vulnerabilityDisclosureSubmissions

Lists VDR submissions in the company's inbox

vulnerabilityDisclosureSubmissions(
  companyId: Int!
  trustCenterId: Int
  statuses: [String!]
  search: String
  limit: Int
): [VulnerabilityDisclosureSubmission!]!

Arguments

vulnerabilityDisclosureSubmissions.companyId ● Int! non-null scalar

vulnerabilityDisclosureSubmissions.trustCenterId ● Int scalar

Restrict the inbox to the reports submitted through one Trust Center page.

vulnerabilityDisclosureSubmissions.statuses ● [String!] list scalar

Filter by status. Accepts: pending_verification, submitted, triaging, accepted, duplicate, invalid, resolved. Default: submitted + triaging.

vulnerabilityDisclosureSubmissions.search ● String scalar

vulnerabilityDisclosureSubmissions.limit ● Int scalar

Type

VulnerabilityDisclosureSubmission object

A vulnerability disclosure report received from an external researcher. Carries third-party PII (researcherEmail, reporterIp): reading it requires vulnerability_read plus a grant on the owning company or on the FQDN asset of the Trust Center the report came in through. Not gated on an admin flag — see Trust::DisclosureSubmissionPolicy.

Example request

This generated query uses placeholders for required values. Replace them with values available to your API key before running it.

Before you run it

Run the companies query first and use data.companies.collection[].id as companyId.

cURL

curl --request POST https://api.convisoappsec.com/graphql \
  --header "x-api-key: $CONVISO_API_KEY" \
  --header "content-type: application/json" \
  --data '{"query":"query GetVulnerabilityDisclosureSubmissions($companyId: Int!) {\n  vulnerabilityDisclosureSubmissions(companyId: $companyId) { id title status }\n}","variables":{"companyId":1}}'

JavaScript

const response = await fetch('https://api.convisoappsec.com/graphql', {
  method: 'POST',
  headers: {
    'content-type': 'application/json',
    'x-api-key': process.env.CONVISO_API_KEY,
  },
  body: JSON.stringify({
    query: "query GetVulnerabilityDisclosureSubmissions($companyId: Int!) {\n  vulnerabilityDisclosureSubmissions(companyId: $companyId) { id title status }\n}",
    variables: {
    "companyId": 1
},
  }),
});

const { data, errors } = await response.json();

if (errors) throw new Error(errors.map(({ message }) => message).join(', '));
console.log(data);

Python

import json
import os
import requests

response = requests.post(
    'https://api.convisoappsec.com/graphql',
    headers={
        'content-type': 'application/json',
        'x-api-key': os.environ['CONVISO_API_KEY'],
    },
    json={
        'query': "query GetVulnerabilityDisclosureSubmissions($companyId: Int!) {\n  vulnerabilityDisclosureSubmissions(companyId: $companyId) { id title status }\n}",
        'variables': json.loads("{\"companyId\":1}"),
    },
    timeout=30,
)
response.raise_for_status()

payload = response.json()
if payload.get('errors'):
    raise RuntimeError(payload['errors'])

print(payload['data'])