> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mainwp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Vulnerability Checker Policy Ability

> Read your Dashboard's non-secret vulnerability provider, schedule, and job readiness settings.

Use `mainwp/get-vulnerability-policy-v1` to read the Vulnerability Checker policy for your Dashboard. It reads saved settings without scanning sites, contacting a provider, or changing settings.

## Access

Activate Vulnerability Checker on a Dashboard with WordPress Abilities API support. Your authenticated user must pass the Dashboard Abilities API permission check and have both access to the extension and its `view_vulnerabilities` right.

Team Control users with that view right can read this policy when their site access is restricted. The response contains no site findings. Users without the view right cannot run the ability.

Use an [Application Password](https://docs.mainwp.com/api-reference/rest-api/application-passwords.md) over HTTPS, or an authenticated WordPress session with a REST nonce. See [Abilities API authentication](https://docs.mainwp.com/api-reference/abilities-api/overview.md#authentication).

## Read the Policy

The ability accepts no parameters. Extra input fields are rejected.

```bash theme={null}
curl -u 'USERNAME:APPLICATION_PASSWORD' \
  'https://your-dashboard.example/wp-json/wp-abilities/v1/abilities/mainwp/get-vulnerability-policy-v1/run'
```

Example response:

```json theme={null}
{
  "credential_configured": false,
  "job_state": "unavailable",
  "notification_enabled": false,
  "provider": "wpvulndb",
  "scan_on_sync": false,
  "schedule": "disabled",
  "policy_generation": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
}
```

| Field | Meaning |
| - | - |
| `provider` | Saved provider: `wpvulndb`, `nvd_nist`, or `wordfence`. |
| `credential_configured` | Whether a WPVulnerability credential is stored. Other providers return `true` because this policy does not require that credential for them. This does not test a credential with a provider. |
| `schedule` | Saved schedule: `daily`, `weekly`, `monthly`, or `disabled`. |
| `scan_on_sync` | Whether scanning on sync is enabled in the saved settings. |
| `notification_enabled` | Whether notifications are enabled in the saved settings. This does not confirm delivery. |
| `job_state` | `unavailable` while the typed observation and job infrastructure is absent. This ability does not create that infrastructure. |
| `policy_generation` | An opaque HMAC of the non-secret policy, bound to your installation. It changes when the returned policy changes. |

> [!NOTE]
>
> This response is policy information, not a scan result or a claim that your sites are free of vulnerabilities. Credentials, API tokens, and notification recipients are never returned.

## Discover the Schema

```bash theme={null}
curl -u 'USERNAME:APPLICATION_PASSWORD' \
  'https://your-dashboard.example/wp-json/wp-abilities/v1/abilities/mainwp/get-vulnerability-policy-v1'
```

The category is `mainwp-vulnerability-checker`. Both schemas reject extra fields. The ability is read-only and idempotent.

## Errors

Anonymous execution returns HTTP `401`. An authenticated caller without the required access receives `403`. Invalid input receives `400`. If Dashboard authorization, the saved provider, or the existing installation binding is unavailable, the ability returns an error rather than a policy result.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.