specification: FinOps Framework
specificationVersion: '1.0'
schema: https://www.finops.org/framework/
provider: National Institute of Standards and Technology (NIST)
providerId: nist
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - FinOps
  - FOCUS
  - Government
  - Public Data
  - Cybersecurity
description: 'FOCUS-aligned FinOps for NIST: NIST APIs are free public-good services with no commercial
  billing. The "FinOps" surface is rate-limit budgeting and operational hygiene rather than dollar cost.'
sources:
  - https://nvd.nist.gov/developers/start-here
alignedWith:
  framework: FinOps Foundation Framework
  frameworkUrl: https://www.finops.org/framework/
  dataSpec: FOCUS
  dataSpecVersion: '1.3'
  dataSpecUrl: https://focus.finops.org/focus-specification/v1-3/
publisherName: U.S. National Institute of Standards and Technology
serviceCategory: Government Open Data
billingModel:
  pricingCategory: Free Public Service
  billingFrequency: None
  billingCurrency: USD
  chargeCategories: []
focusColumns:
  ServiceName: NIST Public APIs
  ServiceCategory: Government Data
  ServiceSubcategory: Vulnerability + Standards Data
  ProviderName: NIST
  PublisherName: U.S. National Institute of Standards and Technology
  InvoiceIssuerName: N/A (free)
  BillingCurrency: USD
  PricingCategory: Free
meters:
  - name: nvd_api_requests
    description: Calls to the NVD REST API (rate-limited, not billed).
    unit: request
    aggregation: sum
    dimensions:
      - api_key
      - endpoint
  - name: nvd_records_synced
    description: CVE records ingested via paginated NVD sync.
    unit: record
    aggregation: sum
    dimensions:
      - feed
  - name: chemistry_webbook_requests
    description: Calls to NIST Chemistry WebBook API.
    unit: request
    aggregation: sum
    dimensions:
      - dataset
  - name: time_service_queries
    description: NIST Internet Time Service queries (NTP, daytime).
    unit: query
    aggregation: sum
    dimensions:
      - protocol
principles:
  - name: Visibility
    description: Track per-key request counts client-side; NIST does not expose a usage dashboard. Log
      response codes (200/403) and align to the 30-second rolling window.
  - name: Allocation
    description: Issue separate API keys per consuming application or environment so quota usage can
      be attributed and one team's bug does not starve another.
  - name: Optimization
    description: Cache NVD CVE data locally and use lastModStartDate windowed sync; avoid re-fetching
      static records. Honor the 6-second inter-request sleep to avoid 403s and unnecessary retries.
  - name: Accountability
    description: Designate a public-data steward per consuming team responsible for honoring the NIST
      Terms of Use, key rotation, and uptime against the public quota.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com