Hello,
We are building an internal integration with InsightVM via the Cloud Integrations API v4 (region: EU, base https://eu.api.insight.rapid7.com).
The assets endpoint works correctly:
POST /vm/v4/integration/assets?size=500 returns 200 and paginates fine via the links.next cursor. We successfully retrieve all ~12,700 assets with their vulnerability counters.
However, the vulnerabilities endpoint consistently returns HTTP 500 for every parameter combination we try:
GET /vm/v4/integration/assets/vulnerabilities?size=5
GET /vm/v4/integration/assets/vulnerabilities?page=0&size=5&sort=id,asc
GET /vm/v4/integration/assets/vulnerabilities (no params)
Response in all cases:
{
"status": 500,
"message": "An unexpected error occurred. Please contact Rapid7 support."
}
OPTIONS on the same URL returns 200 with allow: GET,OPTIONS, so the resource exists and GET is expected.
Authentication is a valid Organization/User API key with Platform Admin permissions (/validate returns 200 Authorized; the assets endpoint authorizes fine with the same key).
Questions:
Is /vm/v4/integration/assets/vulnerabilities the correct endpoint to retrieve per-asset vulnerability details (CVE, CVSS v3, solution/remediation) via the API? If not, what is the correct endpoint for our license (Cloud Risk Complete)?
What causes the HTTP 500, and are there required parameters we are missing?
If per-asset vulnerability detail is not available via v4, what is the recommended API method to export vulnerability findings with CVSS and remediation for the whole organization?