--- updatedAt: 2026-05-27T12:53:27.000Z agentTools: projectIndex: https://developer.onetrust.com/onetrust/llms.txt --- # Update Vulnerabilities Use this API to update the attributes of vulnerabilities in the Vulnerability Library. > 🗒 Things to Know > > - The [Get List of Vulnerabilities](https://developer.onetrust.com/onetrust/reference/findvulnerabilitiesbycriteriausingpost) API can be used to retrieve a list of all existing vulnerabilities. # OpenAPI definition ```json { "openapi": "3.1.0", "info": { "title": "Tech Risk & Compliance - IT Risk Management", "description": "The IT Risk Management API provides comprehensive REST endpoints for managing enterprise security controls, threats, vulnerabilities, and their implementations with OAuth2 security and extensive customization capabilities.", "version": "1.0", "contact": { "name": "OneTrust Support", "url": "https://my.onetrust.com/s/contactsupport" }, "license": { "name": "Apache 2.0", "url": "https://www.apache.org/licenses/LICENSE-2.0" } }, "servers": [ { "url": "https://{hostname}", "variables": { "hostname": { "default": "hostname", "description": "The OneTrust hostname such as app.onetrust.com, app-eu.onetrust.com, app-de.onetrust.com, app-uk.onetrust.com, app-apac.onetrust.com, trial.onetrust.com, or uat.onetrust.com." } } } ], "tags": [ { "name": "Vulnerabilities", "description": "APIs to manage vulnerabilities in the vulnerability library including creation, updates, deletion, and retrieval with support for bulk operations and custom attributes.", "externalDocs": { "description": "OpenAPI 3.1.0 - Download Definition", "url": "https://developer.onetrust.com/onetrust/openapi/tech-risk-compliance-it-risk-management.json" }, "x-displayName": "Vulnerabilities" } ], "paths": { "/api/controls/v2/vulnerabilities": { "put": { "operationId": "updateVulnerabilitiesUsingPUT", "summary": "Update Vulnerabilities", "description": "Use this API to update the attributes of vulnerabilities in the Vulnerability Library.\n\n> 🗒 Things to Know\n>\n> - The [Get List of Vulnerabilities](https://developer.onetrust.com/onetrust/reference/findvulnerabilitiesbycriteriausingpost) API can be used to retrieve a list of all existing vulnerabilities.", "tags": [ "Vulnerabilities" ], "x-onetrust": { "spec-label": "https://developer.onetrust.com/onetrust/openapi/tech-risk-compliance-it-risk-management.json" }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "description": "Post request containing a list of vulnerabilities and attributes to be updated within the vulnerabilities library.", "type": "array", "items": { "$ref": "#/components/schemas/TechRiskCompliance-ITRiskManagement_VulnerabilityUpdateRequest" } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/TechRiskCompliance-ITRiskManagement_VulnerabilityDto" } } } } }, "400": { "description": "Bad Request" }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "429": { "description": "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview).", "headers": { "Retry-After": { "schema": { "description": "The number of seconds after which requests will be allowed again.", "format": "int32" } }, "ot-period": { "schema": { "description": "The unit of time for which the rate limit applies", "enum": [ "HOUR", "MINUTE" ] } }, "ot-ratelimit-event-id": { "schema": { "description": "The unique identifier for the rate-limiting event.", "format": "uuid" } }, "ot-request-made": { "schema": { "description": "The number of requests made within the specified period.", "format": "int32" } }, "ot-requests-allowed": { "schema": { "description": "The number of requests allowed within the specified period.", "format": "int32" } } } }, "500": { "description": "Internal Server Error" } }, "security": [ { "TechRiskCompliance-ITRiskManagement_OAUTH2": [ "ITRM" ] } ] } } }, "components": { "schemas": { "TechRiskCompliance-ITRiskManagement_AssociatedAttributeValueInformation": { "type": "object", "properties": { "id": { "description": "Unique identifier for the attribute option", "type": "string", "format": "uuid", "example": "a34ccec7-1ec0-4d65-9075-bdd0d923f1d1" }, "value": { "description": "Attribute value", "type": "string", "example": "Text Value" }, "valueKey": { "description": "Translation