your organization, with optional filtering by application, type, or URL.

View list assets example

Endpoint: GET /api/inventory/v1/assets

Try it in Swagger UI:

1. Expand Assets and select GET /api/inventory/v1/assets.
2. Click Try it out.
3. Use any combination of the following filters:
   • applicationId - limit results to a specific application
   • assetType - filter by Target, Project, or Repository (Project and Repository are SAST/SCA assets from the Mend integration; Target is a DAST/API asset)
   • targetUrl - filter by URL
   • pageSize and pageNumber - control pagination
4. Click Execute.

Example response:

{
  "items": [
    {
      "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
      "organizationId": "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy",
      "applicationIds": [
        "zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz"
      ],
      "assetType": "Target",
      "name": "Production API",
      "targetUrl": "https://api.example.com",
      "tags": ["api", "production"],
      "deleted": false
    }
  ],
  "pageInfo": {
    "totalCount": 120,
    "pageSize": 20,
    "currentPage": 1,
    "totalPages": 6
  }
}

List vulnerabilities with filters

Use this to retrieve vulnerabilities, filtered by severity, status, or asset.

View list vulnerabilities example

Endpoint: GET /api/inventory/v1/vulnerabilities

Try it in Swagger UI:

1. Expand Vulnerabilities and select GET /api/inventory/v1/vulnerabilities.
2. Click Try it out.
3. Use any combination of the following filters:
   • vulnerabilitySeverities - filter by severity (for example, Critical, High)
   • vulnerabilityStatus - filter by status (for example, open, fixed)
   • assetId - limit results to a specific asset (use the UUID from the assets endpoint)
   • pageSize and pageNumber - control pagination
4. Click Execute.

Example response:

{
  "items": [
    {
      "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
      "assetId": "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy",
      "typeId": "sql-injection",
      "vulnerabilityTypeId": "zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz",
      "signature": "xxxxxxxx-hash-of-vulnerability-attributes",
      "originId": "target-123",
      "name": "Directory listings",
      "status": "open",
      "severity": "medium",
      "confirmed": true,
      "firstSeen": "2025-11-13T10:39:15Z",
      "lastSeen": "2025-11-13T10:39:15Z",
      "lastSeenInstanceLink": "https://platform.invicti.com/app/scans/scan-uuid/instances/instance-uuid",
      "lastSeenInstanceId": "instance-uuid",
      "source": "invicti-dast-scanner",
      "system": "invicti-dast-scanner",
      "dast": {
        "url": "http://aspnet.testinvicti.com/",
        "method": null,
        "parameter": ""
      },
      "tags": ["production"],
      "affectedTechnology": {}
    }
  ],
  "pageInfo": {
    "totalCount": 1,
    "pageSize": 10,
    "currentPage": 1,
    "totalPages": 1
  }
}

Understanding vulnerability response fields

The vulnerabilities response includes several fields that identify the vulnerability at different levels. Here's what each represents:

Field	Description
typeId	External vulnerability type identifier from the scanner (Acunetix, Mend, etc.). For example, sql-injection or a scanner-specific classification code.
vulnerabilityTypeId	Internal inventory UUID that groups vulnerabilities under a single type. Derived from typeId.
signature	Instance-level fingerprint that deduplicates the same vulnerability across multiple scans on the same asset. If you see the same signature on a subsequent scan, it's the same finding.
originId	The asset's identifier in the external scanning service. This bridges your internal inventory asset to its counterpart in the scanner system. Use this to correlate assets across different systems.

Date range filtering

Use firstSeen and lastSeen together with firstSeenOperator and lastSeenOperator to filter vulnerabilities by date range.

Bulk update vulnerability status

Use this to update the status of multiple vulnerabilities at once, for example to mark a batch as accepted risk or confirmed fixed.

View bulk update vulnerability status example

Endpoint: PATCH /api/inventory/v1/vulnerabilities

Try it in Swagger UI:

1. Expand Vulnerabilities and select PATCH /api/inventory/v1/vulnerabilities.
2. Click Try it out.
3. Enter a request body with the vulnerability IDs and the target status:

{
  "ids": [
    "string",
    "string"
  ],
  "newStatus": "fixed"
}

4. Click Execute.

A successful response returns HTTP 200.

Supported newStatus values:

Value	Description
open	Vulnerability is active and unresolved.
fixed	Vulnerability has been remediated and confirmed fixed.
fixedUnconfirmed	Marked as fixed but not yet verified by a scan.
falsePositive	Identified as a false positive finding.
ignored	Acknowledged but not being actioned.
reDiscovered	Previously fixed vulnerability detected again in a subsequent scan. Typically assigned by the platform automatically.
notChecked	Set during a retest when the vulnerability was not part of the retest scope. Distinct from notFound — indicates the vulnerability was not evaluated, not that it wasn't found.
notFound	Set when a previously known vulnerability is absent from a completed scan result. The platform does not immediately mark it as fixed because the scan scope may differ or the target may have been temporarily unavailable. If notFound appears in 2 of the last 3 scan tracks, the vulnerability automatically transitions to fixed.

note

You can retrieve vulnerability IDs using GET /api/inventory/v1/vulnerabilities.

List collections

Use this to retrieve all collections in your organization. Collections group applications by business unit, team, region, or other criteria.

View list collections example

Endpoint: GET /api/inventory/v1/collections

Try it in Swagger UI:

1. Expand Collections and select GET /api/inventory/v1/collections.
2. Click Try it out.
3. Set pageSize and pageNumber to control pagination.
4. Click Execute.

Example response:

{
  "items": [
    {
      "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
      "organizationId": "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy",
      "name": "Finance Systems",
      "description": "All financial processing applications",
      "collectionType": "BusinessUnit",
      "tags": ["finance", "pci-dss"],
      "createdAt": "2025-11-01T09:00:00Z",
      "updatedAt": "2025-11-20T15:30:00Z"
    }
  ],
  "pageInfo": {
    "totalCount": 8,
    "pageSize": 10,
    "currentPage": 1,
    "totalPages": 1
  }
}

Supported collectionType values: BusinessUnit, ProductFamily, Region, Team, Other

Export data

Use this to export vulnerability or asset data as a file for reporting or external processing.

View export data example

Endpoint: POST /api/inventory/v1/export

Try it in Swagger UI:

1. Expand Export and select POST /api/inventory/v1/export.
2. Click Try it out.
3. Specify the data you want to export and the format in the request body.
4. Click Execute.
5. The response returns a binary file. Click Download in Swagger UI to save it.

---

Need help?

The Support team is ready to provide you with technical help. Go to Help Center