> ## Documentation Index > Fetch the complete documentation index at: https://developer.vanta.com/llms.txt > Use this file to discover all available pages before exploring further. # List vendor security incident alerts > Returns a paginated list of security incident alerts that affect your vendors. Requires continuous monitoring. ## OpenAPI ````yaml /reference/manage-vanta.json get /vendor-security-incident-alerts openapi: 3.0.0 info: title: Manage Vanta version: 1.0.0 description: >- The REST API lets customers query and mutate Vanta's data. Use this API to automate bulk actions, query data for custom workflows and dashboards, and bolster your security operations **Note for Vanta Gov (FedRAMP) customers:** Select `Vanta Gov (FedRAMP)` from the server dropdown to issue requests against `https://api.vanta-gov.com`. The OAuth token URL shown below defaults to the commercial host — replace it with `https://api.vanta-gov.com/oauth/token`. termsOfService: https://www.vanta.com/terms license: name: UNLICENSED contact: name: API Support url: https://help.vanta.com/ email: support@vanta.com servers: - url: https://api.vanta.com/v1 description: Vanta (Commercial) - url: https://api.vanta-gov.com/v1 description: Vanta Gov (FedRAMP) security: [] paths: /vendor-security-incident-alerts: get: tags: - Vendor Security Incident Alerts summary: List vendor security incident alerts description: >- Returns a paginated list of security incident alerts that affect your vendors. Requires continuous monitoring. operationId: ListVendorSecurityIncidentAlerts parameters: - in: query name: pageSize required: false schema: $ref: '#/components/schemas/PageSize' - in: query name: pageCursor required: false schema: $ref: '#/components/schemas/PageCursor' - description: Case-insensitive search on alert title and affected vendor name. in: query name: q required: false schema: type: string - description: Organization vendor IDs. in: query name: vendorIdMatchesAny required: false schema: type: array items: type: string minItems: 1 maxItems: 20 - description: >- Filter by resolution state. Returns alerts matching any of the specified states. in: query name: resolutionStateMatchesAny required: false schema: type: array items: $ref: '#/components/schemas/VendorSecurityIncidentAlertResolutionState' minItems: 1 - description: >- Filter by incident confirmation status. Returns alerts matching any of the specified statuses. in: query name: confirmationStatusMatchesAny required: false schema: type: array items: $ref: '#/components/schemas/VendorSecurityIncidentAlertStatus' minItems: 1 - description: >- Filter by overall impact severity. Returns alerts matching any of the specified severities. in: query name: impactSeverityMatchesAny required: false schema: type: array items: $ref: '#/components/schemas/VendorSecurityIncidentAlertImpactSeverity' minItems: 1 - description: >- Matches a DATA_LEAK consequence's severity, independently of overall impact. in: query name: dataLeakSeverityMatchesAny required: false schema: type: array items: $ref: '#/components/schemas/VendorSecurityIncidentAlertImpactSeverity' minItems: 1 - in: query name: sort required: false schema: type: string enum: - creationDate - impactSeverity - resolutionState - confirmationStatus default: creationDate - description: >- Ascending means oldest first, highest impact first (CRITICAL to LOW to UNSPECIFIED), OPEN before RESOLVED, or CONFIRMED before SUSPECTED before POTENTIAL. Descending reverses each order. in: query name: direction required: false schema: default: desc type: string enum: - asc - desc responses: '200': description: Ok content: application/json: schema: $ref: >- #/components/schemas/PaginatedResponse_VendorSecurityIncidentAlert_ security: - bearerAuth: [] components: schemas: PageSize: type: integer format: int32 default: 10 description: >- Controls the maximum number of items returned in one response from the API. minimum: 1 maximum: 100 PageCursor: type: string description: >- A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset. Note that the requested page will not include the item that corresponds to this cursor but will start from the one immediately after this cursor. VendorSecurityIncidentAlertResolutionState: type: string enum: - OPEN - RESOLVED VendorSecurityIncidentAlertStatus: type: string enum: - POTENTIAL - CONFIRMED - SUSPECTED VendorSecurityIncidentAlertImpactSeverity: type: string enum: - UNSPECIFIED - CRITICAL - HIGH - MEDIUM - LOW PaginatedResponse_VendorSecurityIncidentAlert_: properties: results: properties: data: items: $ref: '#/components/schemas/VendorSecurityIncidentAlert' type: array pageInfo: $ref: '#/components/schemas/PageInfo' required: - data - pageInfo type: object required: - results type: object additionalProperties: false VendorSecurityIncidentAlert: properties: id: type: string description: Organization-specific alert ID. resolutionState: $ref: '#/components/schemas/VendorSecurityIncidentAlertResolutionState' createdAt: type: string format: date-time updatedAt: type: string format: date-time affectedVendorIds: items: type: string type: array relatedVendorIds: items: type: string type: array status: $ref: '#/components/schemas/VendorSecurityIncidentAlertStatus' title: type: string rootCause: $ref: '#/components/schemas/VendorSecurityIncidentAlertRootCause' threatActor: $ref: '#/components/schemas/VendorSecurityIncidentAlertThreatActor' evidence: items: $ref: '#/components/schemas/VendorSecurityIncidentAlertPublicUrlEvidence' type: array