key used for localizing the value", "type": "string", "example": "attribute.option.valueKey" }, "colorCode": { "description": "Color code associated with the option. Used for score-based attributes.", "type": "string", "example": "red" } }, "required": [ "value" ] }, "TechRiskCompliance-ITRiskManagement_AttributeValueInformation": { "type": "object", "properties": { "id": { "description": "Unique identifier for the attribute option", "type": "string", "format": "uuid", "example": "a34ccec7-1ec0-4d65-9075-bdd0d923f1d1" }, "value": { "description": "Attribute value", "type": "string", "example": "Text Value" }, "valueKey": { "description": "Translation key used for localizing the value", "type": "string", "example": "attribute.option.valueKey" }, "colorCode": { "description": "Color code associated with the option. Used for score-based attributes.", "type": "string", "example": "red" }, "optionSelectionValue": { "description": "Selection score value linked to the option. Used for score-based or numerical-based attributes.", "type": "string", "example": "3.5" }, "displayLabel": { "description": "Display name for the option, used for external attributes managed by other systems", "type": "string", "example": "United State | San Francisco" }, "associatedAttributeValueInformation": { "description": "Associated attribute option information", "type": "array", "items": { "$ref": "#/components/schemas/TechRiskCompliance-ITRiskManagement_AssociatedAttributeValueInformation" } }, "disabled": { "description": "Indicates whether this attribute option is currently disabled.", "type": "boolean", "example": false, "default": "false" } }, "required": [ "value" ] }, "TechRiskCompliance-ITRiskManagement_CategoryInformation": { "type": "object", "properties": { "id": { "description": "Category unique identifier", "type": "string", "format": "uuid" }, "name": { "description": "Category name", "type": "string", "example": "Financial Category" }, "nameKey": { "description": "Category nameKey for localization support", "type": "string", "example": "IM.FinancialCategoryName" } } }, "TechRiskCompliance-ITRiskManagement_FrameworkInformation": { "type": "object", "properties": { "id": { "description": "Primary Identifier.", "type": "string", "format": "uuid", "example": "123e4567-e89b-12d3-a456-426614174000" }, "name": { "description": "Framework Name of Control.", "type": "string", "example": "ISO 27001" }, "nameKey": { "description": "Framework Name key for Translation.", "type": "string", "example": "framework.key.iso" } } }, "TechRiskCompliance-ITRiskManagement_OrganizationInformation": { "type": "object", "properties": { "id": { "description": "Primary Identifier.", "type": "string", "format": "uuid", "example": "123e4567-e89b-12d3-a456-426614174000" }, "name": { "description": "Organization Name.", "type": "string", "example": "ABC Corp" } } }, "TechRiskCompliance-ITRiskManagement_VulnerabilityDto": { "type": "object", "properties": { "id": { "description": "Unique system identifier (UUID) for the vulnerability.", "type": "string", "format": "uuid", "example": "123e4567-e89b-12d3-a456-426614174000" }, "identifier": { "description": "Business identifier for the vulnerability - unique within the organization.", "type": "string", "example": "VULN-2025-001" }, "name": { "description": "Display name of the vulnerability.", "type": "string", "example": "Cross-Site Scripting (XSS) in Web Application" }, "description": { "description": "Detailed description of the vulnerability, including potential impact and affected components.", "type": "string", "example": "This vulnerability allows attackers to inject malicious client-side scripts into web pages viewed by other users. The vulnerability arises from inadequate validation and sanitization of user input that is subsequently displayed in web pages." }, "framework": { "description": "Framework information associated with this vulnerability, including framework identifier and name.", "$ref": "#/components/schemas/TechRiskCompliance-ITRiskManagement_FrameworkInformation" }, "category": { "description": "Category information for classifying this vulnerability, including category identifier and