> ## Documentation Index > Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get imported cluster stack security posture ## OpenAPI ````yaml https://platform.ankra.app/openapi.json get /org/clusters/imported/{cluster_id}/stacks/{stack_name}/security openapi: 3.1.0 info: title: FastAPI version: 0.1.0 servers: - url: https://platform.ankra.app security: [] tags: - name: Clusters description: Create, inspect and manage clusters, and the stacks deployed on them. - name: Managed Clusters description: Provider-managed control planes, driven through one common surface. - name: Imported Clusters description: Clusters that already existed and were connected to Ankra. - name: Cluster Access description: Kubeconfigs, service-account tokens and per-cluster access grants. - name: Kubernetes description: Read and act on the Kubernetes objects inside a cluster. - name: DigitalOcean Clusters description: Provision and manage DigitalOcean Kubernetes clusters. - name: Hetzner Clusters description: Provision and manage Hetzner Kubernetes clusters. - name: OVH Clusters description: Provision and manage OVH Kubernetes clusters. - name: Scaleway Clusters description: Provision and manage Scaleway Kapsule clusters. - name: UpCloud Clusters description: Provision and manage UpCloud Kubernetes clusters. - name: Applications description: Deploy, configure and observe applications across the fleet. - name: Stack Profiles description: Reusable stack definitions, their versions and sharing. - name: Charts description: Browse the chart catalogue behind stacks and addons. - name: Helm description: Helm registries, credentials and the charts they expose. - name: Executions description: Long-running platform executions and their jobs. - name: Operations description: Cancel in-flight cluster operations and their jobs. - name: Chat description: Conversational sessions, plans and confirmable actions. - name: AI Agent Runs description: Autonomous agent runs and their outcomes. - name: AI Tickets description: The AI ticket board, its sync connections and settings. - name: AI Playbooks description: Reusable playbooks the AI lanes execute. - name: AI Conditions description: Conditions that gate AI autonomy. - name: AI Engineering Handoffs description: Work the AI lanes escalate to a human engineer. - name: AI Environment description: The environment and base stacks AI demos deploy into. - name: Security description: Findings, advisories, SBOMs, compliance and posture. - name: Cost description: Cluster and fleet cost, rate cards and cost settings. - name: Billing description: Subscription and spend caps. - name: Organisation description: Members, invitations, audit logs and organisation settings. - name: Account Tokens description: Personal access tokens for the API and CLI. - name: Credentials description: The shared credential store. - name: Azure Credentials description: Azure credentials and SSH keys. - name: DigitalOcean Credentials description: DigitalOcean credentials and SSH keys. - name: Hetzner Credentials description: Hetzner credentials and SSH keys. - name: OVH Credentials description: OVH credentials and SSH keys. - name: Scaleway Credentials description: Scaleway credentials. - name: UpCloud Credentials description: UpCloud credentials and SSH keys. - name: Data Source Credentials description: Credentials for metrics and log sources. - name: DNS Credentials description: Credentials for DNS providers. - name: DNS description: DNS zones and records, including custom organisation zones. - name: Cloudflare description: Cloudflare domains and the credentials behind them. - name: Variables description: Organisation- and cluster-scoped variables. - name: SOPS description: Encrypt and decrypt values with the organisation SOPS config. - name: Alerts description: Alert integrations and ingest credentials. - name: Notifications description: Notification routes and their delivery targets. - name: Support description: Support tickets. paths: /org/clusters/imported/{cluster_id}/stacks/{stack_name}/security: get: tags: - Security summary: Get imported cluster stack security posture operationId: get_imported_cluster_stack_security parameters: - in: path name: cluster_id required: true schema: format: uuid type: string - in: path name: stack_name required: true schema: type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/SecurityStackSecurityResponse' description: Successful response '400': content: application/json: schema: $ref: '#/components/schemas/SecurityDetailError' description: Business validation error '403': content: application/json: schema: $ref: '#/components/schemas/SecurityPermissionDenied' description: Permission denied '404': content: application/json: schema: $ref: '#/components/schemas/SecurityDetailError' description: Cluster or stack is not in the active organization '422': content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' description: Request validation error '500': content: application/json: schema: $ref: '#/components/schemas/SecurityDetailError' description: Internal server error components: schemas: SecurityStackSecurityResponse: properties: status: description: >- connected: the figures describe scanned workloads. stale: the newest report is older than the scanner's freshness window. no_reports: workloads were attributed but none carries a report or a bill of materials yet. unmatched: no member resolved to an object in the resource cache. unscanned: the scanner has never reported on this cluster. empty: the stack has no add-on or manifest members. enum: - connected - stale - no_reports - unmatched - unscanned - empty type: string cluster_id: format: uuid type: string stack_name: type: string stack_resource_id: format: uuid type: string scanner: $ref: '#/components/schemas/SecurityScannerSummary' intelligence: $ref: '#/components/schemas/SecurityIntelligenceStatus' scope: $ref: '#/components/schemas/SecurityStackSecurityScope' findings: $ref: '#/components/schemas/SecurityStackSecurityFindings' known_exploited: description: >- Every actionable finding of the stack listed in the CISA KEV catalog, earliest remediation due date first (capped at 50; the findings list with known_exploited=true carries the rest). items: $ref: '#/components/schemas/SecurityRemediationCandidate' type: array top_actionable_findings: description: >- The actionable findings to fix first: CISA-listed, then by severity, then fixable ones (capped at 8). items: $ref: '#/components/schemas/SecurityRemediationCandidate' type: array sbom: $ref: '#/components/schemas/SecurityStackSecuritySbom' members: items: $ref: '#/components/schemas/SecurityStackSecurityMember' type: array required: - status - cluster_id - stack_name - stack_resource_id - scanner - intelligence - scope - findings - known_exploited - top_actionable_findings - sbom - members title: SecurityStackSecurityResponse type: object description: >- The security summary of one stack of an imported cluster: CVEs, CISA-listed exploited vulnerabilities and bills of materials across every workload its add-ons and manifests deploy. SecurityDetailError: properties: detail: type: string required: - detail type: object SecurityPermissionDenied: properties: detail: enum: - permission_denied type: string permission: type: string scope_type: type: string required: - detail - permission - scope_type type: object HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' title: Detail type: array title: HTTPValidationError type: object SecurityScannerSummary: properties: fresh_clusters: type: integer last_scan: anyOf: - format: date-time type: string - type: 'null' stale_after_seconds: type: integer stale_clusters: type: integer status: enum: - fresh - degraded - stale - unscanned type: string unscanned_clusters: type: integer required: - status - last_scan - fresh_clusters - stale_clusters - unscanned_clusters - stale_after_seconds type: object SecurityIntelligenceStatus: properties: epss_synced_at: anyOf: - format: date-time type: string - type: 'null' kev_listed: type: integer kev_synced_at: anyOf: - format: date-time type: string - type: 'null' required: - kev_synced_at - epss_synced_at - kev_listed type: object SecurityStackSecurityScope: properties: addons: type: integer description: Add-on members of the stack. manifests: type: integer description: Manifest members of the stack. declared_objects: type: integer description: Kubernetes objects the manifest members declare (kind + name). matched_workloads: type: integer description: >- Distinct workload objects in the cluster's resource cache attributed to the stack, owners walked two levels down. Zero means nothing could be attributed, not that nothing runs. unmatched_members: type: integer description: Members that resolved to no cached workload object. required: - addons - manifests - declared_objects - matched_workloads - unmatched_members title: SecurityStackSecurityScope type: object description: How much of the stack the read could attribute to running objects. SecurityStackSecurityFindings: properties: observed: $ref: '#/components/schemas/SecuritySeverityCounts' actionable: $ref: '#/components/schemas/SecuritySeverityCounts' acknowledged: $ref: '#/components/schemas/SecuritySeverityCounts' accepted_risk: $ref: '#/components/schemas/SecuritySeverityCounts' findings: type: integer description: Distinct CVE-package findings behind the occurrences. fixable_severe: type: integer description: Actionable critical and high occurrences with a fixed version. known_exploited: type: integer description: >- Actionable occurrences on a CISA Known Exploited Vulnerabilities entry. known_exploited_findings: type: integer description: Distinct findings behind known_exploited. affected_images: type: integer affected_workloads: type: integer last_scan: anyOf: - format: date-time type: string - type: 'null' required: - observed - actionable - acknowledged - accepted_risk - findings - fixable_severe - known_exploited - known_exploited_findings - affected_images - affected_workloads - last_scan title: SecurityStackSecurityFindings