{
"basePath": "/api",
"consumes": [
"application/json"
],
"definitions": {
"API Key": {
"properties": {
"apikey": {
"description": "The current API key of the user.",
"type": "string"
}
},
"type": "object"
},
"BadRequestModel": {
"$schema": "http://json-schema.org/draft-04/schema",
"properties": {
"details": {
"items": {
"properties": {
"location": {
"description": "The location of the parameter",
"enum": [
"body",
"param",
"query"
],
"type": "string"
},
"msg": {
"description": "Invalid value",
"type": "string"
},
"param": {
"description": "The name of the parameter with the error",
"type": "string"
}
},
"type": "object"
},
"type": "array"
},
"error": {
"description": "Error name",
"type": "string"
},
"message": {
"description": "Error description",
"type": "string"
}
},
"type": "object"
},
"Banner": {
"properties": {
"enabled": {
"description": "Whether a maintenance notice should be displayed.",
"type": "boolean"
},
"message": {
"description": "The notice to display, as the administrator wrote it. May contain Markdown emphasis and links; it is never HTML.",
"type": "string"
}
},
"type": "object"
},
"Bundle": {
"properties": {
"author": {
"allOf": [
{
"$ref": "#/definitions/User"
}
],
"readOnly": true
},
"creation_timestamp": {
"description": "Creation time of the bundle.",
"format": "date-time",
"readOnly": true,
"type": "string"
},
"description": {
"description": "Description.",
"type": "string"
},
"meta": {
"description": "Zero or more meta-fields.",
"type": "object"
},
"name": {
"description": "Bundle name.",
"type": "string"
},
"related_vulnerabilities": {
"description": "One or more vulnerability references (CVE ID, GHSA-ID, PYSEC ID, etc.) for this bundle.",
"items": {
"type": "string"
},
"type": "array"
},
"timestamp": {
"description": "Updated time of the bundle.",
"format": "date-time",
"readOnly": true,
"type": "string"
},
"uuid": {
"description": "Bundle id.",
"type": "string"
},
"vulnerability_lookup_origin": {
"default": "8627204d-fee7-4bdf-8707-5f0833b57c82",
"description": "UUID of the Vulnerability-Lookup origin instance.",
"readOnly": true,
"type": "string"
}
},
"type": "object"
},
"BundlesList": {
"properties": {
"data": {
"description": "List of bundles.",
"items": {
"$ref": "#/definitions/Bundle"
},
"type": "array"
},
"metadata": {
"allOf": [
{
"$ref": "#/definitions/metadata"
}
],
"description": "Metadata related to the result."
}
},
"type": "object"
},
"CAPEC": {
"properties": {
"@Description": {
"description": "Description.",
"readOnly": true,
"type": "string"
},
"@ID": {
"description": "Identifiant.",
"readOnly": true,
"type": "string"
},
"@Name": {
"description": "Name.",
"readOnly": true,
"type": "string"
}
},
"type": "object"
},
"CAPECsList": {
"properties": {
"data": {
"description": "List of CAPECs.",
"items": {
"$ref": "#/definitions/CAPEC"
},
"type": "array"
},
"metadata": {
"allOf": [
{
"$ref": "#/definitions/metadata"
}
],
"description": "Metadata related to the result."
}
},
"type": "object"
},
"CNACredential": {
"properties": {
"created_at": {
"description": "Creation time of the credential.",
"format": "date-time",
"readOnly": true,
"type": "string"
},
"cve_api_org": {
"description": "CVE Services API organization.",
"type": "string"
},
"cve_api_user": {
"description": "CVE Services API user.",
"type": "string"
},
"enabled": {
"description": "Whether CNA publication is allowed for the user bound to this credential.",
"type": "boolean"
},
"id": {
"description": "CNA credential id.",
"readOnly": true,
"type": "integer"
},
"login": {
"description": "Login of the user bound to this credential.",
"readOnly": true,
"type": "string"
},
"updated_at": {
"description": "Last update time of the credential.",
"format": "date-time",
"readOnly": true,
"type": "string"
}
},
"type": "object"
},
"CNACredentialsList": {
"properties": {
"data": {
"description": "List of CNA credentials.",
"items": {
"$ref": "#/definitions/CNACredential"
},
"type": "array"
},
"metadata": {
"allOf": [
{
"$ref": "#/definitions/metadata"
}
],
"description": "Metadata related to the result."
}
},
"type": "object"
},
"CWE": {
"properties": {
"@Abstraction": {
"description": "Abstraction of the CWE",
"type": "string"
},
"@ID": {
"description": "CWE ID",
"type": "string"
},
"@Name": {
"description": "Name of the CWE",
"type": "string"
},
"@Status": {
"description": "Status of the CWE",
"type": "string"
},
"@Structure": {
"description": "Structure of the CWE",
"type": "string"
},
"Description": {
"description": "Description of the CWE",
"type": "string"
},
"Mapping_Notes": {
"allOf": [
{
"$ref": "#/definitions/MappingNotes"
}
],
"description": "Mapping notes"
},
"Potential_Mitigations": {
"allOf": [
{
"$ref": "#/definitions/Mitigations"
}
],
"description": "Potential mitigations"
},
"Related_Weaknesses": {
"allOf": [
{
"$ref": "#/definitions/RelatedWeaknesses"
}
],
"description": "Related weaknesses"
}
},
"required": [
"@Abstraction",
"@ID",
"@Name",
"@Status",
"@Structure",
"Description"
],
"type": "object"
},
"CWEsList": {
"properties": {
"data": {
"description": "List of CWEs.",
"items": {
"$ref": "#/definitions/CWE"
},
"type": "array"
},
"metadata": {
"allOf": [
{
"$ref": "#/definitions/metadata"
}
],
"description": "Metadata related to the result."
}
},
"type": "object"
},
"CnaRequestModel": {
"$id": "https://cve.org/cve/record/v5_00/",
"$schema": "http://json-schema.org/draft-07/schema#",
"definitions": {
"adpContainer": {
"additionalProperties": false,
"minProperties": 2,
"patternProperties": {
"^x_[^.]*$": {}
},
"properties": {
"affected": {
"$ref": "#/definitions/affected"
},
"configurations": {
"$ref": "#/definitions/configurations"
},
"credits": {
"$ref": "#/definitions/credits"
},
"datePublic": {
"$ref": "#/definitions/timestamp"
},
"descriptions": {
"$ref": "#/definitions/descriptions"
},
"exploits": {
"$ref": "#/definitions/exploits"
},
"impacts": {
"$ref": "#/definitions/impacts"
},
"metrics": {
"$ref": "#/definitions/metrics"
},
"problemTypes": {
"$ref": "#/definitions/problemTypes"
},
"providerMetadata": {
"$ref": "#/definitions/providerMetadata"
},
"references": {
"$ref": "#/definitions/references"
},
"solutions": {
"$ref": "#/definitions/solutions"
},
"source": {
"$ref": "#/definitions/source"
},
"tags": {
"$ref": "#/definitions/adpTags"
},
"taxonomyMappings": {
"$ref": "#/definitions/taxonomyMappings"
},
"timeline": {
"$ref": "#/definitions/timeline"
},
"title": {
"type": "string"
},
"workarounds": {
"$ref": "#/definitions/workarounds"
}
},
"required": [
"providerMetadata"
],
"type": "object"
},
"adpTags": {
"items": {
"oneOf": [
{
"$ref": "#/definitions/tagExtension"
},
{
"$id": "https://cve.mitre.org/cve/v5_00/tags/adp/",
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "string"
}
]
},
"minItems": 1,
"type": "array",
"uniqueItems": true
},
"affected": {
"items": {
"$ref": "#/definitions/product"
},
"minItems": 1,
"type": "array"
},
"cnaPublishedContainer": {
"additionalProperties": false,
"patternProperties": {
"^x_[^.]*$": {}
},
"properties": {
"affected": {
"$ref": "#/definitions/affected"
},
"configurations": {
"$ref": "#/definitions/configurations"
},
"credits": {
"$ref": "#/definitions/credits"
},
"dateAssigned": {
"$ref": "#/definitions/timestamp"
},
"datePublic": {
"$ref": "#/definitions/timestamp"
},
"descriptions": {
"$ref": "#/definitions/descriptions"
},
"exploits": {
"$ref": "#/definitions/exploits"
},
"impacts": {
"$ref": "#/definitions/impacts"
},
"metrics": {
"$ref": "#/definitions/metrics"
},
"problemTypes": {
"$ref": "#/definitions/problemTypes"
},
"providerMetadata": {
"$ref": "#/definitions/providerMetadata"
},
"references": {
"$ref": "#/definitions/references"
},
"solutions": {
"$ref": "#/definitions/solutions"
},
"source": {
"$ref": "#/definitions/source"
},
"tags": {
"$ref": "#/definitions/cnaTags"
},
"taxonomyMappings": {
"$ref": "#/definitions/taxonomyMappings"
},
"timeline": {
"$ref": "#/definitions/timeline"
},
"title": {
"type": "string"
},
"workarounds": {
"$ref": "#/definitions/workarounds"
}
},
"required": [
"providerMetadata",
"descriptions",
"affected",
"references"
],
"type": "object"
},
"cnaRejectedContainer": {
"additionalProperties": false,
"patternProperties": {
"^x_[^.]*$": {}
},
"properties": {
"providerMetadata": {
"$ref": "#/definitions/providerMetadata"
},
"rejectedReasons": {
"$ref": "#/definitions/descriptions"
},
"replacedBy": {
"items": {
"$ref": "#/definitions/cveId"
},
"minItems": 1,
"type": "array",
"uniqueItems": true
}
},
"required": [
"providerMetadata",
"rejectedReasons"
],
"type": "object"
},
"cnaTags": {
"items": {
"oneOf": [
{
"$ref": "#/definitions/tagExtension"
},
{
"$id": "https://cve.mitre.org/cve/v5_00/tags/cna/",
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "string"
}
]
},
"minItems": 1,
"type": "array",
"uniqueItems": true
},
"configurations": {
"items": {
"$ref": "#/definitions/description"
},