name.", "$ref": "#/components/schemas/TechRiskCompliance-ITRiskManagement_CategoryInformation" }, "orgGroup": { "description": "Organization group information that this vulnerability belongs to.", "$ref": "#/components/schemas/TechRiskCompliance-ITRiskManagement_OrganizationInformation" }, "status": { "description": "Current status of the vulnerability (e.g., Active, Pending, Archived).", "type": "string", "example": "Active", "enum": [ "Active", "Pending", "Archived" ] }, "attributes": { "description": "Custom attributes associated with this vulnerability, organized as a map of attribute names to their values.", "type": "object", "additionalProperties": { "type": "array", "description": "Custom attributes associated with this vulnerability, organized as a map of attribute names to their values.", "items": { "$ref": "#/components/schemas/TechRiskCompliance-ITRiskManagement_AttributeValueInformation" } } }, "displayLabel": { "type": "string" } }, "required": [ "id", "identifier", "name", "orgGroup" ] }, "TechRiskCompliance-ITRiskManagement_VulnerabilityUpdateRequest": { "type": "object", "properties": { "orgGroupId": { "description": "Organization group identifier that this vulnerability belongs to.", "type": "string", "format": "uuid", "example": "123e4567-e89b-12d3-a456-426614174000" }, "identifier": { "description": "Unique business identifier for the vulnerability - must be unique within the organization.", "type": "string", "example": "VULN-2025-001", "maxLength": 50, "minLength": 1 }, "name": { "description": "Name of the vulnerability.", "type": "string", "example": "Cross-Site Scripting (XSS) in Web Application", "maxLength": 500, "minLength": 1 }, "description": { "description": "Detailed description of the vulnerability.", "type": "string", "example": "This vulnerability allows attackers to inject malicious client-side scripts into web pages viewed by other users. The vulnerability arises from inadequate validation and sanitization of user input that is subsequently displayed in web pages.", "maxLength": 4000, "minLength": 0 }, "framework": { "description": "Framework information associated with this vulnerability.", "$ref": "#/components/schemas/TechRiskCompliance-ITRiskManagement_FrameworkInformation" }, "category": { "description": "Category information for classifying this vulnerability.", "$ref": "#/components/schemas/TechRiskCompliance-ITRiskManagement_CategoryInformation" }, "status": { "description": "Current status of the vulnerability.", "type": "string", "example": "Active", "enum": [ "Active", "Pending", "Archived" ] }, "id": { "description": "Unique system identifier (UUID) of the vulnerability to update.", "type": "string", "format": "uuid", "example": "123e4567-e89b-12d3-a456-426614174000" }, "attributes": { "description": "Custom attributes associated with this vulnerability, organized as a map of attribute names to their values.", "type": "object", "additionalProperties": { "type": "array", "description": "Custom attributes associated with this vulnerability, organized as a map of attribute names to their values.", "items": { "$ref": "#/components/schemas/TechRiskCompliance-ITRiskManagement_AttributeValueInformation" } } } }, "required": [ "id", "identifier", "name", "orgGroupId" ] } }, "securitySchemes": { "TechRiskCompliance-ITRiskManagement_OAUTH2": { "type": "oauth2", "flows": { "clientCredentials": { "tokenUrl": "https://{hostname}/api/access/v1/oauth/token", "scopes": { "CONTROL": "Access to Control Implementation operations for external systems", "ITRM": "Access to ITRM operations for external systems" } } } } } }, "x-readme": { "explorer-enabled": false, "proxy-enabled": false, "metrics-enabled": false }, "x-onetrust": { "spec-label": "OpenAPI 3.1.0" } } ``` # Sibling pages * [Create Vulnerability](https://developer.onetrust.com/onetrust/reference/addvulnerabilityusingpost_1.md) * [Get List of Vulnerabilities](https://developer.onetrust.com/onetrust/reference/findvulnerabilitiesbycriteriausingpost.md) * [Delete Vulnerability](https://developer.onetrust.com/onetrust/reference/removevulnerabilityusingdelete.md) * [Create Multiple Vulnerabilities](https://developer.onetrust.com/onetrust/reference/addvulnerabilitiesusingpost.md)