openapi: 3.0.3 info: title: Feedly Vulnerability Agent API description: 'Query the Feedly Vulnerability Agent to retrieve CVE data filtered by time window, CVSS scores, exploit status, CISA KEV membership, and more. ' version: '1.0' contact: url: https://developers.feedly.com/reference/vulnerability-agent servers: - url: https://api.feedly.com/v3 security: - bearerAuth: [] paths: /trends/vulnerability-dashboard: post: summary: Vulnerability Agent description: "Query the Vulnerability Agent.\n\n**How to get your query JSON**: Open any saved or\ \ ad-hoc Vulnerability Agent search in the Feedly UI and click the **API** button at the top of\ \ the page. Feedly generates the complete JSON payload for you — paste it directly into the request\ \ body. You do not need to construct the body manually.\n\n**Custom time windows**: Use `\"type\"\ : \"Custom\"` with full ISO 8601 datetimes for `start` and `end` to poll on any cadence (e.g.\ \ every 4 hours) without overlapping bucket boundaries. This is useful for automated workflows\ \ (SOAR, SIEM) so each poll returns only new records with no overlap.\n\n**Request body fields**:\n\ - `layers` (array) — ordered filter layers; filters within a layer are\n OR'd, layers are AND'd\ \ together\n\n- `layers[].filters[].field` — filter dimension: `period`, `trending`,\n `created`,\ \ `exploited`, `poc`, `weaponized`, `inCisaKev`, `cvssScore`,\n `cvssEstimate`, `cvssVector`\n\ \n- `layers[].filters[].value` — value depends on field:\n period → `{\"type\": \"Last7Days\"\ |\"Last30Days\"|\"Last3Months\"|\"Last6Months\"|\"Custom\", \"label\": \"...\", \"start\": \"\ ISO datetime\", \"end\": \"ISO datetime\"}`;\n cvssScore → `{\"gte\": 9}`;\n cvssEstimate →\ \ `\"HIGH\"|\"MEDIUM\"|\"LOW\"`;\n cvssVector → string component e.g. `\"AV:N\"`, `\"PR:N\"`,\ \ `\"UI:N\"`;\n boolean fields → `true`\n\n- `count` (integer, optional) — max results per page\n\ - `continuation` — pagination token from the previous response\n- `sort` — `{\"field\": \"cveId\"\ |\"cvssScore\"|\"epssScore\"|\"publishedDate\", \"order\": \"asc\"|\"desc\"}`\n" operationId: getVulnerabilityAgent tags: - CVEs requestBody: content: application/json: schema: type: object properties: RAW_BODY: type: string format: json description: "Body of the request: the JSON query exported from the Feedly UI. Click\ \ the **API** button on any Vulnerability Agent search page — Feedly generates the\ \ complete JSON payload. Paste it here directly.\n\n**Custom time windows**: Use `\"\ type\": \"Custom\"` with ISO 8601 datetimes for `start` and `end` to poll on any cadence\ \ without overlapping bucket boundaries.\n\nExample:\n\n```json\n{\n \"layers\":\ \ [\n {\n \"filters\": [\n {\n \"field\": \"period\",\n \ \ \"value\": {\n \"type\": \"Custom\",\n \"start\": \"\ 2026-06-11T02:00:00.000Z\",\n \"end\": \"2026-06-11T06:00:00.000Z\"\n \ \ }\n }\n ]\n },\n {\n \"filters\": [\n { \"\ field\": \"exploited\", \"value\": true },\n { \"field\": \"inCisaKev\", \"\ value\": true },\n { \"field\": \"weaponized\", \"value\": true }\n ]\n\ \ }\n ]\n}\n```\n" examples: last7Days: summary: Last 7 days — trending, high severity value: layers: - filters: - field: period value: type: Last7Days label: Last 7 Days - filters: - field: trending value: true - filters: - field: cvssScore value: gte: 9 - field: cvssEstimate value: HIGH sort: field: cveId order: desc last3Months: summary: Last 3 months — exploited, weaponized, or in CISA KEV value: layers: - filters: - field: period value: type: Last3Months label: Last 3 months - filters: - field: trending value: true - filters: - field: created value: true - filters: - field: exploited value: true - field: poc value: true - field: weaponized value: true - field: inCisaKev value: true - filters: - field: cvssScore value: gte: 9 - field: cvssEstimate value: HIGH - filters: - field: cvssVector value: AV:N - filters: - field: cvssVector value: PR:N - filters: - field: cvssVector value: UI:N customWindow: summary: Custom time window (for automated polling) value: count: 50 layers: - filters: - field: period value: type: Custom start: '2026-06-11T02:00:00.000Z' end: '2026-06-11T06:00:00.000Z' responses: '200': description: Successful response