# Get the most vulnerable assets

`GET /app/reports/vulnerable-assets`

The 10 assets with the most serious open issues in the period.

Scope: `reports:read`.

## Parameters

- `projectId` (query, integer): Only this project's numbers.
- `assetId` (query, integer): Only this asset's numbers.
- `from` (query, string)
- `to` (query, string)

## Example

```bash
curl -X GET "https://api.fortwatch.ai/app/reports/vulnerable-assets" \
  -H "Authorization: Bearer $FORTWATCH_API_KEY"
```

## Response 200

The request succeeded.

- `id` (number, required)
- `value` (string, required)
- `type` (string, required)
- `project` (object, required)
- `findingsCount` (number, required)
- `scansCount` (number, required)

```json
[
  {
    "id": 42,
    "value": "app.example.com",
    "type": "string",
    "project": {},
    "findingsCount": 1,
    "scansCount": 1
  }
]
```

## Errors

- 400: The request is not valid: a field is missing or has the wrong shape (the message names it).
- 401: No valid credentials: the API key or access token is missing, revoked or expired (INVALID_API_KEY, INVALID_TOKEN).
- 403: Not allowed: the key or token lacks this scope (SCOPE_REQUIRED), the route is dashboard-only (SESSION_REQUIRED), or a plan limit applies.
- 429: Too many requests (RATE_LIMITED): wait the seconds Retry-After gives.