"minItems": 1,
"type": "array",
"uniqueItems": true
},
"credits": {
"items": {
"properties": {
"lang": {
"$ref": "#/definitions/language"
},
"type": {
"type": "string"
},
"user": {
"$ref": "#/definitions/uuidType"
},
"value": {
"type": "string"
}
},
"required": [
"lang",
"value"
],
"type": "object"
},
"minItems": 1,
"type": "array",
"uniqueItems": true
},
"cveId": {
"type": "string"
},
"cveMetadataPublished": {
"additionalProperties": false,
"properties": {
"assignerOrgId": {
"$ref": "#/definitions/orgId"
},
"assignerShortName": {
"$ref": "#/definitions/shortName"
},
"cveId": {
"$ref": "#/definitions/cveId"
},
"datePublished": {
"$ref": "#/definitions/timestamp"
},
"dateReserved": {
"$ref": "#/definitions/timestamp"
},
"dateUpdated": {
"$ref": "#/definitions/timestamp"
},
"requesterUserId": {
"$ref": "#/definitions/userId"
},
"serial": {
"type": "integer"
},
"state": {
"type": "string"
}
},
"required": [
"cveId",
"assignerOrgId",
"state"
],
"type": "object"
},
"cveMetadataRejected": {
"additionalProperties": false,
"properties": {
"assignerOrgId": {
"$ref": "#/definitions/orgId"
},
"assignerShortName": {
"$ref": "#/definitions/shortName"
},
"cveId": {
"$ref": "#/definitions/cveId"
},
"datePublished": {
"$ref": "#/definitions/timestamp"
},
"dateRejected": {
"$ref": "#/definitions/timestamp"
},
"dateReserved": {
"$ref": "#/definitions/timestamp"
},
"dateUpdated": {
"$ref": "#/definitions/timestamp"
},
"serial": {
"type": "integer"
},
"state": {
"type": "string"
}
},
"required": [
"cveId",
"assignerOrgId",
"state"
],
"type": "object"
},
"dataType": {
"type": "string"
},
"dataVersion": {
"type": "string"
},
"datestamp": {
"format": "date",
"type": "string"
},
"description": {
"additionalProperties": false,
"properties": {
"lang": {
"$ref": "#/definitions/language"
},
"supportingMedia": {
"items": {
"properties": {
"base64": {
"default": false,
"type": "boolean"
},
"type": {
"type": "string"
},
"value": {
"type": "string"
}
},
"required": [
"type",
"value"
],
"type": "object"
},
"minItems": 1,
"type": "array",
"uniqueItems": true
},
"value": {
"type": "string"
}
},
"required": [
"lang",
"value"
],
"type": "object"
},
"descriptions": {
"contains": {
"$ref": "#/definitions/englishLanguageDescription"
},
"items": {
"$ref": "#/definitions/description"
},
"minItems": 1,
"type": "array",
"uniqueItems": true
},
"englishLanguage": {
"type": "string"
},
"englishLanguageDescription": {
"properties": {
"lang": {
"$ref": "#/definitions/englishLanguage"
}
},
"required": [
"lang"
],
"type": "object"
},
"exploits": {
"items": {
"$ref": "#/definitions/description"
},
"minItems": 1,
"type": "array",
"uniqueItems": true
},
"impacts": {
"items": {
"properties": {
"capecId": {
"type": "string"
},
"descriptions": {
"$ref": "#/definitions/descriptions"
}
},
"required": [
"descriptions"
],
"type": "object"
},
"minItems": 1,
"type": "array",
"uniqueItems": true
},
"language": {
"type": "string"
},
"metrics": {
"items": {
"anyOf": [
{
"required": [
"cvssV4_0"
]
},
{
"required": [
"cvssV3_1"
]
},
{
"required": [
"cvssV3_0"
]
},
{
"required": [
"cvssV2_0"
]
},
{
"required": [
"other"
]
}
],
"properties": {
"cvssV2_0": {
"$schema": "http://json-schema.org/draft-04/schema#",
"definitions": {
"accessComplexityType": {
"type": "string"
},
"accessVectorType": {
"type": "string"
},
"authenticationType": {
"type": "string"
},
"ciaRequirementType": {
"type": "string"
},
"ciaType": {
"type": "string"
},
"collateralDamagePotentialType": {
"type": "string"
},
"exploitabilityType": {
"type": "string"
},
"remediationLevelType": {
"type": "string"
},
"reportConfidenceType": {
"type": "string"
},
"scoreType": {
"type": "number"
},
"targetDistributionType": {
"type": "string"
}
},
"properties": {
"accessComplexity": {
"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/accessComplexityType"
},
"accessVector": {
"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/accessVectorType"
},
"authentication": {
"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/authenticationType"
},
"availabilityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/ciaType"
},
"availabilityRequirement": {
"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/ciaRequirementType"
},
"baseScore": {
"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/scoreType"
},
"collateralDamagePotential": {
"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/collateralDamagePotentialType"
},
"confidentialityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/ciaType"
},
"confidentialityRequirement": {
"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/ciaRequirementType"
},
"environmentalScore": {
"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/scoreType"
},
"exploitability": {
"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/exploitabilityType"
},
"integrityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/ciaType"
},
"integrityRequirement": {
"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/ciaRequirementType"
},
"remediationLevel": {
"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/remediationLevelType"
},
"reportConfidence": {
"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/reportConfidenceType"
},
"targetDistribution": {
"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/targetDistributionType"
},
"temporalScore": {
"$ref": "#/definitions/metrics/items/properties/cvssV2_0/definitions/scoreType"
},
"vectorString": {
"type": "string"
},
"version": {
"type": "string"
}
},
"required": [
"version",
"vectorString",
"baseScore"
],
"type": "object"
},
"cvssV3_0": {
"$schema": "http://json-schema.org/draft-04/schema#",
"definitions": {
"attackComplexityType": {
"type": "string"
},
"attackVectorType": {
"type": "string"
},
"ciaRequirementType": {
"type": "string"
},
"ciaType": {
"type": "string"
},
"confidenceType": {
"type": "string"
},
"exploitCodeMaturityType": {
"type": "string"
},
"modifiedAttackComplexityType": {
"type": "string"
},
"modifiedAttackVectorType": {
"type": "string"
},
"modifiedCiaType": {
"type": "string"
},
"modifiedPrivilegesRequiredType": {
"type": "string"
},
"modifiedScopeType": {
"type": "string"
},
"modifiedUserInteractionType": {
"type": "string"
},
"privilegesRequiredType": {
"type": "string"
},
"remediationLevelType": {
"type": "string"
},
"scopeType": {
"type": "string"
},
"scoreType": {
"type": "number"
},
"severityType": {
"type": "string"
},
"userInteractionType": {
"type": "string"
}
},
"properties": {
"attackComplexity": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/attackComplexityType"
},
"attackVector": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/attackVectorType"
},
"availabilityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/ciaType"
},
"availabilityRequirement": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/ciaRequirementType"
},
"baseScore": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/scoreType"
},
"baseSeverity": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/severityType"
},
"confidentialityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/ciaType"
},
"confidentialityRequirement": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/ciaRequirementType"
},
"environmentalScore": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/scoreType"
},
"environmentalSeverity": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/severityType"
},
"exploitCodeMaturity": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/exploitCodeMaturityType"
},
"integrityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/ciaType"
},
"integrityRequirement": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/ciaRequirementType"
},
"modifiedAttackComplexity": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/modifiedAttackComplexityType"
},
"modifiedAttackVector": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/modifiedAttackVectorType"
},
"modifiedAvailabilityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/modifiedCiaType"
},
"modifiedConfidentialityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/modifiedCiaType"
},
"modifiedIntegrityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/modifiedCiaType"
},
"modifiedPrivilegesRequired": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/modifiedPrivilegesRequiredType"
},
"modifiedScope": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/modifiedScopeType"
},
"modifiedUserInteraction": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/modifiedUserInteractionType"
},
"privilegesRequired": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/privilegesRequiredType"
},
"remediationLevel": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/remediationLevelType"
},
"reportConfidence": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/confidenceType"
},
"scope": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/scopeType"
},
"temporalScore": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/scoreType"
