---
title: CVE Exposure Assessment REST API
description: Review the following information before using the CVE Exposure Assessment REST API to trigger a CVE exposure assessment or create a vulnerability assessment record from an external system.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response-workspaces/vr-va-ws-cve-exposure-assessment-api.html
release: australia
product: Vulnerability Response Workspaces
classification: vulnerability-response-workspaces
topic_type: concept
last_updated: "2026-09-03"
reading_time_minutes: 3
keywords: [CVE Exposure Assessment REST API, Assess CVEs API, Create a vulnerability assessment API]
breadcrumb: [Exploring vulnerability assessment, Explore the Vulnerability Assessment Workspace, Vulnerability Response Workspaces, Unified Security Exposure Management, Security Operations]
---

# CVE Exposure Assessment REST API

Review the following information before using the CVE Exposure Assessment REST API to trigger a CVE exposure assessment or create a vulnerability assessment record from an external system.

To call either operation in this API, the sn\_vul\_analyst.emergency\_response role is required. If you don't pass a **source** value in the request body, the system records `VR-SNOW` so the calling system is still identifiable.

## Assess CVEs

Accepts one or more CVE IDs and triggers the same exposure assessment that the **Get CVE exposure** action triggers in the [Vulnerability Assessment Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response-workspaces/vr-ws-vuln-analyst-workspace.md). CVE IDs that don't match a CVE entry in your instance aren't treated as a failure: the request still succeeds, and those IDs are returned separately so you can identify them.

HTTP method: \(POST\)

API URL: <host\_name>/api/sn\_vul\_analyst/exposure\_assessment/cve

**Note:** <host\_name> is your ServiceNow instance name.

|Request parameters|Possible values|Description|
|------------------|---------------|-----------|
|cveIds|Array of CVE ID strings, for example \["CVE-2024-1234", "CVE-2024-5678"\]|Required. The request fails if this array is missing or empty.|
|source|Any string that identifies the calling system, for example "Qualys"|Optional.|

Request example.

```
{"cveIds": ["CVE-2024-1234", "CVE-2024-5678"], "source": "Qualys"}
```

Response example. **existingCves** lists CVE IDs that were already tracked for exposure before this call, and **newCves** lists the ones this call newly enabled. **jobStatusLink** is an HTML link, not a plain URL: parse the `href` attribute if you need the link target programmatically.

```
{
  "result": {
    "notFoundCveIds": ["CVE-2024-9999"],
    "existingCves": ["CVE-2024-1234"],
    "newCves": ["CVE-2024-5678"],
    "jobStatusLink": "<a href=/nav_to.do?uri=sn_sec_cmn_background_job.do%3Fsys_id%3D... target=\"_blank\">View Status</a>"
  }
}
```

If **cveIds** isn't a non-empty array, the API rejects the request with an `HTTP 400` error.

## Create a vulnerability assessment

Creates a vulnerability assessment record the same way the **Create Vulnerability Assessment** action does in the [Vulnerability Assessment Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response-workspaces/vr-ws-vuln-analyst-workspace.md). Use this operation to create the record only, then use [Perform an assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response-workspaces/perform-initial-assesment.md) \(or the Assess CVEs operation above\) to run the assessment.

HTTP method: \(POST\)

API URL: &lt;host\_name&gt;/api/sn\_vul\_analyst/exposure\_assessment/vulnerability\_assessment

**Note:** &lt;host\_name&gt; is your ServiceNow instance name.

|Request parameters|Possible values|Description|
|------------------|---------------|-----------|
|title|String|Required. Title of the vulnerability assessment record.|
|cve|A single CVE ID, for example "CVE-2024-1234"|Optional. Associates the CVE as the **Primary CVE** on the new record. The request fails if the CVE ID doesn't match an existing record, or if there's already an active \(non-closed\) vulnerability assessment for that CVE. The error doesn't return the existing record's sys\_id, so check for an existing assessment first if you need to find it.|
|source|Any string that identifies the calling system, for example "Qualys"|Optional.|
|autoCreateVitsAvits|true or false|Optional. Sets the **Auto-create VITs/AVITs** field on the new record. Defaults to false.|
|priority|1, 2, 3, 4, or 5|Optional. The request fails if you pass a value outside this range.|

Request example.

```
{"title": "Assess CVE-2024-1234", "cve": "CVE-2024-1234", "source": "Qualys", "autoCreateVitsAvits": false, "priority": "2"}
```

On success, the API returns an `HTTP 201` status and the sys\_id of the new record.

```
{
  "result": {
    "sysId": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6"
  }
}
```

If **title** is missing, **priority** is outside the valid range, **cve** doesn't match an existing CVE, or an active assessment already exists for that CVE, the API rejects the request with an `HTTP 400` error and an error message describing which check failed.

**Related topics**  


[Create a vulnerability assessment record](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response-workspaces/create-vuln-assessment.md)

[Perform an assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response-workspaces/perform-initial-assesment.md)

[Add CVEs to assess exposure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response-workspaces/vr-ws-add-cve.md)