Copy the prompt to run this live via the MCP server or have AI generate a runnable script.
{children}
;
export const VULN_ASK = "Using the Vanta MCP server, show me all CRITICAL and HIGH vulnerabilities whose remediation SLA deadline falls within the next 14 days.\n\nFor each one, include the vulnerability name, CVE ID (if available), integration it came from, the affected asset, whether a fix is available, and the exact remediation deadline. Group results by integration.";
export const VULN_BUILD = "Using the Manage Vanta API (base URL https://api.vanta.com), write a Node.js script that:\n\n1. Mints a Vanta API token using the client-credentials flow. Re-mint at the top of every scheduled run (tokens expire after one hour).\n2. Computes two ISO 8601 timestamps for now and now+14 days using new Date().toISOString().\n3. Calls GET /v1/vulnerabilities with pageSize=100, slaDeadlineAfterDate, slaDeadlineBeforeDate, severity=CRITICAL (run a second pass for HIGH), and isFixAvailable=true.\n4. Paginates using results.pageInfo.endCursor until hasNextPage is false.\n5. Filters out items where deactivateMetadata is not null (suppressed vulnerabilities).\n6. Groups results by integrationId and prints: severity, name, remediateByDate, packageIdentifier, fixedVersion, externalURL.\n7. Prints a summary: total count, breakdown by severity and integration.\n\nError handling:\n- 401: re-mint and retry once.\n- 400 on date params: timestamps must be full ISO 8601 with timezone.\n- 5xx: retry with 2s exponential back-off, max 3 attempts.\n\nScope required: vanta-api.all:read.";
This guide queries `GET /v1/vulnerabilities` on the Manage Vanta API for CRITICAL and HIGH vulnerabilities whose remediation SLA deadline falls inside a configurable window — the standard pattern is "next 14 days" so security teams can prioritize fixes before they breach. Use the ask prompt to surface them through the Vanta MCP server, or the build prompt to generate a scheduled job that groups results by integration and skips suppressed vulnerabilities.
## Before you begin
This guide is for Vanta admins managing data inside their own Vanta account.
You'll need:
* A Manage Vanta [API token](/docs/quickstart/manage-vanta).
* The token must have scope `vanta-api.all:read`.
* At least one vulnerability scanner integration connected to Vanta (e.g. Snyk, Qualys, Inspector).
Vanta consolidates scan results from multiple tools into a single view and tracks remediation against the SLAs you've configured. The vulnerabilities endpoint lets you slice that view by SLA window so you can act on what's actually about to breach.
Wiring this into a daily nudge or ticketing automation? Re-mint your token at the top of each run, query `slaDeadlineBeforeDate` set to "today + 14 days", and feed the response into your downstream system.
Decide which vulnerabilities to surface. Most teams use one of:
* **Approaching breach** — `slaDeadlineAfterDate` = now, `slaDeadlineBeforeDate` = now + 7–14 days.
* **Already breached** — `slaDeadlineBeforeDate` = now (with no `slaDeadlineAfterDate`).
* **All vulnerabilities with an SLA** — both params omitted, but `includeVulnerabilitiesWithoutSlas=false`.
Layer in `severity=CRITICAL` (or `HIGH`), `isFixAvailable=true`, and `integrationId=` to narrow further.
```bash Terminal theme={"system"}
# Two-week window: due after today, before today + 14 days
AFTER=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
BEFORE=$(date -u -v+14d +"%Y-%m-%dT%H:%M:%SZ") # GNU date: date -u -d '+14 days' +%Y-%m-%dT%H:%M:%SZ
echo "from $AFTER to $BEFORE"
```
`severity` (`CRITICAL`/`HIGH`/`MEDIUM`/`LOW`), `isFixAvailable`, `integrationId`, `packageIdentifier`, `vulnerableAssetId`, `externalVulnerabilityId`, `q` (free-text search), and `includeVulnerabilitiesWithoutSlas`.
By default the endpoint excludes vulnerabilities that have no `remediateByDate`. Set `includeVulnerabilitiesWithoutSlas=true` to include them — useful if a scanner doesn't emit severities Vanta can map to an SLA.
**Your terminal** — call [`GET /v1/vulnerabilities`](/api-reference/vulnerabilities/get-vulnerabilities) with the SLA window and any extra filters.