impact: $ref: '#/components/schemas/VendorSecurityIncidentAlertImpact' timeline: items: $ref: '#/components/schemas/VendorSecurityIncidentAlertTimelineEvent' type: array required: - id - resolutionState - createdAt - updatedAt - affectedVendorIds - relatedVendorIds - status - title - rootCause - threatActor - evidence - impact - timeline type: object additionalProperties: false PageInfo: description: Provides information about the pagination of a dataset. properties: endCursor: type: string nullable: true description: >- The cursor that points to the end of the current page, or null if there is no such cursor. hasNextPage: type: boolean description: Indicates if there is another page after the current page. hasPreviousPage: type: boolean description: Indicates if there is a page before the current page. startCursor: type: string nullable: true description: >- The cursor that points to the start of the current page, or null if there is no such cursor. required: - endCursor - hasNextPage - hasPreviousPage - startCursor type: object additionalProperties: false VendorSecurityIncidentAlertRootCause: type: string enum: - UNSPECIFIED - PHISHING - COMPROMISED_CREDENTIALS - VENDOR_PARTNER_COMPROMISE - ZERO_DAY_VULNERABILITY - KNOWN_VULNERABILITY - MISCONFIGURATION - INSIDER_THREAT - DDOS_ATTACK - PHYSICAL_ACCESS - PUBLICLY_EXPOSED_SENSITIVE_INTERFACE - NOT_DISCLOSED VendorSecurityIncidentAlertThreatActor: properties: name: type: string required: - name type: object additionalProperties: false VendorSecurityIncidentAlertPublicUrlEvidence: properties: id: type: string type: type: string enum: - PUBLIC_URL_EVIDENCE nullable: false contentCategory: $ref: >- #/components/schemas/VendorSecurityIncidentAlertEvidenceContentCategory url: type: string required: - id - type - contentCategory - url type: object additionalProperties: false VendorSecurityIncidentAlertImpact: properties: severity: $ref: '#/components/schemas/VendorSecurityIncidentAlertImpactSeverity' context: type: string affectedParties: items: $ref: '#/components/schemas/VendorSecurityIncidentAlertAffectedParty' type: array dataLeakStatus: $ref: '#/components/schemas/VendorSecurityIncidentAlertDataLeakStatus' consequences: items: $ref: '#/components/schemas/VendorSecurityIncidentAlertConsequence' type: array required: - severity - context - affectedParties - dataLeakStatus - consequences type: object additionalProperties: false VendorSecurityIncidentAlertTimelineEvent: properties: type: $ref: '#/components/schemas/VendorSecurityIncidentAlertTimelineEventType' occurredAt: type: string format: date-time required: - type - occurredAt type: object additionalProperties: false VendorSecurityIncidentAlertEvidenceContentCategory: type: string enum: - SEC - LEGAL - DATA_BREACH - GENERAL - EVIDENCE_OF_COMPROMISE - CLAIM_POST - PACKAGE_REGISTRY_PAGE - REGULATORY_FILING - VENDOR_NOTES - PUBLIC_NEWS_DISCUSSION VendorSecurityIncidentAlertAffectedParty: type: string enum: - CUSTOMERS - EMPLOYEES - THIRD_PARTIES - MIXED - UNKNOWN VendorSecurityIncidentAlertDataLeakStatus: type: string enum: - UNSPECIFIED - UNKNOWN - OBSERVED - CONFIRMED VendorSecurityIncidentAlertConsequence: anyOf: - $ref: >- #/components/schemas/VendorSecurityIncidentAlertDenialOfServiceConsequence - $ref: >- #/components/schemas/VendorSecurityIncidentAlertUnauthorizedAccessConsequence - $ref: '#/components/schemas/VendorSecurityIncidentAlertDataLeakConsequence' VendorSecurityIncidentAlertTimelineEventType: type: string enum: - INITIAL_ACCESS - HACKER_DISCLOSURE - INCIDENT_DETECTION - DATA_BREACH_NOTIFICATION - SEC_FILING - LAWSUIT_FILING VendorSecurityIncidentAlertDenialOfServiceConsequence: title: VendorSecurityIncidentAlertDenialOfServiceConsequence properties: type: type: string enum: - DENIAL_OF_SERVICE nullable: false required: - type type: object additionalProperties: false VendorSecurityIncidentAlertUnauthorizedAccessConsequence: title: VendorSecurityIncidentAlertUnauthorizedAccessConsequence properties: type: type: string enum: - UNAUTHORIZED_ACCESS nullable: false required: - type type: object additionalProperties: false VendorSecurityIncidentAlertDataLeakConsequence: title: VendorSecurityIncidentAlertDataLeakConsequence properties: type: type: string enum: - DATA_LEAK nullable: false dataCategories: items: $ref: '#/components/schemas/VendorSecurityIncidentAlertDataCategory' type: array severity: $ref: '#/components/schemas/VendorSecurityIncidentAlertDataLeakSeverity' required: - type - dataCategories - severity type: object additionalProperties: false VendorSecurityIncidentAlertDataCategory: type: string enum: - PII - PHI - FINANCIAL - CREDENTIALS - INTELLECTUAL_PROPERTY VendorSecurityIncidentAlertDataLeakSeverity: type: string enum: - UNSPECIFIED - CRITICAL - HIGH - MEDIUM - LOW securitySchemes: bearerAuth: type: http scheme: bearer ```` ## Related topics - [Update vendor security incident alerts](https://developer.vanta.com/api-reference/vendor-security-incident-alerts/update-vendor-security-incident-alerts.md) - [Get vendor security incident alert by ID](https://developer.vanta.com/api-reference/vendor-security-incident-alerts/get-vendor-security-incident-alert-by-id.md) - [List vendor alerts](https://developer.vanta.com/api-reference/vendor-alerts/list-vendor-alerts.md) - [List security reviews by vendor ID](https://developer.vanta.com/api-reference/vendors/list-security-reviews-by-vendor-id.md) - [Create vendors with evidence](https://developer.vanta.com/docs/guides/create-vendors-and-attach-documentation.md)