> ## Documentation Index > Fetch the complete documentation index at: https://developer.vanta.com/llms.txt > Use this file to discover all available pages before exploring further. # List vendor external findings > Lists the security findings continuous monitoring has found on a vendor’s external-facing assets, such as exposed assets and vulnerabilities. When you use pageCursor, keep the filters and sorting the same as in your previous request. Requires continuous monitoring. ## OpenAPI ````yaml /reference/manage-vanta.json get /vendors/{vendorId}/external-findings openapi: 3.0.0 info: title: Manage Vanta version: 1.0.0 description: >- The REST API lets customers query and mutate Vanta's data. Use this API to automate bulk actions, query data for custom workflows and dashboards, and bolster your security operations **Note for Vanta Gov (FedRAMP) customers:** Select `Vanta Gov (FedRAMP)` from the server dropdown to issue requests against `https://api.vanta-gov.com`. The OAuth token URL shown below defaults to the commercial host — replace it with `https://api.vanta-gov.com/oauth/token`. termsOfService: https://www.vanta.com/terms license: name: UNLICENSED contact: name: API Support url: https://help.vanta.com/ email: support@vanta.com servers: - url: https://api.vanta.com/v1 description: Vanta (Commercial) - url: https://api.vanta-gov.com/v1 description: Vanta Gov (FedRAMP) security: [] paths: /vendors/{vendorId}/external-findings: get: tags: - Vendors summary: List vendor external findings description: >- Lists the security findings continuous monitoring has found on a vendor’s external-facing assets, such as exposed assets and vulnerabilities. When you use pageCursor, keep the filters and sorting the same as in your previous request. Requires continuous monitoring. operationId: ListVendorExternalFindings parameters: - description: Unique identifier of the vendor. in: path name: vendorId required: true schema: type: string - in: query name: pageSize required: false schema: $ref: '#/components/schemas/PageSize' - in: query name: pageCursor required: false schema: $ref: '#/components/schemas/PageCursor' - description: Search finding titles and descriptions. in: query name: q required: false schema: type: string - description: 'Match any specified severity. Omitted: all except INFO.' in: query name: severityMatchesAny required: false schema: type: array items: type: string enum: - CRITICAL - HIGH - MEDIUM - LOW - INFO minItems: 1 - description: 'Match any specified status. Omitted: both statuses.' in: query name: statusMatchesAny required: false schema: type: array items: type: string enum: - ACTIVE - RESOLVED minItems: 1 - description: >- Match any specified monitoring category, exactly and case-sensitively. Omitted: all categories. in: query name: categoryMatchesAny required: false schema: type: array items: type: string enum: - Application security - Exposed application user interfaces - Exposed services - Exposed & leaked sensitive information - End of life & outdated applications - Sensitive interfaces exposure - Threat intelligence - Trust - Vulnerabilities - Vulnerable misconfigurations minItems: 1 - description: >- Inclusive ISO 8601 first-seen lower bound. Supply both date bounds with start no later than end. in: query name: firstSeenStartDate required: false schema: type: string - description: >- Inclusive ISO 8601 first-seen upper bound. Supply both date bounds with start no later than end. in: query name: firstSeenEndDate required: false schema: type: string - in: query name: sort required: false schema: type: string enum: - firstSeenDate - severity - title default: firstSeenDate - description: >- Ascending means oldest first, highest severity first (CRITICAL to INFO), or title A to Z. Descending reverses each order, matching security incident alerts' severity convention. in: query name: direction required: false schema: default: desc type: string enum: - asc - desc responses: '200': description: Ok content: application/json: schema: $ref: '#/components/schemas/PaginatedResponse_VendorExternalFinding_' security: - bearerAuth: [] components: schemas: PageSize: type: integer format: int32 default: 10 description: >- Controls the maximum number of items returned in one response from the API. minimum: 1 maximum: 100 PageCursor: type: string description: >- A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset. Note that the requested page will not include the item that corresponds to this cursor but will start from the one immediately after this cursor. PaginatedResponse_VendorExternalFinding_: properties: results: properties: data: items: $ref: '#/components/schemas/VendorExternalFinding' type: array pageInfo: $ref: '#/components/schemas/PageInfo' required: - data - pageInfo type: object required: - results type: object additionalProperties: false VendorExternalFinding: properties: id: type: string description: Unique identifier of the external finding. vendorId: type: string description: Unique identifier of the vendor in your organization. title: type: string description: type: string severity: type: string enum: - CRITICAL - HIGH - MEDIUM - LOW - INFO severityReason: type: string nullable: true status: type: string enum: - ACTIVE - RESOLVED category: type: string description: Security category, such as Vulnerabilities or Exposed services. type: type: string enum: - GENERAL - CVE - LEAKED_CREDENTIALS source: type: string nullable: true firstSeenDate: type: string format: date-time description: Date and time the finding was first seen, in ISO 8601 format. lastSeenDate: type: string format: date-time description: Date and time the finding was last seen, in ISO 8601 format. appearances: type: number format: double remediationGuidance: type: string nullable: true riskContext: type: string nullable: true cveMetadata: allOf: - $ref: '#/components/schemas/VendorExternalFindingCveMetadata' nullable: true required: - id - vendorId - title - description - severity - severityReason - status - category - type - source - firstSeenDate - lastSeenDate - appearances - remediationGuidance - riskContext - cveMetadata type: object additionalProperties: false PageInfo: description: Provides information about the pagination of a dataset. properties: endCursor: type: string nullable: true description: >- The cursor that points to the end of the current page, or null if there is no such cursor. hasNextPage: type: boolean description: Indicates if there is another page after the current page. hasPreviousPage: type: boolean description: Indicates if there is a page before the current page. startCursor: type: string nullable: true description: >- The cursor that points to the start of the current page, or null if there is no such cursor. required: - endCursor - hasNextPage - hasPreviousPage - startCursor type: object additionalProperties: false VendorExternalFindingCveMetadata: properties: cvssScore: type: number format: double nullable: true epssScore: type: string nullable: true publishedDate: type: string format: date-time nullable: true nvdUrl: type: string nullable: true required: - cvssScore - epssScore - publishedDate - nvdUrl type: object additionalProperties: false securitySchemes: bearerAuth: type: http scheme: bearer ```` ## Related topics - [Get vendor external finding](https://developer.vanta.com/api-reference/vendors/get-vendor-external-finding.md) - [List vendor findings](https://developer.vanta.com/api-reference/vendors/list-vendor-findings.md) - [List vendor findings mapped to a risk scenario](https://developer.vanta.com/api-reference/risk-scenarios/list-vendor-findings-mapped-to-a-risk-scenario.md) - [Update vendor finding](https://developer.vanta.com/api-reference/vendors/update-vendor-finding.md) - [Add a vendor finding](https://developer.vanta.com/api-reference/vendors/add-a-vendor-finding.md)