# Using API or SQL to get info from remediation projects **URL:** \ **Category:** InsightVM\ **Tags:** sql, api\_trigger\ **Created:** [December 11, 2020, 11:05am UTC](https://discuss.rapid7.com/t/using-api-or-sql-to-get-info-from-remediation-projects/2739 "2020-12-11T11:05:50Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![pedro\_queiros](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/p/a87d85/32.png) [@pedro\_queiros](https://discuss.rapid7.com/u/pedro_queiros)\ **Post date:** [December 11, 2020, 11:05am UTC](https://discuss.rapid7.com/t/using-api-or-sql-to-get-info-from-remediation-projects/2739/1 "2020-12-11T11:05:50Z")
Hello, This might’ve been addressed in another topic, but I couldn’t find it. Is there a way to export information from the existing remediation projects (via API or SQL query)? I know I can go into the GUI and export via CSV, but we’d rather do it programmatically to build scripts that interact with our patching system. A good starting point would be to export all solutions titles from a given remediation project. Thanks! ---
**Author:** ![tyler\_schmidtke](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/tyler_schmidtke/32/226_2.png) [@tyler\_schmidtke](https://discuss.rapid7.com/u/tyler_schmidtke)\ **Post date:** [December 11, 2020, 3:31pm UTC](https://discuss.rapid7.com/t/using-api-or-sql-to-get-info-from-remediation-projects/2739/2 "2020-12-11T15:31:32Z")
Hi @pedro_queiros, there is not a programatic way for retrieving remediation projects information today. I’ll pass this post along internally though. 🙂 ---
**Author:** ![walter\_oberacher](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/w/58f4c7/32.png) [@walter\_oberacher](https://discuss.rapid7.com/u/walter_oberacher)\ **Post date:** [May 28, 2021, 4:30pm UTC](https://discuss.rapid7.com/t/using-api-or-sql-to-get-info-from-remediation-projects/2739/3 "2021-05-28T16:30:39Z")
Hi, This would be extremely useful. Also notice that api endpoints already exist as the dashboard itself refers to ‘_/ea/ra/api/2/project/[id]/remediation/[id]/solution_’ to retrieve the data, and the only issue in getting there by code is the authentication. Did this get into the features queue? Thanks ---
**Author:** ![ddaniel.navas](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/d/c0e974/32.png) [@ddaniel.navas](https://discuss.rapid7.com/u/ddaniel.navas)\ **Post date:** [June 25, 2022, 7:25pm UTC](https://discuss.rapid7.com/t/using-api-or-sql-to-get-info-from-remediation-projects/2739/4 "2022-06-25T19:25:39Z")
Any updates on this? ---
**Author:** ![ddaniel.navas](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/d/c0e974/32.png) [@ddaniel.navas](https://discuss.rapid7.com/u/ddaniel.navas)\ **Post date:** [June 25, 2022, 7:30pm UTC](https://discuss.rapid7.com/t/using-api-or-sql-to-get-info-from-remediation-projects/2739/5 "2022-06-25T19:30:31Z")
It’s been 2 years now, I’m guessing no progress so far. ---
**Author:** ![john\_hartman](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/john_hartman/32/1255_2.png) [@john\_hartman](https://discuss.rapid7.com/u/john_hartman)\ **Post date:** [June 27, 2022, 5:38pm UTC](https://discuss.rapid7.com/t/using-api-or-sql-to-get-info-from-remediation-projects/2739/6 "2022-06-27T17:38:07Z")
Unfortunately the latest API available for InsightVM is still API (v3) [InsightVM API (v3)](https://help.rapid7.com/insightvm/en-us/api/index.html#tag/Report) This does not include remediation projects of course. However we are still in the process of moving to a cloud native architecture for IVM which I believe will come with a new API that includes the cloud components. ---
**Author:** ![dreadpir8robots](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/dreadpir8robots/32/1074_2.png) [@dreadpir8robots](https://discuss.rapid7.com/u/dreadpir8robots)\ **Post date:** [June 27, 2022, 8:13pm UTC](https://discuss.rapid7.com/t/using-api-or-sql-to-get-info-from-remediation-projects/2739/7 "2022-06-27T20:13:14Z")
I’d also be interested in retrieving remediation project info programmatically. Given how central the remediation project concept is to InsightVM overall, and how extensive the API is in other areas, I was surprised that this isn’t already possible. An immediate use case: we have a weekly senior management meeting where vulnerability/remediation numbers are presented and discussed. It would be useful to automatically pull numbers and send them to the presenting manager overnight so that the data is in their inbox the morning of the meeting ready to drop into their slide deck, rather than several people pulling numbers by hand once a week. ---