content: application/json: schema: $ref: '#/components/schemas/VulnerabilityDashboardResponse' '400': description: Bad request — malformed query body content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: Unauthorized — missing or invalid API key components: securitySchemes: bearerAuth: type: http scheme: bearer description: 'Enterprise API key. Pass as `Authorization: Bearer `. See https://developers.feedly.com/reference/authorization. ' schemas: VulnerabilityDashboardResponse: type: object properties: total: type: integer description: Total number of vulnerabilities matching the query. example: 38 continuation: description: 'Pass this value back as `continuation` in the next request to retrieve the next page of results. Absent when there are no more pages. ' oneOf: - type: string - type: array items: {} example: - 2026 - 20182 - vulnerability/m/entity/CVE-2026-20182 vulnerabilities: type: array items: $ref: '#/components/schemas/Vulnerability' aggregations: $ref: '#/components/schemas/Aggregations' Vulnerability: type: object properties: id: type: string description: Feedly entity ID for this CVE. example: vulnerability/m/entity/CVE-2026-50751 cveid: type: string description: CVE identifier. example: CVE-2026-50751 type: type: string example: vulnerability label: type: string example: CVE-2026-50751 hasSalience: type: boolean description: Whether Feedly has determined this CVE is editorially significant. description: type: string description: 'Vulnerability description. For CVEs discovered by Feedly before MITRE/NVD publication, this may be a placeholder such as "The CVE description is not yet available but Feedly AI found some discussions about it." Replaced automatically as the CVE progresses through the pipeline. ' cveStatus: type: string description: 'Official standing of the CVE in MITRE/NVD at the time of the last status check. Use `Analyzed` or `Modified` for fully actionable entries. Include `Received`, `Awaiting Analysis`, and `Undergoing Analysis` for early-warning coverage. Exclude `Likely Rejected` and `Rejected` for production alerting. `null` indicates a legacy entry that predates this field. ' enum: - Received - Awaiting Analysis - Undergoing Analysis - Analyzed - Modified - Deferred - Reserved - Rejected - Unknown - Likely Rejected example: Received nullable: true advisoryUrl: type: string format: uri description: Primary advisory or reference URL. cvssV3: $ref: '#/components/schemas/CvssV3' cvssCategoryEstimate: type: string description: 'Feedly''s AI-estimated severity when an official CVSS score is unavailable. ' enum: - HIGH - MEDIUM - LOW example: HIGH cweIds: type: array items: $ref: '#/components/schemas/CweId' epssScore: type: string description: EPSS probability of exploitation (0–1, as a string). example: '0.137310000' trending: type: boolean description: Whether this CVE is currently trending in Feedly. patched: type: boolean description: Whether a patch is available. patchDetails: type: array items: $ref: '#/components/schemas/PatchDetail' exploits: type: array description: 'Classified exploit objects for this CVE. Each entry is produced by Feedly''s exploit analyzer (Claude Haiku) and carries a label, confidence score, and supporting evidence. See `overall_label` for a quick CVE-level signal without iterating this array. ' items: $ref: '#/components/schemas/ExploitDetail' newExploits: type: array description: 'Legacy field — enriched exploit entries from the previous classification pipeline. See `exploits` for the current format. ' items: $ref: '#/components/schemas/ExploitDetail' exploit_count: type: integer description: Total number of exploit URLs associated with this CVE. example: 2 overall_label: type: string description: 'Highest-severity classification across all exploit entries for this CVE. Use this to quickly identify CVEs with `exploit_code` or `exploit_steps` without iterating the full `exploits` array. ' enum: - exploit_code - exploit_steps - poc_code - poc_steps - detection - advisory - empty - unknown example: exploit_code proofOfExploits: type: array description: URLs to articles or posts confirming in-the-wild exploitation. items: type: string format: uri proofOfConcepts: type: array