},
"temporalSeverity": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/severityType"
},
"userInteraction": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_0/definitions/userInteractionType"
},
"vectorString": {
"type": "string"
},
"version": {
"type": "string"
}
},
"required": [
"version",
"vectorString",
"baseScore",
"baseSeverity"
],
"type": "object"
},
"cvssV3_1": {
"$schema": "http://json-schema.org/draft-07/schema#",
"definitions": {
"attackComplexityType": {
"type": "string"
},
"attackVectorType": {
"type": "string"
},
"ciaRequirementType": {
"type": "string"
},
"ciaType": {
"type": "string"
},
"confidenceType": {
"type": "string"
},
"exploitCodeMaturityType": {
"type": "string"
},
"modifiedAttackComplexityType": {
"type": "string"
},
"modifiedAttackVectorType": {
"type": "string"
},
"modifiedCiaType": {
"type": "string"
},
"modifiedPrivilegesRequiredType": {
"type": "string"
},
"modifiedScopeType": {
"type": "string"
},
"modifiedUserInteractionType": {
"type": "string"
},
"privilegesRequiredType": {
"type": "string"
},
"remediationLevelType": {
"type": "string"
},
"scopeType": {
"type": "string"
},
"scoreType": {
"type": "number"
},
"severityType": {
"type": "string"
},
"userInteractionType": {
"type": "string"
}
},
"properties": {
"attackComplexity": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/attackComplexityType"
},
"attackVector": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/attackVectorType"
},
"availabilityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/ciaType"
},
"availabilityRequirement": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/ciaRequirementType"
},
"baseScore": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/scoreType"
},
"baseSeverity": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/severityType"
},
"confidentialityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/ciaType"
},
"confidentialityRequirement": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/ciaRequirementType"
},
"environmentalScore": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/scoreType"
},
"environmentalSeverity": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/severityType"
},
"exploitCodeMaturity": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/exploitCodeMaturityType"
},
"integrityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/ciaType"
},
"integrityRequirement": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/ciaRequirementType"
},
"modifiedAttackComplexity": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/modifiedAttackComplexityType"
},
"modifiedAttackVector": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/modifiedAttackVectorType"
},
"modifiedAvailabilityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/modifiedCiaType"
},
"modifiedConfidentialityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/modifiedCiaType"
},
"modifiedIntegrityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/modifiedCiaType"
},
"modifiedPrivilegesRequired": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/modifiedPrivilegesRequiredType"
},
"modifiedScope": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/modifiedScopeType"
},
"modifiedUserInteraction": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/modifiedUserInteractionType"
},
"privilegesRequired": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/privilegesRequiredType"
},
"remediationLevel": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/remediationLevelType"
},
"reportConfidence": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/confidenceType"
},
"scope": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/scopeType"
},
"temporalScore": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/scoreType"
},
"temporalSeverity": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/severityType"
},
"userInteraction": {
"$ref": "#/definitions/metrics/items/properties/cvssV3_1/definitions/userInteractionType"
},
"vectorString": {
"type": "string"
},
"version": {
"description": "CVSS Version",
"type": "string"
}
},
"required": [
"version",
"vectorString",
"baseScore",
"baseSeverity"
],
"type": "object"
},
"cvssV4_0": {
"$schema": "http://json-schema.org/draft-07/schema#",
"additionalProperties": false,
"allOf": [
{
"properties": {
"baseScore": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/noneScoreType"
},
"baseSeverity": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/noneSeverityType"
}
}
},
{
"properties": {
"threatScore": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/noneScoreType"
},
"threatSeverity": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/noneSeverityType"
}
}
},
{
"properties": {
"environmentalScore": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/noneScoreType"
},
"environmentalSeverity": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/noneSeverityType"
}
}
}
],
"definitions": {
"attackComplexityType": {
"type": "string"
},
"attackRequirementsType": {
"type": "string"
},
"attackVectorType": {
"type": "string"
},
"automatableType": {
"type": "string"
},
"ciaRequirementType": {
"type": "string"
},
"criticalScoreType": {
"type": "number"
},
"criticalSeverityType": {
"const": "string"
},
"exploitMaturityType": {
"type": "string"
},
"highScoreType": {
"type": "number"
},
"highSeverityType": {
"type": "string"
},
"lowScoreType": {
"type": "number"
},
"lowSeverityType": {
"type": "string"
},
"mediumScoreType": {
"type": "number"
},
"mediumSeverityType": {
"const": "string"
},
"modifiedAttackComplexityType": {
"type": "string"
},
"modifiedAttackRequirementsType": {
"type": "string"
},
"modifiedAttackVectorType": {
"type": "string"
},
"modifiedPrivilegesRequiredType": {
"type": "string"
},
"modifiedSubCType": {
"type": "string"
},
"modifiedSubIaType": {
"type": "string"
},
"modifiedUserInteractionType": {
"type": "string"
},
"modifiedVulnCiaType": {
"type": "string"
},
"noneScoreType": {
"type": "number"
},
"noneSeverityType": {
"const": "string"
},
"privilegesRequiredType": {
"type": "string"
},
"providerUrgencyType": {
"type": "string"
},
"recoveryType": {
"type": "string"
},
"safetyType": {
"type": "string"
},
"scoreType": {
"type": "number"
},
"severityType": {
"type": "string"
},
"subCiaType": {
"type": "string"
},
"userInteractionType": {
"type": "string"
},
"valueDensityType": {
"type": "string"
},
"vulnCiaType": {
"type": "string"
},
"vulnerabilityResponseEffortType": {
"type": "string"
}
},
"properties": {
"Automatable": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/automatableType"
},
"Recovery": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/recoveryType"
},
"Safety": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/safetyType"
},
"attackComplexity": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/attackComplexityType"
},
"attackRequirements": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/attackRequirementsType"
},
"attackVector": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/attackVectorType"
},
"availabilityRequirement": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/ciaRequirementType"
},
"baseScore": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/scoreType"
},
"baseSeverity": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/severityType"
},
"confidentialityRequirement": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/ciaRequirementType"
},
"exploitMaturity": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/exploitMaturityType"
},
"integrityRequirement": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/ciaRequirementType"
},
"modifiedAttackComplexity": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/modifiedAttackComplexityType"
},
"modifiedAttackRequirements": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/modifiedAttackRequirementsType"
},
"modifiedAttackVector": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/modifiedAttackVectorType"
},
"modifiedPrivilegesRequired": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/modifiedPrivilegesRequiredType"
},
"modifiedSubAvailabilityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/modifiedSubIaType"
},
"modifiedSubConfidentialityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/modifiedSubCType"
},
"modifiedSubIntegrityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/modifiedSubIaType"
},
"modifiedUserInteraction": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/modifiedUserInteractionType"
},
"modifiedVulnAvailabilityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/modifiedVulnCiaType"
},
"modifiedVulnConfidentialityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/modifiedVulnCiaType"
},
"modifiedVulnIntegrityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/modifiedVulnCiaType"
},
"privilegesRequired": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/privilegesRequiredType"
},
