openapi: 3.1.0
info:
  title: TI Endpoints
  version: 1.0.0
  description: Retrieve the event timeline for a CVE vulnerability entity.
servers:
- url: https://api.feedly.com/v3
paths:
  /entities/{entityId}/timeline:
    get:
      summary: Get CVE Timeline
      description: Returns a chronological list of significant events for a given CVE entity, including
        CVSS score changes, exploitation reports, vendor advisories, threat intelligence reports, and
        relationship discoveries.
      operationId: getCveTimeline
      tags:
      - CVEs
      parameters:
      - name: entityId
        in: path
        required: true
        description: The entity ID of the vulnerability (e.g. `vulnerability/m/entity/CVE-2026-5426`).
          URL-encode the slashes when calling the API directly.
        schema:
          type: string
        example: vulnerability/m/entity/CVE-2026-5426
      security:
      - bearerAuth: []
      responses:
        '200':
          description: Successful response containing the timeline events for the CVE.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TimelineResponse'
              example:
                events:
                - id: 3c4e29c3-4b44-53ff-82ba-d4a4d6168c5c
                  type: vulnerability:cvssScoreUpdate
                  ts: 1779819616428
                  updated: 1779819617623
                  score: 9.1
                  sourceName: nvd
                  update: true
                - id: fda26aa1-797a-527a-826d-96cf9a7ad27e
                  type: trending
                  ts: 1779772863686
                  updated: 1779772863959
                  trending: true
                - id: b19cc6f5-3b38-5a18-9f6c-dde26c6f450e
                  type: relationship:cveExploit
                  ts: 1779707315859
                  updated: 1779707342615
                  cveId: vulnerability/m/entity/CVE-2026-5426
                  entryId: BWEgUuMGzJZRGS6YxA9VWNYmgyVV7cj7FVDMsTGdIdY=_19e5ed28693:2fde63a:8dcaf9bf
                  sourceName: OTX Bot
                  threatId: nlp/f/entity/gz:mal:1a1d3ea4-972e-4c48-8d85-08d9db8f1550
                  threatLabel: Cobalt Strike
        '401':
          description: Missing or invalid authorization token.
        '404':
          description: Entity not found.
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Feedly API token (format `fe_...`)
  schemas:
    TimelineResponse:
      type: object
      properties:
        events:
          type: array
          description: List of timeline events, ordered from most recent to oldest.
          items:
            $ref: '#/components/schemas/TimelineEvent'
    TimelineEvent:
      type: object
      description: A single timeline event. The fields present depend on the `type`.
      required:
      - id
      - type
      - ts
      - updated
      properties:
        id:
          type: string
          format: uuid
          description: Unique identifier for the event.
        type:
          type: string
          description: The event type.
          enum:
          - vulnerability:cvssScoreUpdate
          - vulnerability:cvssScoreEstimation
          - vulnerability:cveAssigned
          - vulnerability:exploitation
          - vulnerability:vendorAdvisory
          - relationship:cveExploit
          - threatIntelligenceReport
          - trending
          - firstArticle
        ts:
          type: integer
          format: int64
          description: Event timestamp in milliseconds since epoch.
        updated:
          type: integer
          format: int64
          description: Last updated timestamp in milliseconds since epoch.
        score:
          type: number
          description: CVSS score. Present on `vulnerability:cvssScoreUpdate` events.
          example: 9.1
        cvssCategoryEstimate:
          type: string
          description: Feedly's estimated severity category. Present on `vulnerability:cvssScoreEstimation`
            events.
          example: HIGH
        sourceName:
          type: string
          description: Name of the source that triggered the event.
          example: nvd
        update:
          type: boolean
          description: Whether this is an update to a previously set value. Present on score and advisory
            events.
        trending:
          type: boolean
          description: Whether the CVE is trending. Present on `trending` events.
        entryId:
          type: string
          description: Feedly entry ID of the article associated with the event.
        url:
          type: string
          format: uri
          description: URL of the source article or advisory.
        vendorName:
          type: string
          description: Name of the vendor that issued the advisory. Present on `vulnerability:vendorAdvisory`
            events.
        advisoryId:
          type: string
          description: Advisory identifier. Present on `vulnerability:vendorAdvisory` events.
        cveId:
          type: string
          description: Feedly entity ID of the CVE. Present on `relationship:cveExploit` events.
        threatId:
          type: string
          description: Feedly entity ID of the related threat (malware or threat actor). Present on `relationship:cveExploit`
            events.
        threatLabel:
          type: string
          description: Human-readable name of the related threat. Present on `relationship:cveExploit`
            events.
        summary:
          type: string
          description: AI-generated summary of the threat intelligence report. Present on `threatIntelligenceReport`
            events.
x-readme:
  explorer-enabled: true
  proxy-enabled: true