```javascript Node.js theme={"system"}
const after = new Date().toISOString();
const before = new Date(Date.now() + 14 * 24 * 60 * 60 * 1000).toISOString();
const url = new URL("https://api.vanta.com/v1/vulnerabilities");
url.searchParams.set("pageSize", "50");
url.searchParams.set("slaDeadlineAfterDate", after);
url.searchParams.set("slaDeadlineBeforeDate", before);
url.searchParams.set("severity", "CRITICAL");
url.searchParams.set("isFixAvailable", "true");
const res = await fetch(url, {
headers: { Authorization: "Bearer YOUR_TOKEN" },
});
const body = await res.json();
for (const vuln of body.results.data) {
console.log(vuln.severity, vuln.name, "due", vuln.remediateByDate);
}
```
```python Python theme={"system"}
from datetime import datetime, timedelta, timezone
import requests
after = datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
before = (datetime.now(timezone.utc) + timedelta(days=14)).isoformat().replace("+00:00", "Z")
r = requests.get(
"https://api.vanta.com/v1/vulnerabilities",
headers={"Authorization": "Bearer YOUR_TOKEN"},
params={
"pageSize": 50,
"slaDeadlineAfterDate": after,
"slaDeadlineBeforeDate": before,
"severity": "CRITICAL",
"isFixAvailable": "true",
},
)
r.raise_for_status()
for vuln in r.json()["results"]["data"]:
print(vuln["severity"], vuln["name"], "due", vuln["remediateByDate"])
```
```bash Terminal theme={"system"}
AFTER=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
BEFORE=$(date -u -v+14d +"%Y-%m-%dT%H:%M:%SZ")
curl --get 'https://api.vanta.com/v1/vulnerabilities' \
--data-urlencode 'pageSize=50' \
--data-urlencode "slaDeadlineAfterDate=$AFTER" \
--data-urlencode "slaDeadlineBeforeDate=$BEFORE" \
--data-urlencode 'severity=CRITICAL' \
--data-urlencode 'isFixAvailable=true' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer YOUR_TOKEN'
```
Expected response (`200`) — paginated vulnerabilities, sorted by `remediateByDate` ascending (most urgent first):
```json theme={"system"}
{
"results": {
"data": [
{
"id": "65f05b5def4a9f04c44e5748",
"name": "CVE-2021-3711",
"description": "Alpine Linux Security Update for OpenSSL",
"integrationId": "qualys",
"packageIdentifier": "libssl1.1:1.1.1g-r0",
"vulnerabilityType": "COMMON",
"targetId": "65f05b57f37f4ffbd87dc20c",
"severity": "CRITICAL",
"cvssSeverityScore": 9.8,
"isFixable": true,
"fixedVersion": "1.1.1n-r0",
"remediateByDate": "2024-04-16T17:14:26.718Z",
"externalURL": "https://qualysguard.qg4.apps.qualys.com/cs/#/...",
"deactivateMetadata": null
}
],
"pageInfo": { "hasNextPage": true, "endCursor": "..." }
}
}
```
Use `targetId` to join back to the affected asset, `externalURL` to deep-link to your scanner, and `remediateByDate` to drive your countdown.
Token is expired (one-hour lifetime), missing, or lacks `vanta-api.all:read`. Mint a fresh one — see [Authentication → Token expiration](/docs/concepts/authentication#token-expiration).
`slaDeadlineAfterDate` and `slaDeadlineBeforeDate` must be ISO 8601 timestamps with timezone (e.g. `2024-04-16T17:14:26.718Z`). Plain dates without time-of-day will be rejected.
Read `results.pageInfo.endCursor` and `hasNextPage`. Re-call with `pageCursor=` until `hasNextPage` is `false`. Don't try to fetch all vulnerabilities in one call — `pageSize` caps at 100.
That vulnerability has been deactivated (suppressed). It still appears in the list but won't impact tests. Filter client-side on `deactivateMetadata == null` if you only want active items.
**Suppressing a known false positive?** Use [`POST /v1/vulnerabilities/deactivate`](/api-reference/vulnerabilities/deactivate-vulnerability-monitoring-for-a-vulnerability) with a reason. Reactivate later with the matching `/reactivate` endpoint.
## Congratulations
You've pulled the canonical list of vulnerabilities approaching their SLA deadline. Wire this into a Slack channel, Jira ticket creator, or PagerDuty schedule so your remediation work happens against actual deadlines instead of a static dashboard.
***
## Next steps
See which tests are failing because of overdue vulnerabilities.
React in real time when a vulnerability is detected, deactivated, or remediated.
Import the collection and run the vulnerability query against a sandbox in seconds.
Browse every Manage Vanta endpoint — vulnerabilities, tests, controls, documents, people.