"providerUrgency": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/providerUrgencyType"
},
"subAvailabilityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/subCiaType"
},
"subConfidentialityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/subCiaType"
},
"subIntegrityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/subCiaType"
},
"userInteraction": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/userInteractionType"
},
"valueDensity": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/valueDensityType"
},
"vectorString": {
"type": "string"
},
"version": {
"description": "CVSS Version",
"enum": [
"4.0"
],
"type": "string"
},
"vulnAvailabilityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/vulnCiaType"
},
"vulnConfidentialityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/vulnCiaType"
},
"vulnIntegrityImpact": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/vulnCiaType"
},
"vulnerabilityResponseEffort": {
"$ref": "#/definitions/metrics/items/properties/cvssV4_0/definitions/vulnerabilityResponseEffortType"
}
},
"required": [
"version",
"vectorString",
"baseScore",
"baseSeverity"
],
"title": "JSON Schema for Common Vulnerability Scoring System version 4.0",
"type": "object"
},
"format": {
"type": "string"
},
"other": {
"properties": {
"content": {
"type": "object"
},
"type": {
"type": "string"
}
},
"required": [
"type",
"content"
],
"type": "object"
},
"scenarios": {
"items": {
"properties": {
"lang": {
"$ref": "#/definitions/language"
},
"value": {
"type": "string"
}
},
"required": [
"lang",
"value"
],
"type": "object"
},
"minItems": 1,
"type": "array",
"uniqueItems": true
}
},
"type": "object"
},
"minItems": 1,
"type": "array",
"uniqueItems": true
},
"orgId": {
"$ref": "#/definitions/uuidType"
},
"problemTypes": {
"items": {
"properties": {
"descriptions": {
"items": {
"properties": {
"cweId": {
"type": "string"
},
"description": {
"type": "string"
},
"lang": {
"$ref": "#/definitions/language"
},
"references": {
"$ref": "#/definitions/references"
},
"type": {
"type": "string"
}
},
"required": [
"lang",
"description"
],
"type": "object"
},
"minItems": 1,
"type": "array",
"uniqueItems": true
}
},
"required": [
"descriptions"
],
"type": "object"
},
"minItems": 1,
"type": "array",
"uniqueItems": true
},
"product": {
"allOf": [
{
"anyOf": [
{
"required": [
"vendor",
"product"
]
},
{
"required": [
"collectionURL",
"packageName"
]
}
]
},
{
"anyOf": [
{
"required": [
"versions"
]
},
{
"required": [
"defaultStatus"
]
}
]
}
],
"properties": {
"collectionURL": {
"$ref": "#/definitions/uriType"
},
"cpes": {
"items": {
"type": "string"
},
"type": "array",
"uniqueItems": true
},
"defaultStatus": {
"$ref": "#/definitions/status"
},
"modules": {
"items": {
"type": "string"
},
"type": "array",
"uniqueItems": true
},
"packageName": {
"type": "string"
},
"platforms": {
"items": {
"type": "string"
},
"type": "array",
"uniqueItems": true
},
"product": {
"type": "string"
},
"programFiles": {
"items": {
"type": "string"
},
"type": "array",
"uniqueItems": true
},
"programRoutines": {
"items": {
"properties": {
"name": {
"type": "string"
}
},
"required": [
"name"
],
"type": "object"
},
"type": "array",
"uniqueItems": true
},
"repo": {
"$ref": "#/definitions/uriType"
},
"vendor": {
"type": "string"
},
"versions": {
"items": {
"oneOf": [
{
"maxProperties": 2,
"required": [
"version",
"status"
]
},
{
"oneOf": [
{
"required": [
"lessThan"
]
},
{
"required": [
"lessThanOrEqual"
]
}
],
"required": [
"version",
"status",
"versionType"
]
}
],
"properties": {
"changes": {
"items": {
"properties": {
"at": {
"$ref": "#/definitions/version"
},
"status": {
"$ref": "#/definitions/status"
}
},
"required": [
"at",
"status"
],
"type": "object"
},
"minItems": 1,
"type": "array",
"uniqueItems": true
},
"lessThan": {
"$ref": "#/definitions/version"
},
"lessThanOrEqual": {
"$ref": "#/definitions/version"
},
"status": {
"$ref": "#/definitions/status"
},
"version": {
"$ref": "#/definitions/version"
},
"versionType": {
"type": "string"
}
},
"type": "object"
},
"type": "array",
"uniqueItems": true
}
},
"type": "object"
},
"providerMetadata": {
"properties": {
"dateUpdated": {
"$ref": "#/definitions/timestamp"
},
"orgId": {
"$ref": "#/definitions/orgId"
},
"shortName": {
"$ref": "#/definitions/shortName"
}
},
"required": [
"orgId"
],
"type": "object"
},
"reference": {
"properties": {
"name": {
"type": "string"
},
"tags": {
"items": {
"oneOf": [
{
"$ref": "#/definitions/tagExtension"
},
{
"$id": "https://cve.mitre.org/cve/v5_00/tags/reference/",
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "string"
}
]
},
"type": "array"
},
"url": {
"$ref": "#/definitions/uriType"
}
},
"required": [
"url"
],
"type": "object"
},
"references": {
"items": {
"$ref": "#/definitions/reference"
},
"maxItems": 512,
"minItems": 1,
"type": "array",
"uniqueItems": true
},
"shortName": {
"type": "string"
},
"solutions": {
"items": {
"$ref": "#/definitions/description"
},
"minItems": 1,
"type": "array",
"uniqueItems": true
},
"source": {
"minProperties": 1,
"type": "object"
},
"status": {
"type": "string"
},
"tagExtension": {
"type": "string"
},
"taxonomyMappings": {
"items": {
"properties": {
"taxonomyName": {
"maxLength": 128,
"minLength": 1,
"type": "string"
},
"taxonomyRelations": {
"items": {
"properties": {
"relationshipName": {
"maxLength": 128,
"minLength": 1,
"type": "string"
},
"relationshipValue": {
"maxLength": 2048,
"minLength": 1,
"type": "string"
},
"taxonomyId": {
"maxLength": 2048,
"minLength": 1,
"type": "string"
}
},
"required": [
"taxonomyId",
"relationshipName",
"relationshipValue"
],
"type": "object"
},
"minItems": 1,
"type": "array",
"uniqueItems": true
},
"taxonomyVersion": {
"maxLength": 128,
"minLength": 1,
"type": "string"
}
},
"required": [
"taxonomyName",
"taxonomyRelations"
],
"type": "object"
},
"minItems": 1,
"type": "array",
"uniqueItems": true
},
"timeline": {
"items": {
"properties": {
"lang": {
"$ref": "#/definitions/language"
},
"time": {
"$ref": "#/definitions/timestamp"
},
"value": {
"type": "string"
}
},
"required": [
"time",
"lang",
"value"
],
"type": "object"
},
"minItems": 1,
"type": "array",
"uniqueItems": true
},
"timestamp": {
"format": "date-time",
"type": "string"
},
"uriType": {
"format": "uri",
"type": "string"
},
"userId": {
"$ref": "#/definitions/uuidType"
},
"uuidType": {
"type": "string"
},
"version": {
"type": "string"
},
"workarounds": {
"items": {
"$ref": "#/definitions/description"
},
"minItems": 1,
"type": "array",
"uniqueItems": true
}
},
"description": "cve-schema specifies the CVE JSON record format. This is the blueprint for a rich set of JSON data that can be submitted by CVE Numbering Authorities (CNAs) and Authorized Data Publishers (ADPs) to describe a CVE Record. Some examples of CVE Record data include CVE ID number, affected product(s), affected version(s), and public references. While those specific items are required when assigning a CVE, there are many other optional data in the schema that can be used to enrich CVE Records for community benefit. Learn more about the CVE program at [the official website](https://cve.mitre.org). This CVE JSON record format is defined using JSON Schema. Learn more about JSON Schema [here](https://json-schema.org/).",
"properties": {
"adpContainer": {
"$ref": "#/definitions/adpContainer"
}
},
"required": [
"adpContainer"
],
"title": "CVE JSON record format",
"type": "object"
},
"Comment": {
"properties": {
"author": {
"allOf": [
{
"$ref": "#/definitions/User"
}
],
"readOnly": true
},
"creation_timestamp": {
"description": "Creation time of the comment.",
"format": "date-time",
"readOnly": true,
"type": "string"
},
"description": {
"description": "Description.",
"type": "string"
},
"description_format": {
"description": "Description format (markdown or text).",
"type": "string"
},
"meta": {
"description": "Zero or more meta-fields.",
"type": "object"
},
"related_vulnerabilities": {
"description": "One or more vulnerability references (CVE ID, GHSA-ID, PYSEC ID, etc.) for this comment.",
"items": {
"type": "string"
},
"type": "array"
},
"timestamp": {
"description": "Updated time of the comment.",
"format": "date-time",
"readOnly": true,
"type": "string"
},
"title": {
"description": "Comment title.",
"type": "string"
},
"uuid": {
"description": "Comment uuid.",
"type": "string"
},
"vulnerability": {
"description": "Vulnerability id.",
"type": "string"
},
"vulnerability_lookup_origin": {
"default": "8627204d-fee7-4bdf-8707-5f0833b57c82",
"description": "UUID of the Vulnerability-Lookup origin instance.",
"readOnly": true,
"type": "string"
}
},
"type": "object"
},
"CommentsList": {
"properties": {
"data": {
"description": "List of comments.",
"items": {
"$ref": "#/definitions/Comment"
},
"type": "array"
},
"metadata": {
"allOf": [
{
"$ref": "#/definitions/metadata"
}
],
"description": "Metadata related to the result."
