BrambleHelp
ReferenceWarden API

Vulnerabilities & findings

Vulnerable packages across the fleet (one row per package) and the individual findings (package × device × CVE). Mark findings accepted or false positive.

MethodPathSummary
GET/api/vulnerabilitiesList vulnerable packages
GET/api/vulnerabilities/:packageOne package's findings across devices
GET/api/findingsList findings
POST/api/findings/statusAccept or dismiss findings

#List vulnerable packages

GET/api/vulnerabilities
Address
https://<your-org>.brambleit.cloud/warden/api/vulnerabilities
Requires
Signed-in browser session (the sso_session / session_id cookies from Bramble sign-in).
Licence: Warden.

Query parameters

NameTypeDescription
statusstring: "open" | "accepted" | "false_positive" | "resolved"open, accepted or false_positive.
severityanycritical, high, medium or low.
fix_statestring: "installable" | "reboot" | "awaiting" | "released" | "manual" | "none"installable, reboot, awaiting, released, manual or none.
kevstring1 for only CVEs known to be exploited (CISA KEV).
device_idstringOnly this device.
packagestringOnly this package.
searchstringText to search for.

Response 200

FieldTypeDescription
packagesarray of object
packages[].packagestring
packages[].devicesinteger
packages[].cvesinteger
packages[].findingsinteger
packages[].worstany
packages[].kevboolean
packages[].epssnumber, or null
packages[].cvssnumber, or null
packages[].installablenumber
packages[].rebootnumber
packages[].awaitingnumber
packages[].releasednumber
packages[].manualnumber
packages[].fixed_versionstring, or null
packages[].first_seenstring (date-time)
packages[].criticalnumber
packages[].highnumber
packages[].mediumnumber
packages[].lownumber
packages[].ticketednumber
packages[].oldest_publishedany
Example response
JSON
{
  "packages": [
    {
      "package": "string",
      "devices": 1,
      "cves": 1,
      "findings": 1,
      "worst": null,
      "kev": false,
      "epss": 12.5,
      "cvss": 12.5,
      "installable": 12.5,
      "reboot": 12.5,
      "awaiting": 12.5,
      "released": 12.5,
      "manual": 12.5,
      "fixed_version": "string",
      "first_seen": "2026-11-12T09:30:00.000Z",
      "critical": 12.5,
      "high": 12.5,
      "medium": 12.5,
      "low": 12.5,
      "ticketed": 12.5,
      "oldest_published": null
    }
  ]
}

Example request

JavaScript
// From a page served by Bramble (uses the signed-in session)
const res = await fetch('/warden/api/vulnerabilities', {
  method: 'GET',
  credentials: 'include',
});
const data = await res.json();

#One package's findings across devices

GET/api/vulnerabilities/:package
Address
https://<your-org>.brambleit.cloud/warden/api/vulnerabilities/:package
Requires
Signed-in browser session (the sso_session / session_id cookies from Bramble sign-in).
Licence: Warden.

Path parameters

NameTypeDescription
packagerequiredstring

Response 200

FieldTypeDescription
packageany
cvesarray of any
devicesarray of any
Example response
JSON
{
  "package": null,
  "cves": [],
  "devices": []
}

Example request

JavaScript
// From a page served by Bramble (uses the signed-in session)
const res = await fetch('/warden/api/vulnerabilities/string', {
  method: 'GET',
  credentials: 'include',
});
const data = await res.json();

#List findings

GET/api/findings

Individual findings (package, device, CVE). Takes the same filters as the vulnerabilities list.

Address
https://<your-org>.brambleit.cloud/warden/api/findings
Requires
Signed-in browser session (the sso_session / session_id cookies from Bramble sign-in).
Licence: Warden.

Query parameters

NameTypeDescription
statusstring: "open" | "accepted" | "false_positive" | "resolved"
severityany
fix_statestring: "installable" | "reboot" | "awaiting" | "released" | "manual" | "none"
kevstring
device_idstring
packagestring
searchstring

Response 200

FieldTypeDescription
findingsarray of object
findings[].idinteger
findings[].tenant_idinteger
findings[].device_idstring
findings[].packagestring
findings[].binariesstring, or null
findings[].installed_versionstring, or null
findings[].fixed_versionstring, or null
findings[].fix_statestring: "installable" | "reboot" | "awaiting" | "released" | "manual" | "none"
findings[].vuln_idstring
findings[].cve_idstring
findings[].severitystring: "critical" | "high" | "medium" | "low" | "none"
findings[].distro_prioritystring, or null
findings[].cvss_scorenumber, or null
findings[].kevboolean
findings[].epssnumber, or null
findings[].statusstring: "open" | "resolved" | "accepted" | "false_positive"
findings[].status_notestring, or null
findings[].status_bystring, or null
findings[].status_atstring (date-time), or null
findings[].first_seenstring (date-time)
findings[].last_seenstring (date-time)
findings[].resolved_atstring (date-time), or null
findings[].ticket_link_idinteger, or null
findings[].summaryany
Example response
JSON
{
  "findings": [
    {
      "id": 42,
      "tenant_id": 1,
      "device_id": "string",
      "package": "string",
      "binaries": "string",
      "installed_version": "string",
      "fixed_version": "string",
      "fix_state": "installable",
      "vuln_id": "string",
      "cve_id": "string",
      "severity": "critical",
      "distro_priority": "string",
      "cvss_score": 12.5,
      "kev": false,
      "epss": 12.5,
      "status": "open",
      "status_note": "active",
      "status_by": "active",
      "status_at": "2026-11-12T09:30:00.000Z",
      "first_seen": "2026-11-12T09:30:00.000Z",
      "last_seen": "2026-11-12T09:30:00.000Z",
      "resolved_at": "2026-11-12T09:30:00.000Z",
      "ticket_link_id": 7,
      "summary": null
    }
  ]
}

Example request

JavaScript
// From a page served by Bramble (uses the signed-in session)
const res = await fetch('/warden/api/findings', {
  method: 'GET',
  credentials: 'include',
});
const data = await res.json();

#Accept or dismiss findings

POST/api/findings/status
Address
https://<your-org>.brambleit.cloud/warden/api/findings/status
Requires
Signed-in browser session (the sso_session / session_id cookies from Bramble sign-in).
Licence: Warden.

Request body JSON

NameTypeDescription
idsarray of anyFinding ids.
statusstring: "open" | "accepted" | "false_positive"open, accepted (a known, accepted risk) or false_positive.
notestringWhy.

Response 200

FieldTypeDescription
updatedinteger
Example response
JSON
{
  "updated": 1
}

Example request

JavaScript
// From a page served by Bramble (uses the signed-in session)
const res = await fetch('/warden/api/findings/status', {
  method: 'POST',
  credentials: 'include',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({"ids":[],"status":"open","note":"string"}),
});
const data = await res.json();