type: object description: >- The CVE posture across the stack's workloads: live, namespaced occurrences only. SecurityRemediationCandidate: properties: actionable_count: type: integer affected_clusters: type: integer affected_workloads: type: integer cve_id: type: string finding_id: format: uuid type: string fixable_occurrences: type: integer last_seen_at: format: date-time type: string package_name: type: string package_type: type: string severity: type: string title: anyOf: - type: string - type: 'null' known_exploited: type: boolean kev_date_added: anyOf: - type: string - type: 'null' kev_due_date: anyOf: - type: string - type: 'null' kev_ransomware_use: type: boolean epss_score: anyOf: - format: double type: number - type: 'null' epss_percentile: anyOf: - format: double type: number - type: 'null' kev_vendor_project: anyOf: - type: string - type: 'null' kev_product: anyOf: - type: string - type: 'null' kev_vulnerability_name: anyOf: - type: string - type: 'null' kev_required_action: anyOf: - type: string - type: 'null' required: - finding_id - cve_id - package_type - package_name - severity - title - actionable_count - affected_clusters - affected_workloads - fixable_occurrences - last_seen_at - known_exploited - kev_date_added - kev_due_date - kev_ransomware_use - epss_score - epss_percentile - kev_vendor_project - kev_product - kev_vulnerability_name - kev_required_action type: object SecurityStackSecuritySbom: properties: containers: type: integer description: >- Running containers (init containers included) of pods the stack owns. containers_with_sbom: type: integer containers_without_sbom: type: integer pods: type: integer images: type: integer description: >- Distinct images with a stored bill of materials linked to a stack workload. components: type: integer description: Components across those images. workloads: type: integer description: Workloads carrying a bill-of-materials link. latest_generated_at: anyOf: - format: date-time type: string - type: 'null' coverage: $ref: '#/components/schemas/SecuritySbomCoverage' required: - containers - containers_with_sbom - containers_without_sbom - pods - images - components - workloads - latest_generated_at - coverage title: SecurityStackSecuritySbom type: object description: >- The bill-of-materials picture of the stack; coverage is the cluster's opt-in state so an absent inventory can be read against it. SecurityStackSecurityMember: properties: resource_id: format: uuid type: string kind: enum: - addon - manifest type: string name: type: string namespace: anyOf: - type: string - type: 'null' release_name: anyOf: - type: string - type: 'null' description: >- The Helm release an add-on member is attributed by; null for a manifest. chart_name: anyOf: - type: string - type: 'null' declared_objects: type: integer description: Objects a manifest member declares; zero for an add-on. workloads: type: integer description: >- Cached workload objects attributed to the member. Zero means the member could not be attributed and its other figures are absent, not clean. observed: $ref: '#/components/schemas/SecuritySeverityCounts' actionable: $ref: '#/components/schemas/SecuritySeverityCounts' fixable_severe: type: integer known_exploited: type: integer affected_images: type: integer containers: type: integer containers_with_sbom: type: integer containers_without_sbom: type: integer sbom_images: type: integer sbom_components: type: integer last_scan: anyOf: - format: date-time type: string - type: 'null' required: - resource_id - kind - name - namespace - release_name - chart_name - declared_objects - workloads - observed - actionable - fixable_severe - known_exploited - affected_images - containers - containers_with_sbom - containers_without_sbom - sbom_images - sbom_components - last_scan title: SecurityStackSecurityMember type: object description: >- One add-on or manifest of the stack with the figures attributed to the objects it deploys. An object two members both own counts for each, so member rows need not sum to the stack total. ValidationError: properties: loc: items: anyOf: - type: string - type: integer title: Location type: array msg: title: Message type: string type: title: Error Type type: string required: - loc - msg - type title: ValidationError type: object SecuritySeverityCounts: properties: critical: type: integer high: type: integer low: type: integer medium: type: integer unknown: type: integer required: - critical - high - medium - low - unknown type: object SecuritySbomCoverage: properties: scanned_clusters: type: integer clusters_with_sbom: description: >- Below scanned_clusters means the remaining clusters have SBOM generation switched off, not that they run nothing. type: integer images: type: integer components: type: integer workloads: type: integer latest_generated_at: anyOf: - format: date-time type: string - type: 'null' required: - scanned_clusters - clusters_with_sbom - images - components - workloads - latest_generated_at title: SecuritySbomCoverage type: object ````