}
},
"type": "object"
},
"CreateCveRecordModel": {
"$schema": "http://json-schema.org/draft-04/schema",
"properties": {
"message": {
"type": "string"
},
"updated": {
"properties": {
"containers": {
"properties": {
"cna": {
"properties": {
"affected": {
"properties": {
"product": {
"type": "string"
},
"vendor": {
"type": "string"
},
"versions": {
"items": {
"properties": {
"status": {
"type": "string"
},
"version": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
}
},
"type": "object"
},
"dataType": {
"type": "string"
},
"dataVersion": {
"type": "string"
},
"descriptions": {
"items": {
"properties": {
"lang": {
"type": "string"
},
"value": {
"type": "string"
}
},
"type": "object"
},
"required": [
"lang",
"value"
],
"type": "array"
},
"problemTypes": {
"items": {
"properties": {
"descriptions": {
"items": {
"properties": {
"description": {
"type": "string"
},
"lang": {
"type": "string"
},
"type": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
}
},
"type": "object"
},
"type": "array"
},
"providerMetadata": {
"properties": {
"orgId": {
"type": "string"
}
},
"type": "object"
},
"references": {
"items": {
"properties": {
"name": {
"type": "string"
},
"url": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
}
},
"type": "object"
}
},
"type": "object"
},
"cveMetadata": {
"properties": {
"assignerOrgId": {
"type": "string"
},
"assignerShortName": {
"type": "string"
},
"cveId": {
"type": "string"
},
"datePublished": {
"type": "string"
},
"dateReserved": {
"type": "string"
},
"requesterUserId": {
"type": "string"
},
"state": {
"type": "string"
}
},
"type": "object"
},
"dataType": {
"type": "string"
},
"dataVersion": {
"type": "string"
}
},
"type": "object"
}
},
"type": "object"
},
"CveCursorUnionResponse": {
"$schema": "http://json-schema.org/draft-04/schema#",
"oneOf": [
{
"$schema": "http://json-schema.org/draft-04/schema",
"properties": {
"cveRecords": {
"items": {
"properties": {
"containers": {
"properties": {
"cna": {
"properties": {
"affected": {
"properties": {
"vendor": {
"type": "string"
},
"versions": {
"items": {
"properties": {
"status": {
"type": "string"
},
"version": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
}
},
"type": "object"
},
"descriptions": {
"items": {
"properties": {
"lang": {
"type": "string"
},
"value": {
"type": "string"
}
},
"type": "object"
},
"required": [
"lang",
"value"
],
"type": "array"
},
"problemTypes": {
"items": {
"properties": {
"descriptions": {
"items": {
"properties": {
"description": {
"type": "string"
},
"lang": {
"type": "string"
},
"type": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
}
},
"type": "object"
},
"type": "array"
},
"providerMetadata": {
"properties": {
"orgId": {
"type": "string"
}
},
"type": "object"
},
"references": {
"items": {
"properties": {
"name": {
"type": "string"
},
"tags": {
"items": {
"type": "string"
},
"type": "array"
},
"url": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
}
},
"type": "object"
}
},
"type": "object"
},
"cveMetadata": {
"properties": {
"assignerOrgId": {
"type": "string"
},
"assignerShortName": {
"type": "string"
},
"cveId": {
"type": "string"
},
"datePublished": {
"type": "string"
},
"dateReserved": {
"type": "string"
},
"requesterUserId": {
"type": "string"
},
"state": {
"type": "string"
}
},
"type": "object"
},
"dataType": {
"type": "string"
},
"dataVersion": {
"type": "integer"
}
},
"type": "object"
},
"type": "array"
},
"hasNext": {
"type": "boolean"
},
"hasPrevious": {
"type": "boolean"
},
"next": {
"type": "string"
},
"previous": {
"type": "string"
}
},
"type": "object"
},
{
"$schema": "http://json-schema.org/draft-04/schema",
"properties": {
"created": {
"properties": {
"containers": {
"properties": {
"cna": {
"properties": {
"providerMetadata": {
"properties": {
"dateUpdated": {
"format": "date-time",
"type": "string"
},
"orgId": {
"type": "string"
},
"shortName": {
"type": "string"
}
},
"type": "object"
},
"rejectedReasons": {
"items": {
"properties": {
"lang": {
"type": "string"
},
"supportingMedia": {
"items": {
"properties": {
"base64": {
"default": false,
"description": "If true then the value field contains the media data encoded in base64. If false then the value field contains the UTF-8 media content.",
"title": "Encoding",
"type": "boolean"
},
"type": {
"description": "RFC2046 compliant IANA Media type for eg., text/markdown, text/html.",
"examples": [
"text/markdown",
"text/html",
"image/png",
"image/svg",
"audio/mp3"
],
"maxLength": 256,
"minLength": 1,
"title": "Media type",
"type": "string"
},
"value": {
"description": "Supporting media content, up to 16K. If base64 is true, this field stores base64 encoded data.",
"maxLength": 16384,
"minLength": 1,
"type": "string"
}
},
"required": [
"type",
"value"
],
"type": "object"
},
"type": "array"
},
"value": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
},
"replacedBy": {
"items": {
"type": "string"
},
"type": "array"
}
},
"type": "object"
}
},
"type": "object"
},
"cveMetadata": {
"properties": {
"assignerOrgId": {
"type": "string"
},
"assignerShortName": {
"type": "string"
},
"cveId": {
"type": "string"
},
"datePublished": {
"type": "string"
},
"dateReserved": {
"type": "string"
},
"requesterUserId": {
"type": "string"
},
"state": {
"type": "string"
}
},
"type": "object"
},
"dataType": {
"type": "string"
},
"dataVersion": {
"type": "string"
}
},
"type": "object"
},
"message": {
"type": "string"
}
},
"type": "object"
}
]
},
"CveGetUnionResponse": {
"$schema": "http://json-schema.org/draft-04/schema#",
"oneOf": [
{
"$schema": "http://json-schema.org/draft-04/schema",
"properties": {
"containers": {
"properties": {
"cna": {
"properties": {
"affected": {
"properties": {
"vendor": {
"type": "string"
},
"versions": {
"items": {
"properties": {
"status": {
"type": "string"
},
"version": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
}
},
"type": "object"
},
"descriptions": {
"items": {
"properties": {
"lang": {
"type": "string"
},
"value": {
"type": "string"
}
},
"type": "object"
},
"required": [
"lang",
"value"
],
"type": "array"
},
"problemTypes": {
"items": {
"properties": {
"descriptions": {
"items": {
"properties": {
"description": {
"type": "string"
},
"lang": {
"type": "string"
},
"type": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
}
},
"type": "object"
},
"type": "array"
},
"providerMetadata": {
"properties": {
"orgId": {
"type": "string"
}
},
"type": "object"
},
"references": {
"items": {
"properties": {
"name": {
"type": "string"
},
"tags": {
"items": {
"type": "string"
},
"type": "array"
},
"url": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
}
},
"type": "object"
}
},
"type": "object"
},
"cveMetadata": {
"properties": {
"assignerOrgId": {
"type": "string"
},
"assignerShortName": {
"type": "string"
},
"cveId": {
"type": "string"
},
"datePublished": {
"type": "string"
},
"dateReserved": {
"type": "string"
},
"requesterUserId": {
"type": "string"
},
"state": {
"type": "string"
}
},
"type": "object"
},
"dataType": {
"type": "string"