description: URLs to public proof-of-concept resources. items: type: string format: uri exploitedAt: type: array description: Unix epoch millisecond timestamps of known exploitation events. items: type: integer example: - 1728924420139 urlReferenceCount: type: integer description: Number of URLs referencing this CVE across Feedly's sources. example: 25 graphUrl: type: string format: uri description: URL to a full-size trend graph image for this CVE. smallGraphUrl: type: string format: uri description: URL to a small trend graph image for this CVE. feedlyInsertedDate: type: string format: date-time description: When Feedly first indexed this CVE. example: '2024-01-24T15:49:00.439865+00:00' feedlyUpdatedDate: type: string format: date-time description: When Feedly last updated this CVE. example: '2024-12-03T23:39:55.341856+00:00' publishedDate: type: string format: date-time description: Original NVD/MITRE publication date. example: '2024-01-24T00:00:00+00:00' publicationDateInfo: type: array description: Detailed publication date metadata. items: type: object additionalProperties: true executiveSummary: $ref: '#/components/schemas/ExecutiveSummary' relationships: type: array description: Related threat entities (threat actors, malware, TTPs, etc.). items: type: object additionalProperties: true timeline: type: array description: 'Chronological events for this CVE (CVSS changes, exploitation reports, vendor advisories, relationship discoveries). ' items: type: object additionalProperties: true affectedProducts: type: array description: List of products confirmed affected by this CVE. items: type: object additionalProperties: true vulnerableProducts: type: object description: Summary of vulnerable products. additionalProperties: true affectedProductsEstimate: type: array description: Estimated list of affected products when confirmed data is unavailable. items: type: object additionalProperties: true idMapping: type: array description: Related threat IDs from external sources. items: type: object additionalProperties: true detectedBy: type: array description: Scanner detection information (vendor-specific identifiers). items: type: object additionalProperties: true CvssV3: type: object description: CVSS v3.x base score and vector components. properties: version: type: string example: '3.1' baseScore: type: number example: 9.3 vectorString: type: string example: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N attackVector: type: string enum: - NETWORK - ADJACENT_NETWORK - LOCAL - PHYSICAL example: NETWORK attackComplexity: type: string enum: - LOW - HIGH example: LOW privilegesRequired: type: string enum: - NONE - LOW - HIGH example: NONE userInteraction: type: string enum: - NONE - REQUIRED example: NONE scope: type: string enum: - UNCHANGED - CHANGED example: CHANGED confidentialityImpact: type: string enum: - NONE - LOW - HIGH example: HIGH integrityImpact: type: string enum: - NONE - LOW - HIGH example: LOW availabilityImpact: type: string enum: - NONE - LOW - HIGH example: NONE CweId: type: object properties: cweID: type: string example: CWE-287 name: type: string example: Improper Authentication PatchDetail: type: object properties: title: type: string example: Github Advisory source: type: string description: Source database (e.g. `github_advisories`, `nvd`). example: github_advisories url: type: string format: uri patchAddedDate: type: string format: date-time description: When this patch was published by the source. feedlyPatchAddedDate: type: string format: date-time description: When Feedly first indexed this patch. ExploitDetail: type: object description: 'A classified exploit entry produced by Feedly''s exploit analyzer (Claude Haiku). Each URL associated with a CVE is automatically classified with a label, confidence score, and supporting evidence. ' properties: url: type: string format: uri description: URL to the exploit or PoC resource. source: type: string description: Source that surfaced this URL (e.g. `PoC-in-GitHub`, `nvd`). example: PoC-in-GitHub language: type: string nullable: true description: Primary programming language detected in the repository. example: Python label: type: string description: 'Classification