Create a project-level vulnerability export

POST

/api/v4/security/projects/{id}/vulnerability_exports

• GitLab REST API

Creates a vulnerability export for a project. Returns status code 403 if the authenticated user does not have permission to create a vulnerability.

Authorizations

• http
• oauth2

Parameters

Path Parameters

id

required

One of:

string

string

integer

integer

The ID or URL-encoded path of the project

Request Body

Media type application/json

object

export_format

Format of the generated report

string

default: csv nullable

Allowed values: csv pdf

send_email

If true, sends an email notification to the requesting user when the export completes.

boolean

nullable

report_data

An object that contains report components mapped to frontend data assets.

Some report formats support embedding UI components from the UI. For example, users can apply certain filters in the web UI, and export the component to a PDF. The SVG is provided from the frontend in the report data field.

Unsupported keys are discarded. If the data doesn’t fit the component it is keyed to, the component is ignored and an error is logged.

object

project_vulnerabilities_history

This object should include an SVG asset to be rendered in PDF reports

object

group_vulnerabilities_over_time

This object should include an SVG asset to be rendered in PDF reports

object

project_security_status

Data for rendering the project grades summary in PDF reports

object

total_risk_score

Data for rendering the total risk score in PDF reports

object

open_vulnerabilities_over_time

Data for rendering the open vulnerabilities over time in PDF reports

object

vulnerabilities_by_age

Data for rendering the vulnerabilities by age in PDF reports

object

vulnerabilities_by_severity_count

Data for rendering the vulnerabilities by severity count in PDF reports

object

critical

object

count

Number of vulnerabilities

integer

nullable

medianAge

Median age in days

number

nullable

color

Severity color hex code

string

nullable

high

object

count

Number of vulnerabilities

integer

nullable

medianAge

Median age in days

number

nullable

color

Severity color hex code

string

nullable

medium

object

count

Number of vulnerabilities

integer

nullable

medianAge

Median age in days

number

nullable

color

Severity color hex code

string

nullable

low

object

count

Number of vulnerabilities

integer

nullable

medianAge

Median age in days

number

nullable

color

Severity color hex code

string

nullable

unknown

object

count

Number of vulnerabilities

integer

nullable

medianAge

Median age in days

number

nullable

color

Severity color hex code

string

nullable

info

object

count

Number of vulnerabilities

integer

nullable

medianAge

Median age in days

number

nullable

color

Severity color hex code

string

nullable

dashboard_type

The type of vulnerability grouping this report is being created for

string

nullable

Allowed values: :project :group :instance

full_path

The full path of the vulnerable

string

nullable

Responses

201

Created

Media type application/json

object

id

integer format: int64

created_at

string format: date-time

project_id

integer format: int64

group_id

integer format: int64

format

string

status

string

started_at

string format: date-time

finished_at

string format: date-time

send_email

boolean

expires_at

string format: date-time

_links

object

Example ^generated

{
  "id": 1,
  "created_at": "2026-04-15T12:00:00Z",
  "project_id": 1,
  "group_id": 1,
  "format": "example",
  "status": "example",
  "started_at": "2026-04-15T12:00:00Z",
  "finished_at": "2026-04-15T12:00:00Z",
  "send_email": true,
  "expires_at": "2026-04-15T12:00:00Z",
  "_links": {}
}

400

Bad Request

404

Not Found