> ## Documentation Index
> Fetch the complete documentation index at: https://docs.attaxr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Vulnerabilities

> Confirmed findings from Hackbot hunts and the vulnerability pipeline.

A vulnerability is a confirmed finding with severity, evidence, and a proof
of concept. Hackbot opens findings during hunts. The pipeline deduplicates
and persists them.

## List and read

* `GET /api/vulnerabilities` — paginated list. `?q=` searches the title.
* `GET /api/vulnerabilities/{id}` — one finding with its full report body.

## Create and update

* `POST /api/vulnerabilities` — create a finding. Hackbot's pipeline does
  this automatically. Your tools can too.
* `PUT /api/vulnerabilities/{id}` — partial merge update. Send only the
  fields you want to change.
* `DELETE /api/vulnerabilities/{id}` — delete.

The update never changes `userId` or the dedup key. Aquila rejects a body
that carries them.

## Severity lens

Findings carry a severity. The severity speaks to impact, not to exploit
difficulty. Reports and notifications inherit the severity of their finding.

## Reports

`POST /api/reports` queues a written report for a finding. See
[Reports](/guides/reports).