label assigned by Feedly''s exploit analyzer. `is_real_exploit` is `true` for `exploit_code` and `exploit_steps` only. ' enum: - exploit_code - exploit_steps - poc_code - poc_steps - detection - advisory - empty - unknown example: detection is_real_exploit: type: boolean description: '`true` when label is `exploit_code` or `exploit_steps` — i.e. the content can compromise a real system, not just demonstrate or detect the vulnerability. ' confidence: type: string description: 'Classifier confidence. `download_urls` and `inline_snippets` are only populated when confidence is `high` and the label is actionable (`exploit_code`, `exploit_steps`, `poc_code`, `poc_steps`, `detection`). ' enum: - high - medium - low example: high reason: type: string description: Human-readable explanation of the classification decision. key_evidence: type: string description: Specific evidence excerpt that drove the classification. download_urls: type: array description: 'Raw/fetchable URLs for exploit files. Only populated when `confidence` is `high` and the label is actionable. ' items: type: string format: uri inline_snippets: type: array description: 'Code blocks extracted from the content. Only populated when `confidence` is `high` and the label is actionable. ' items: type: object properties: language: type: string example: python code: type: string example: 'import socket ...' classification_model: type: string description: The model used to classify this exploit entry. example: claude-haiku-4-5-20251001 classification_duration_ms: type: integer description: Time taken to classify, in milliseconds. example: 1340 exploitAddedDate: type: string format: date-time description: When this exploit URL was first associated with the CVE. exploitUpdatedDate: type: string format: date-time description: When the exploit classification was last updated. ExecutiveSummary: type: object description: 'AI-generated executive summary for the vulnerability. Fields are written for a non-technical audience. ' properties: impact: type: string description: Plain-language description of what an attacker could do. example: An attacker exploiting this vulnerability could... exploitation: type: string description: Current exploitation status and public PoC availability. example: There is no evidence that a public proof-of-concept exists... description: type: string description: Brief summary of the vulnerability. patch: type: string description: Patch availability and version information. example: A patch is available. Firefox versions 131.0.3... mitigation: type: string description: Recommended mitigation steps. example: Update Firefox to version 131.0.3 or later. processing_time_s: type: number description: Time taken to generate the summary, in seconds. example: 8.203333 Aggregations: type: object description: 'Facet counts for the full result set. Useful for building filter UIs or summary dashboards. ' properties: weaponized: $ref: '#/components/schemas/ScalarAggregation' exploited: $ref: '#/components/schemas/ScalarAggregation' vendors: $ref: '#/components/schemas/BucketAggregation' malwareFamilies: $ref: '#/components/schemas/BucketAggregation' threatActors: $ref: '#/components/schemas/BucketAggregation' ScalarAggregation: type: object description: A single count aggregation (no breakdown by bucket). properties: name: type: string example: exploited total: type: integer example: 34 BucketAggregation: type: object description: Aggregation broken down by individual entities. properties: name: type: string example: vendors buckets: type: array items: $ref: '#/components/schemas/AggregationBucket' AggregationBucket: type: object properties: id: type: string description: 'Entity ID or short key. `__others__` represents all entities beyond the top N returned. ' example: nlp/f/entity/gz:mal:8071f2d8-cc44-4682-845b-6f39a9f8b587 label: type: string example: Clop total: type: integer example: 1 ErrorResponse: type: object properties: errorCode: type: integer errorId: type: string message: type: string x-readme: headers: [] explorer-enabled: true proxy-enabled: true _id: buffer: '0': 106 '1': 66 '2': 129 '3': 123 '4': 114 '5': 105 '6': 29 '7': 240 '8': 191 '9': 196 '10': 1 '11': 20