},
"dataVersion": {
"type": "string"
}
},
"type": "object"
},
{
"$schema": "http://json-schema.org/draft-04/schema",
"properties": {
"created": {
"properties": {
"containers": {
"properties": {
"cna": {
"properties": {
"providerMetadata": {
"properties": {
"dateUpdated": {
"format": "date-time",
"type": "string"
},
"orgId": {
"type": "string"
},
"shortName": {
"type": "string"
}
},
"type": "object"
},
"rejectedReasons": {
"items": {
"properties": {
"lang": {
"type": "string"
},
"supportingMedia": {
"items": {
"properties": {
"base64": {
"default": false,
"description": "If true then the value field contains the media data encoded in base64. If false then the value field contains the UTF-8 media content.",
"title": "Encoding",
"type": "boolean"
},
"type": {
"description": "RFC2046 compliant IANA Media type for eg., text/markdown, text/html.",
"examples": [
"text/markdown",
"text/html",
"image/png",
"image/svg",
"audio/mp3"
],
"maxLength": 256,
"minLength": 1,
"title": "Media type",
"type": "string"
},
"value": {
"description": "Supporting media content, up to 16K. If base64 is true, this field stores base64 encoded data.",
"maxLength": 16384,
"minLength": 1,
"type": "string"
}
},
"required": [
"type",
"value"
],
"type": "object"
},
"type": "array"
},
"value": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
},
"replacedBy": {
"items": {
"type": "string"
},
"type": "array"
}
},
"type": "object"
}
},
"type": "object"
},
"cveMetadata": {
"properties": {
"assignerOrgId": {
"type": "string"
},
"assignerShortName": {
"type": "string"
},
"cveId": {
"type": "string"
},
"datePublished": {
"type": "string"
},
"dateReserved": {
"type": "string"
},
"requesterUserId": {
"type": "string"
},
"state": {
"type": "string"
}
},
"type": "object"
},
"dataType": {
"type": "string"
},
"dataVersion": {
"type": "string"
}
},
"type": "object"
},
"message": {
"type": "string"
}
},
"type": "object"
}
]
},
"CveIdGetModel": {
"$schema": "http://json-schema.org/draft-04/schema",
"properties": {
"cve_id": {
"description": "^CVE-[0-9]{4}-[0-9]{4,}$",
"type": "string"
},
"cve_year": {
"description": "^[0-9]{4}$",
"type": "string"
},
"message": {
"type": "string"
},
"owning_cna": {
"description": "The shortname for the organization that owns the CVE ID",
"type": "string"
},
"requested_by": {
"properties": {
"cna": {
"description": "The shortname for the organization of the user that requested the ID",
"type": "string"
},
"user": {
"description": "The username for the account that requested the ID",
"type": "string"
}
},
"type": "object"
},
"reserved": {
"description": "The time the ID was reserved",
"format": "date-time",
"type": "string"
},
"state": {
"enum": [
"RESERVED",
"PUBLISHED",
"REJECTED"
],
"type": "string"
},
"time": {
"properties": {
"created": {
"description": "The time the ID was created",
"format": "date-time",
"type": "string"
},
"modified": {
"description": "The last time the ID was modified",
"format": "date-time",
"type": "string"
}
},
"type": "object"
}
},
"type": "object"
},
"CveIdListResponseModel": {
"$schema": "http://json-schema.org/draft-04/schema",
"properties": {
"currentPage": {
"description": "Current page",
"format": "int32",
"type": "integer"
},
"cve_ids": {
"items": {
"properties": {
"cve_id": {
"description": "^CVE-[0-9]{4}-[0-9]{4,}$",
"type": "string"
},
"cve_year": {
"description": "^[0-9]{4}$",
"type": "string"
},
"owning_cna": {
"description": "The shortname for the organization that owns the CVE ID",
"type": "string"
},
"requested_by": {
"properties": {
"cna": {
"description": "The shortname for the organization of the user that requested the ID",
"type": "string"
},
"user": {
"description": "The username for the account that requested the ID",
"type": "string"
}
},
"type": "object"
},
"reserved": {
"description": "The time the ID was reserved",
"format": "date-time",
"type": "string"
},
"state": {
"enum": [
"RESERVED",
"PUBLISHED",
"REJECTED"
],
"type": "string"
},
"time": {
"properties": {
"created": {
"description": "The time the ID was created",
"format": "date-time",
"type": "string"
},
"modified": {
"description": "The last time the ID was modified",
"format": "date-time",
"type": "string"
}
},
"type": "object"
}
},
"type": "object"
},
"type": "array"
},
"itemsPerPage": {
"description": "Number of CVE records in a page",
"format": "int32",
"type": "integer"
},
"nextPage": {
"description": "Next page",
"format": "int32",
"type": "integer"
},
"pageCount": {
"description": "Total number of pages",
"format": "int32",
"type": "integer"
},
"prevPage": {
"description": "Previous page",
"format": "int32",
"type": "integer"
},
"totalCount": {
"description": "Total CVE records found",
"format": "int32",
"type": "integer"
}
},
"type": "object"
},
"CveIdUpdateModel": {
"$schema": "http://json-schema.org/draft-04/schema",
"properties": {
"message": {
"type": "string"
},
"updated": {
"properties": {
"cve_id": {
"description": "^CVE-[0-9]{4}-[0-9]{4,}$",
"type": "string"
},
"cve_year": {
"description": "^[0-9]{4}$",
"type": "string"
},
"owning_cna": {
"description": "The shortname for the organization that owns the CVE ID",
"type": "string"
},
"requested_by": {
"properties": {
"cna": {
"description": "The shortname for the organization of the user that requested the ID",
"type": "string"
},
"user": {
"description": "The username for the account that requested the ID",
"type": "string"
}
},
"type": "object"
},
"reserved": {
"description": "The time the ID was reserved",
"format": "date-time",
"type": "string"
},
"state": {
"enum": [
"RESERVED",
"PUBLISHED",
"REJECTED"
],
"type": "string"
},
"time": {
"properties": {
"created": {
"description": "The time the ID was created",
"format": "date-time",
"type": "string"
},
"modified": {
"description": "The last time the ID was modified",
"format": "date-time",
"type": "string"
}
},
"type": "object"
}
},
"type": "object"
}
},
"type": "object"
},
"CveListUnionResponse": {
"$schema": "http://json-schema.org/draft-04/schema#",
"oneOf": [
{
"$schema": "http://json-schema.org/draft-04/schema",
"properties": {
"currentPage": {
"format": "int32",
"type": "integer"
},
"cveRecords": {
"items": {
"properties": {
"containers": {
"properties": {
"cna": {
"properties": {
"affected": {
"properties": {
"vendor": {
"type": "string"
},
"versions": {
"items": {
"properties": {
"status": {
"type": "string"
},
"version": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
}
},
"type": "object"
},
"descriptions": {
"items": {
"properties": {
"lang": {
"type": "string"
},
"value": {
"type": "string"
}
},
"type": "object"
},
"required": [
"lang",
"value"
],
"type": "array"
},
"problemTypes": {
"items": {
"properties": {
"descriptions": {
"items": {
"properties": {
"description": {
"type": "string"
},
"lang": {
"type": "string"
},
"type": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
}
},
"type": "object"
},
"type": "array"
},
"providerMetadata": {
"properties": {
"orgId": {
"type": "string"
}
},
"type": "object"