**Author:** ![ddaniel.navas](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/d/c0e974/32.png) [@ddaniel.navas](https://discuss.rapid7.com/u/ddaniel.navas)\ **Post date:** [June 28, 2022, 2:03pm UTC](https://discuss.rapid7.com/t/using-api-or-sql-to-get-info-from-remediation-projects/2739/8 "2022-06-28T14:03:48Z")
What’s really unfair is that we are paying a good amount of money to R7 and a we can’t do such a simple task (like retrieving our local remediation projects via API). I think we are going to build a web crawler in the meantime, still, 2 years and no response, feels like this is actually not being worked on at all. ---
**Author:** ![SCO](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/s/e5b9ba/32.png) [@SCO](https://discuss.rapid7.com/u/SCO)\ **Post date:** [June 29, 2022, 11:18am UTC](https://discuss.rapid7.com/t/using-api-or-sql-to-get-info-from-remediation-projects/2739/9 "2022-06-29T11:18:49Z")
**Summary** Request ```auto GET /ea/ra/api/2/project/_summary Host: eu.exposure-analytics.insight.rapid7.com ``` Response body ```auto {"meUuid":"--user--1","numProjects":xxx,"numOpenProjects":xxx,"numClosedProjects":0,"numExpiredProjects":xxx,"numOwnedMeProjects":xxx,"numAssignedMeProjects":0} ``` **Remediation Projects** Request ```auto GET /ea/ra/api/3/project HTTP/1.1 Host: eu.exposure-analytics.insight.rapid7.com ``` Response ```auto "content":[{"projectUuid":"xxx","title":"xxx","completedRemediations":xxx,"totalRemediations":xxx,"originalRemediations":xxx,"removedRemediations":xxx,"addedRemediations":0,"totalRisk":xxx,"remainingRisk":xxx,"acceptedRisk":xxx,"dueOnTime":x,"numAssets":xxx,"completedAssets":xxx,"incTotalAssets":xxxx,"incCompletedAssets":1,"ownerUuid":"--user--1","ownerName":"xxx","assignees":[{"active":true,"email":xxx,"userFullName":"xxx","userName":"xxx","userUuid":"xxx"}],"status":"EXPIRED","createdOn":xxx,"createCompletedTime":xxx,"createProgress":xxx,"type":"STATIC","projectVisibility":{"showAssetIp":true,"showAssetOs":true,"showAssetName":true},"progress":xxx,"emptyRemediatedAssets":0,"ticketingActive":false,"serverActive":false,"projectScope":{"assetCount":xxx,"queries":["vulnerability.cveIds IN ['CVE-2016-6195']||... 0545']||vulnerability.cveIds IN ['CVE-2021-44228']"],"queryId":null},"incrementalProgress":xxx,"remainingTime":xxx}, ``` **Remediaton Details** Request (PROJECTUUID from previous request) ```auto GET /ea/ra/api/2/project/[PROJECTUUID]/remediation HTTP/1.1 Host: eu.exposure-analytics.insight.rapid7.com ``` Response body Snippet ```auto "content":[{"remediationUuid":"xxxx","projectUuid":"xxx","solutionUuid":"apache-httpd-upgrade-latest","numAssets":xxx,"completedAssets":xxx,"unresolvedVulns":xxx,"assigneeName":xxx,"assigneeUuid":xxx,"riskReduction":xxx,"status":"OPEN","statusComment":xxx,"actions":null,"tickets":[],"summary":"Upgrade to the latest version of Apache HTTPD"},{ ``` ---
**Author:** ![ddaniel.navas](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/d/c0e974/32.png) [@ddaniel.navas](https://discuss.rapid7.com/u/ddaniel.navas)\ **Post date:** [June 30, 2022, 2:46pm UTC](https://discuss.rapid7.com/t/using-api-or-sql-to-get-info-from-remediation-projects/2739/10 "2022-06-30T14:46:30Z")
Thank you!!! What would be the authentication method? I’ve tried InsightVM method and it didn’t work, also tried with X-Api-Key and didn’t work either. Also, is there an endpoint to retrieve the list of the assets and vulnerabilities involved for each solution within a remediation project? If not, can we at least get the list of the assets and vulnerabilities related to the whole remediation project? ---
**Author:** ![ddaniel.navas](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/d/c0e974/32.png) [@ddaniel.navas](https://discuss.rapid7.com/u/ddaniel.navas)\ **Post date:** [July 4, 2022, 10:34pm UTC](https://discuss.rapid7.com/t/using-api-or-sql-to-get-info-from-remediation-projects/2739/11 "2022-07-04T22:34:15Z")
Any updates @Scor? ---
**Author:** ![SCO](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/s/e5b9ba/32.png) [@SCO](https://discuss.rapid7.com/u/SCO)\ **Post date:** [July 5, 2022, 7:30pm UTC](https://discuss.rapid7.com/t/using-api-or-sql-to-get-info-from-remediation-projects/2739/12 "2022-07-05T19:30:15Z")
unfortunately, you need `IPIMS_SESSION` and `IPIMS_PRODUCT_TOKEN` to interact with `*.exposure-analytics.insight.rapid7.com`. - The product token is static. - The session ID is returned, after the SAML SSO dance on [https://rapid7ipimseu.okta-emea.com](https://rapid7ipimseu.okta-emea.com) and the redirect to [Rapid7 - Login](https://insight.rapid7.com/saml/SSO). If you have MFA enabled, the SAML SSO dance is complicated, but not impossible to script (e.g., [authenticator · PyPI](https://pypi.org/project/authenticator/)) ---
