VEX

Export Vulnerability Exploitability eXchange documents (OpenVEX or CycloneDX VEX) that tell customers and auditors which vulnerabilities affect your software and why others do not.

A VEX document states, for each vulnerability in your dependencies, whether your software is affected. MergeHarbor builds it from your findings and their status, so the decisions your teams make (fixes, exceptions, not-affected justifications) are what customers and auditors receive.

Export from Vulnerabilities → Inventory → SBOMs → Export VEX, for the whole organization, a repository or a service, as OpenVEX or CycloneDX VEX. Findings fixed in the last 90 days are included as fixed.

Finding status	OpenVEX	CycloneDX
Open	under_investigation	in_triage
Triaged, In progress	affected, with the upgrade to apply	exploitable
Risk accepted	affected, with the acceptance and its expiry	exploitable, will not fix
Not affected	not_affected, with the justification	not_affected
False positive	not_affected, with the reason	false_positive
Fixed	fixed	resolved

To mark a vulnerability not affected, request a Not affected exception and choose its justification; see SLAs and exceptions.

With an API key: POST /api/v1/orgs/{org}/vulnerabilities/vex/exports?format=openvex (or format=cyclonedx), optionally with repo_id or service_id. The document is built in the background: the answer is 202 with an operation. Poll GET /api/v1/orgs/{org}/operations/{id} until its status is succeeded, then ask for a download link with POST /api/v1/orgs/{org}/operations/{id}/download-url and fetch its url within 5 minutes (the file is kept for 7 days).