},
"references": {
"items": {
"properties": {
"name": {
"type": "string"
},
"tags": {
"items": {
"type": "string"
},
"type": "array"
},
"url": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
}
},
"type": "object"
}
},
"type": "object"
},
"cveMetadata": {
"properties": {
"assignerOrgId": {
"type": "string"
},
"assignerShortName": {
"type": "string"
},
"cveId": {
"type": "string"
},
"datePublished": {
"type": "string"
},
"dateReserved": {
"type": "string"
},
"requesterUserId": {
"type": "string"
},
"state": {
"type": "string"
}
},
"type": "object"
},
"dataType": {
"type": "string"
},
"dataVersion": {
"type": "integer"
}
},
"type": "object"
},
"type": "array"
},
"itemsPerPage": {
"format": "int32",
"type": "integer"
},
"nextPage": {
"format": "int32",
"type": "integer"
},
"pageCount": {
"format": "int32",
"type": "integer"
},
"prevPage": {
"format": "int32",
"type": "integer"
},
"totalCount": {
"format": "int32",
"type": "integer"
}
},
"type": "object"
},
{
"$schema": "http://json-schema.org/draft-04/schema",
"properties": {
"created": {
"properties": {
"containers": {
"properties": {
"cna": {
"properties": {
"providerMetadata": {
"properties": {
"dateUpdated": {
"format": "date-time",
"type": "string"
},
"orgId": {
"type": "string"
},
"shortName": {
"type": "string"
}
},
"type": "object"
},
"rejectedReasons": {
"items": {
"properties": {
"lang": {
"type": "string"
},
"supportingMedia": {
"items": {
"properties": {
"base64": {
"default": false,
"description": "If true then the value field contains the media data encoded in base64. If false then the value field contains the UTF-8 media content.",
"title": "Encoding",
"type": "boolean"
},
"type": {
"description": "RFC2046 compliant IANA Media type for eg., text/markdown, text/html.",
"examples": [
"text/markdown",
"text/html",
"image/png",
"image/svg",
"audio/mp3"
],
"maxLength": 256,
"minLength": 1,
"title": "Media type",
"type": "string"
},
"value": {
"description": "Supporting media content, up to 16K. If base64 is true, this field stores base64 encoded data.",
"maxLength": 16384,
"minLength": 1,
"type": "string"
}
},
"required": [
"type",
"value"
],
"type": "object"
},
"type": "array"
},
"value": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
},
"replacedBy": {
"items": {
"type": "string"
},
"type": "array"
}
},
"type": "object"
}
},
"type": "object"
},
"cveMetadata": {
"properties": {
"assignerOrgId": {
"type": "string"
},
"assignerShortName": {
"type": "string"
},
"cveId": {
"type": "string"
},
"datePublished": {
"type": "string"
},
"dateReserved": {
"type": "string"
},
"requesterUserId": {
"type": "string"
},
"state": {
"type": "string"
}
},
"type": "object"
},
"dataType": {
"type": "string"
},
"dataVersion": {
"type": "string"
}
},
"type": "object"
},
"message": {
"type": "string"
}
},
"type": "object"
}
]
},
"CveRecordResponseModel": {
"$schema": "http://json-schema.org/draft-04/schema",
"properties": {
"created": {
"properties": {
"containers": {
"properties": {
"cna": {
"properties": {
"affected": {
"properties": {
"product": {
"type": "string"
},
"vendor": {
"type": "string"
},
"versions": {
"items": {
"properties": {
"status": {
"type": "string"
},
"version": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
}
},
"type": "object"
},
"descriptions": {
"items": {
"properties": {
"lang": {
"type": "string"
},
"value": {
"type": "string"
}
},
"type": "object"
},
"required": [
"lang",
"value"
],
"type": "array"
},
"problemTypes": {
"items": {
"properties": {
"descriptions": {
"items": {
"properties": {
"description": {
"type": "string"
},
"lang": {
"type": "string"
},
"type": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
}
},
"type": "object"
},
"type": "array"
},
"providerMetadata": {
"properties": {
"dateUpdated": {
"format": "date-time",
"type": "string"
},
"orgId": {
"type": "string"
},
"shortName": {
"type": "string"
}
},
"type": "object"
},
"references": {
"items": {
"properties": {
"name": {
"type": "string"
},
"tags": {
"items": {
"type": "string"
},
"type": "array"
},
"url": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
}
},
"type": "object"
}
},
"type": "object"
},
"cveMetadata": {
"properties": {
"assignerOrgId": {
"type": "string"
},
"assignerShortName": {
"type": "string"
},
"cveId": {
"type": "string"
},
"datePublished": {
"type": "string"
},
"dateReserved": {
"type": "string"
},
"requesterUserId": {
"type": "string"
},
"state": {
"type": "string"
}
},
"type": "object"
},
"dataType": {
"type": "string"
},
"dataVersion": {
"type": "string"
}
},
"type": "object"
},
"message": {
"type": "string"
}
},
"type": "object"
},
"CveRecordUpdateresponseModel": {
"$schema": "http://json-schema.org/draft-04/schema",
"properties": {
"message": {
"type": "string"
},
"updated": {
"properties": {
"containers": {
"properties": {
"cna": {
"properties": {
"affected": {
"properties": {
"product": {
"type": "string"
},
"vendor": {
"type": "string"
},
"versions": {
"items": {
"properties": {
"status": {
"type": "string"
},
"version": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
}
},
"type": "object"
},
"dataType": {
"type": "string"
},
"dataVersion": {
"type": "string"
},
"descriptions": {
"items": {
"properties": {
"lang": {
"type": "string"
},
"value": {
"type": "string"
}
},
"type": "object"
},
"required": [
"lang",
"value"
],
"type": "array"
},
"problemTypes": {
"items": {
"properties": {
"descriptions": {
"items": {
"properties": {
"description": {
"type": "string"
},
"lang": {
"type": "string"
},
"type": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
}
},
"type": "object"
},
"type": "array"
},
"providerMetadata": {
"properties": {
"orgId": {
"type": "string"
}
},
"type": "object"
},
"references": {
"items": {
"properties": {
"name": {
"type": "string"
},
"url": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
}
},
"type": "object"
}
},
"type": "object"
},
"cveMetadata": {
"properties": {
"assignerOrgId": {
"type": "string"
},
"assignerShortName": {
"type": "string"
},
"cveId": {
"type": "string"
},
"datePublished": {
"type": "string"
},
"dateReserved": {
"type": "string"
},
"requesterUserId": {
"type": "string"
},
"state": {
"type": "string"
}
},
"type": "object"
},
"dataType": {
"type": "string"
},
"dataVersion": {
"type": "string"
}
},
"type": "object"
}
},
"type": "object"
},
"EMB3DsList": {
"properties": {
"data": {
"description": "List of Adversarial Techniques from MITRE EMB3D.",
"items": {
"$ref": "#/definitions/Emb3d"
},
"type": "array"
},
"metadata": {
"allOf": [
{
"$ref": "#/definitions/metadata"
}
],
"description": "Metadata related to the result."
}
},
"type": "object"
},
"EUVD": {
"properties": {
"aliases": {
"description": "Identifiers this entry is also known by.",
"items": {
"type": "string"
},
"type": "array"
},
"assigner": {
"description": "CNA that assigned the linked CVE.",
"type": "string"
},
"cvss": {
"allOf": [
{
"$ref": "#/definitions/EUVDCvss"
}
],
"description": "Highest-version CVSS metric of the linked CVE."