**Author:** ![dreadpir8robots](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/dreadpir8robots/32/1074_2.png) [@dreadpir8robots](https://discuss.rapid7.com/u/dreadpir8robots)\ **Post date:** [July 6, 2022, 1:58pm UTC](https://discuss.rapid7.com/t/using-api-or-sql-to-get-info-from-remediation-projects/2739/13 "2022-07-06T13:58:33Z")
I’m probably not going to attempt to use this workaround, but I wanted to say thank you @SCO for providing specific detail. ---
**Author:** ![SCO](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/s/e5b9ba/32.png) [@SCO](https://discuss.rapid7.com/u/SCO)\ **Post date:** [July 6, 2022, 2:41pm UTC](https://discuss.rapid7.com/t/using-api-or-sql-to-get-info-from-remediation-projects/2739/14 "2022-07-06T14:41:47Z")
I realize I do not know how to send a PM here, but I can share some input on this @dreadpir8robots ---
**Author:** ![dreadpir8robots](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/dreadpir8robots/32/1074_2.png) [@dreadpir8robots](https://discuss.rapid7.com/u/dreadpir8robots)\ **Post date:** [July 6, 2022, 5:09pm UTC](https://discuss.rapid7.com/t/using-api-or-sql-to-get-info-from-remediation-projects/2739/15 "2022-07-06T17:09:00Z")
Thanks @SCO. I’ll likely wait for the product to deliver this capability as part of the API - it was @ddaniel.navas who asked how you managed to achieve this - but I definitely appreciate you taking the time and trouble to share what you know. ---
**Author:** ![SCO](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/s/e5b9ba/32.png) [@SCO](https://discuss.rapid7.com/u/SCO)\ **Post date:** [July 6, 2022, 5:49pm UTC](https://discuss.rapid7.com/t/using-api-or-sql-to-get-info-from-remediation-projects/2739/16 "2022-07-06T17:49:48Z")
I did confuse you for the OP. @ddaniel.navas drop a mail address and I’ll send you a working POC for SAML SSo. @dreadpir8robots what is your source for the upcoming API release, and do you have more info on its scope ? ---
**Author:** ![dreadpir8robots](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/dreadpir8robots/32/1074_2.png) [@dreadpir8robots](https://discuss.rapid7.com/u/dreadpir8robots)\ **Post date:** [July 6, 2022, 6:05pm UTC](https://discuss.rapid7.com/t/using-api-or-sql-to-get-info-from-remediation-projects/2739/17 "2022-07-06T18:05:44Z")
> [@SCO](#): > > what is your source for the upcoming API release Ah, sorry if I misled you. I don’t know anything - but API for remediation projects is something which people ask for periodically here in the forums, so it might be built one day. ---
**Author:** ![ddaniel.navas](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/d/c0e974/32.png) [@ddaniel.navas](https://discuss.rapid7.com/u/ddaniel.navas)\ **Post date:** [September 2, 2022, 5:07pm UTC](https://discuss.rapid7.com/t/using-api-or-sql-to-get-info-from-remediation-projects/2739/18 "2022-09-02T17:07:26Z")
Hello guys, we are opening a ticket with you, we would like to get this addressed ASAP, if we can’t get this solved soon, we will start looking at other solutions. ---
**Author:** ![lleica-jrobertson](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@lleica-jrobertson](https://discuss.rapid7.com/u/lleica-jrobertson)\ **Post date:** [April 28, 2023, 7:53am UTC](https://discuss.rapid7.com/t/using-api-or-sql-to-get-info-from-remediation-projects/2739/19 "2023-04-28T07:53:21Z")
SCO, congratulations for being the only google hit for IPIMS\_PRODUCT\_TOKEN ---
**Author:** ![cchnrpower](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/c/dc4da7/32.png) [@cchnrpower](https://discuss.rapid7.com/u/cchnrpower)\ **Post date:** [December 19, 2023, 11:26am UTC](https://discuss.rapid7.com/t/using-api-or-sql-to-get-info-from-remediation-projects/2739/20 "2023-12-19T11:26:22Z")
@SCO I’ve been playing around with the endpoints you brought up, using the token we get after the SSO dance. It works great, and I wrote a quick authentication module for our internal python library. In-fact some of the endpoints seems better than the native endpoints from the official documentation. We’re now using it for a custom-built ticketing connector to mirror remediation projects with great results. Any reason why this isn’t just officially supported and documented? Considering how well it already works, and how many useful calls there is (I’ve scraped a bunch of endpoints from postman), it seems like a no-brainer to just get it added officially? [Next page](https://discuss.rapid7.com/t/using-api-or-sql-to-get-info-from-remediation-projects/2739.md?page=2)