> ## Documentation Index > Fetch the complete documentation index at: https://developer.vanta.com/llms.txt > Use this file to discover all available pages before exploring further. # List vendor alerts > Retrieves vendor alerts in your organization, such as CVEs, leaked credentials, and exposed assets. Doesn't return security incident alerts. Filters combine across fields; values within each filter match any value. Requires vendor read access and continuous monitoring enabled for your organization. ## OpenAPI ````yaml /reference/manage-vanta.json get /vendor-alerts openapi: 3.0.0 info: title: Manage Vanta version: 1.0.0 description: >- The REST API lets customers query and mutate Vanta's data. Use this API to automate bulk actions, query data for custom workflows and dashboards, and bolster your security operations **Note for Vanta Gov (FedRAMP) customers:** Select `Vanta Gov (FedRAMP)` from the server dropdown to issue requests against `https://api.vanta-gov.com`. The OAuth token URL shown below defaults to the commercial host — replace it with `https://api.vanta-gov.com/oauth/token`. termsOfService: https://www.vanta.com/terms license: name: UNLICENSED contact: name: API Support url: https://help.vanta.com/ email: support@vanta.com servers: - url: https://api.vanta.com/v1 description: Vanta (Commercial) - url: https://api.vanta-gov.com/v1 description: Vanta Gov (FedRAMP) security: [] paths: /vendor-alerts: get: tags: - Vendor Alerts summary: List vendor alerts description: >- Retrieves vendor alerts in your organization, such as CVEs, leaked credentials, and exposed assets. Doesn't return security incident alerts. Filters combine across fields; values within each filter match any value. Requires vendor read access and continuous monitoring enabled for your organization. operationId: ListVendorAlerts parameters: - in: query name: pageSize required: false schema: $ref: '#/components/schemas/PageSize' - in: query name: pageCursor required: false schema: $ref: '#/components/schemas/PageCursor' - description: Search alert titles and vendor names. in: query name: search required: false schema: type: string - description: Filter to alerts matching any of the provided statuses. in: query name: statusMatchesAny required: false schema: type: array items: $ref: '#/components/schemas/VendorAlertStatus' example: - OPEN - ESCALATED - description: Filter to alerts matching any of the provided severities. in: query name: severityMatchesAny required: false schema: type: array items: $ref: '#/components/schemas/VendorAlertSeverity' example: - HIGH - CRITICAL - description: Filter to alerts matching any of the provided security categories. in: query name: categoryMatchesAny required: false schema: items: type: string type: array example: - Vulnerabilities - description: Filter to alerts matching any of the provided types. in: query name: typeMatchesAny required: false schema: type: array items: $ref: '#/components/schemas/VendorAlertType' example: - CVE - description: >- Filter to alerts whose vendors match any of the provided inherent risk levels. in: query name: vendorRiskLevelMatchesAny required: false schema: type: array items: type: string enum: - CRITICAL - HIGH - MEDIUM - LOW - UNSCORED example: - HIGH - description: Field to sort results by. Defaults to severity. in: query name: orderBy required: false schema: default: severity type: string enum: - severity - status - creationDate example: creationDate - description: Direction to sort results in. Defaults to descending. in: query name: orderDirection required: false schema: default: desc type: string enum: - asc - desc example: desc responses: '200': description: Ok content: application/json: schema: $ref: '#/components/schemas/PaginatedResponse_VendorAlert_' examples: Example 1: value: results: data: - id: 68f620000000000000000001 vendorId: 68f620000000000000000002 title: Exposed service detected description: A service is publicly accessible. severity: HIGH status: OPEN category: Exposed services type: GENERAL source: external attack surface scanning creationDate: '2026-10-20T12:00:00.000Z' updatedDate: '2026-10-20T12:00:00.000Z' pageInfo: startCursor: null endCursor: null hasNextPage: false hasPreviousPage: false security: - bearerAuth: [] components: schemas: PageSize: type: integer format: int32 default: 10 description: >- Controls the maximum number of items returned in one response from the API. minimum: 1 maximum: 100 PageCursor: type: string description: >- A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset. Note that the requested page will not include the item that corresponds to this cursor but will start from the one immediately after this cursor. VendorAlertStatus: type: string enum: - OPEN - ESCALATED - RESOLVED - NOT_RELEVANT - AUTO_RESOLVED VendorAlertSeverity: type: string enum: - CRITICAL - HIGH - MEDIUM - LOW VendorAlertType: type: string enum: - GENERAL - CVE - LEAKED_CREDENTIALS PaginatedResponse_VendorAlert_: properties: results: properties: data: items: $ref: '#/components/schemas/VendorAlert' type: array pageInfo: $ref: '#/components/schemas/PageInfo' required: - data - pageInfo type: object required: - results type: object additionalProperties: false VendorAlert: properties: id: type: string description: Unique identifier of the vendor alert. vendorId: type: string description: Unique identifier of the vendor associated with the alert. title: type: string description: Title of the monitoring finding that triggered the alert. description: type: string description: Details of the monitoring finding that triggered the alert. severity: $ref: '#/components/schemas/VendorAlertSeverity' description: Severity of the monitoring finding. status: $ref: '#/components/schemas/VendorAlertStatus' description: |- Current alert status. AUTO_RESOLVED indicates automatic resolution; NOT_RELEVANT indicates the alert was marked as not relevant. category: type: string description: Security category, such as Vulnerabilities or Application security. type: $ref: '#/components/schemas/VendorAlertType' description: 'Type of monitoring finding: general, CVE, or leaked credentials.' source: type: string nullable: true description: Source of the monitoring finding, or null when unavailable. creationDate: type: string format: date-time description: Date and time the alert was created, in ISO 8601 format. updatedDate: type: string format: date-time description: Date and time the alert was last updated, in ISO 8601 format. required: - id - vendorId - title - description - severity - status - category - type - source - creationDate - updatedDate type: object additionalProperties: false PageInfo: description: Provides information about the pagination of a dataset. properties: endCursor: type: string nullable: true description: >- The cursor that points to the end of the current page, or null if there is no such cursor. hasNextPage: type: boolean description: Indicates if there is another page after the current page. hasPreviousPage: type: boolean description: Indicates if there is a page before the current page. startCursor: type: string nullable: true description: >- The cursor that points to the start of the current page, or null if there is no such cursor. required: - endCursor - hasNextPage - hasPreviousPage - startCursor type: object additionalProperties: false securitySchemes: bearerAuth: type: http scheme: bearer ```` ## Related topics - [List vendor security incident alerts](https://developer.vanta.com/api-reference/vendor-security-incident-alerts/list-vendor-security-incident-alerts.md) - [Get vendor alert](https://developer.vanta.com/api-reference/vendor-alerts/get-vendor-alert.md) - [Update vendor alerts](https://developer.vanta.com/api-reference/vendor-alerts/update-vendor-alerts.md) - [Update vendor security incident alerts](https://developer.vanta.com/api-reference/vendor-security-incident-alerts/update-vendor-security-incident-alerts.md) - [Get vendor alert settings](https://developer.vanta.com/api-reference/vendor-alert-settings/get-vendor-alert-settings.md)