# VEX

> Export Vulnerability Exploitability eXchange documents (OpenVEX or CycloneDX VEX) that tell customers and auditors which vulnerabilities affect your software and why others do not.

A VEX document states, for each vulnerability in your dependencies, whether your software is affected. MergeHarbor builds it from your findings and their status, so the decisions your teams make (fixes, exceptions, not-affected justifications) are what customers and auditors receive.

Export from **Vulnerabilities → Inventory → SBOMs → Export VEX**, for the whole organization, a repository or a service, as **OpenVEX** or **CycloneDX VEX**. Findings fixed in the last 90 days are included as fixed.

| Finding status       | OpenVEX                                      | CycloneDX                 |
| -------------------- | -------------------------------------------- | ------------------------- |
| Open                 | under_investigation                          | in_triage                 |
| Triaged, In progress | affected, with the upgrade to apply          | exploitable               |
| Risk accepted        | affected, with the acceptance and its expiry | exploitable, will not fix |
| Not affected         | not_affected, with the justification         | not_affected              |
| False positive       | not_affected, with the reason                | false_positive            |
| Fixed                | fixed                                        | resolved                  |

To mark a vulnerability not affected, request a **Not affected** exception and choose its justification; see [SLAs and exceptions](https://mergeharbor.com/docs/vulnerability-slas).

With an API key: `POST /api/v1/orgs/{org}/vulnerabilities/vex/exports?format=openvex` (or `format=cyclonedx`), optionally with `repo_id` or `service_id`. The document is built in the background: the answer is `202` with an operation. Poll `GET /api/v1/orgs/{org}/operations/{id}` until its `status` is `succeeded`, then ask for a download link with `POST /api/v1/orgs/{org}/operations/{id}/download-url` and fetch its `url` within 5 minutes (the file is kept for 7 days).