},
"date_published": {
"description": "ISO-8601 publication timestamp.",
"type": "string"
},
"date_updated": {
"description": "ISO-8601 last-update timestamp.",
"type": "string"
},
"description": {
"description": "Description of the linked CVE.",
"type": "string"
},
"epss": {
"description": "EPSS probability (0..1) of the linked CVE.",
"type": "number"
},
"exploited_since": {
"description": "ISO-8601 timestamp of the earliest KEV listing.",
"type": "string"
},
"id": {
"description": "EUVD identifier, e.g. EUVD-2026-0001.",
"type": "string"
},
"products": {
"description": "Affected products.",
"items": {
"$ref": "#/definitions/EUVDProduct"
},
"type": "array"
},
"references": {
"description": "Reference URLs.",
"items": {
"type": "string"
},
"type": "array"
},
"vendors": {
"description": "Affected vendor names.",
"items": {
"type": "string"
},
"type": "array"
}
},
"type": "object"
},
"EUVDAdvisory": {
"properties": {
"aliases": {
"description": "CVEs the advisory covers.",
"items": {
"type": "string"
},
"type": "array"
},
"date_published": {
"description": "ISO-8601 initial release.",
"type": "string"
},
"date_updated": {
"description": "ISO-8601 current release.",
"type": "string"
},
"euvds": {
"description": "EUVD entries this advisory covers.",
"items": {
"$ref": "#/definitions/EUVD"
},
"type": "array"
},
"id": {
"description": "The advisory's own tracking id.",
"type": "string"
},
"products": {
"items": {
"$ref": "#/definitions/EUVDAdvisoryProduct"
},
"type": "array"
},
"references": {
"description": "The advisory's own URLs.",
"items": {
"type": "string"
},
"type": "array"
},
"source": {
"description": "VL source holding the advisory.",
"type": "string"
},
"summary": {
"description": "The advisory's summary note.",
"type": "string"
},
"title": {
"description": "Advisory title.",
"type": "string"
}
},
"type": "object"
},
"EUVDAdvisoryProduct": {
"properties": {
"name": {
"description": "Product name from the CSAF product tree.",
"type": "string"
},
"vendor": {
"description": "Nearest enclosing vendor branch.",
"type": "string"
}
},
"type": "object"
},
"EUVDCvss": {
"properties": {
"base_score": {
"description": "CVSS base score.",
"type": "number"
},
"vector": {
"description": "CVSS vector string.",
"type": "string"
},
"version": {
"description": "CVSS version the score comes from.",
"type": "string"
}
},
"type": "object"
},
"EUVDDetail": {
"allOf": [
{
"$ref": "#/definitions/EUVD"
},
{
"properties": {
"advisories": {
"description": "CSAF advisories covering this entry.",
"items": {
"$ref": "#/definitions/EUVDLinkedAdvisory"
},
"type": "array"
},
"vulnerabilities": {
"description": "The records this EUVD is an identifier for.",
"items": {
"$ref": "#/definitions/EUVDLinkedVulnerability"
},
"type": "array"
}
},
"type": "object"
}
]
},
"EUVDError": {
"properties": {
"message": {
"description": "Why the request could not be answered.",
"type": "string"
}
},
"type": "object"
},
"EUVDLinkedAdvisory": {
"properties": {
"id": {
"description": "The advisory's own tracking id.",
"type": "string"
},
"source": {
"description": "VL source holding the advisory.",
"type": "string"
}
},
"type": "object"
},
"EUVDLinkedVulnerability": {
"properties": {
"assigner": {
"description": "CNA that assigned the record.",
"type": "string"
},
"cvss": {
"$ref": "#/definitions/EUVDCvss"
},
"date_published": {
"description": "ISO-8601 publication timestamp.",
"type": "string"
},
"date_updated": {
"description": "ISO-8601 last-update timestamp.",
"type": "string"
},
"description": {
"description": "Description of the record.",
"type": "string"
},
"epss": {
"description": "EPSS probability (0..1).",
"type": "number"
},
"id": {
"description": "Identifier, e.g. CVE-2026-1234.",
"type": "string"
},
"products": {
"items": {
"$ref": "#/definitions/EUVDProduct"
},
"type": "array"
},
"references": {
"description": "Reference URLs.",
"items": {
"type": "string"
},
"type": "array"
},
"status": {
"description": "Lifecycle state: PUBLISHED, REJECTED, RESERVED.",
"type": "string"
},
"vendors": {
"description": "Affected vendor names.",
"items": {
"type": "string"
},
"type": "array"
}
},
"type": "object"
},
"EUVDList": {
"properties": {
"data": {
"items": {
"$ref": "#/definitions/EUVD"
},
"type": "array"
},
"metadata": {
"$ref": "#/definitions/EUVDListMetadata"
}
},
"type": "object"
},
"EUVDListMetadata": {
"properties": {
"count": {
"description": "Number of entries returned.",
"type": "integer"
},
"limit": {
"description": "Maximum that was requested.",
"type": "integer"
}
},
"type": "object"
},
"EUVDProduct": {
"properties": {
"name": {
"description": "Product name, as the CNA wrote it.",
"type": "string"
},
"vendor": {
"description": "Vendor name, as the CNA wrote it.",
"type": "string"
},
"version": {
"description": "Affected version or version range.",
"type": "string"
}
},
"type": "object"
},
"EUVDSearchMetadata": {
"properties": {
"count": {
"description": "Entries matching the filters. A total when count_is_exact is true, otherwise a lower bound.",
"type": "integer"
},
"count_is_exact": {
"description": "True when the walk reached the end of the index, so count is the complete total; false when it stopped at its bound.",
"type": "boolean"
},
"has_more": {
"description": "True when further entries are available beyond this page.",
"type": "boolean"
},
"page": {
"description": "Page returned (1-indexed).",
"type": "integer"
},
"per_page": {
"description": "Entries per page.",
"type": "integer"
}
},
"type": "object"
},
"EUVDSearchResult": {
"properties": {
"data": {
"items": {
"$ref": "#/definitions/EUVD"
},
"type": "array"
},
"metadata": {
"$ref": "#/definitions/EUVDSearchMetadata"
}
},
"type": "object"
},
"EUVDStatsAssignerRank": {
"properties": {
"assigner": {
"description": "CNA short name, as the CVE records it.",
"type": "string"
},
"count": {
"description": "Records assigned.",
"type": "number"
}
},
"type": "object"
},
"EUVDStatsCount": {
"properties": {
"available": {
"description": "False when the counters have never been prepared; counts is then empty.",
"type": "boolean"
},
"counts": {
"description": "Period (YYYY or YYYY-MM) -> record count.",
"type": "object"
},
"granularity": {
"description": "year or month.",
"type": "string"
}
},
"type": "object"
},
"EUVDStatsDistribution": {
"properties": {
"available": {
"description": "False when the distribution has never been prepared; distribution is then empty.",
"type": "boolean"
},
"distribution": {
"description": "Bucket -> record count.",
"type": "object"
},
"period": {
"description": "The publication year the distribution covers, or null for the whole catalogue.",
"type": "string"
}
},
"type": "object"
},
"EUVDStatsError": {
"properties": {
"message": {
"description": "Why the request could not be answered.",
"type": "string"
}
},
"type": "object"
},
"EUVDStatsKEV": {
"properties": {
"available": {
"description": "False before the KEV sync has built the exploited index.",
"type": "boolean"
},
"catalogs": {
"description": "Catalogue short name -> record count. These overlap: a record listed by two catalogues is counted by both, so they do not sum to `exploited`.",
"type": "object"
},
"exploited": {
"description": "Records whose CVE appears in at least one known-exploited catalogue.",
"type": "integer"
},
"ratio": {
"description": "exploited / total, or null when the catalogue is empty.",
"type": "number"
},
"total": {
"description": "Records in the catalogue.",
"type": "integer"
},
"unattributed": {
"description": "Exploited records held under a catalogue this instance cannot name. Non-zero means the local GCVE reference data is absent or stale.",
"type": "integer"
}
},
"type": "object"
},
"EUVDStatsStatus": {
"properties": {
"published": {
"description": "Records carrying a publication date.",
"type": "integer"
},
"reserved": {
"description": "Records carrying a reservation date.",
"type": "integer"
},
"total": {
"description": "Records in the catalogue.",
"type": "integer"
}
},
"type": "object"
},
"EUVDStatsTimeToExploit": {
"properties": {
"available": {
"description": "False when the cross-store scan has never run.",
"type": "boolean"
},
"computed_at": {
"description": "When the snapshot was taken.",
"type": "string"
},
"count": {
"description": "Records the figure rests on -- those ever exploited.",
"type": "integer"
},
"cves_exploited": {
"description": "Distinct CVEs those entries named -- the denominator of the two unmatched counts.",
"type": "integer"
},
"entries_scanned": {
"description": "Known-exploited catalogue entries the scan read.",
"type": "integer"
},
"exploited_before_publication": {
"description": "Of count, how many were listed before the record was published.",
"type": "integer"
},
"max_days": {
"description": "Longest observed interval.",
"type": "number"
},
"mean_days": {
"description": "Mean days from publication to first listing.",
"type": "number"
},
"median_days": {
"description": "Median days, reported alongside the mean.",
"type": "number"
},
"min_days": {
"description": "Shortest observed interval.",
"type": "number"
},
"p90_days": {
"description": "90th percentile, nearest rank.",
"type": "number"
},
"unmatched_no_publication_date": {
"description": "Exploited records carrying no publication date, so they could not be dated.",
"type": "integer"
},
"unmatched_no_record": {
"description": "Exploited CVEs this source holds no record for, so they could not be dated. Reported rather than dropped: the figures above are a mean over what remains.",
"type": "integer"
}
},
"type": "object"
},
"EUVDStatsVendorRank": {
"properties": {
"count": {
"description": "Records affecting the vendor.",
"type": "number"
},
"vendor": {
"description": "Vendor name, as the CVE records it.",
"type": "string"
}
},
"type": "object"
},
"Emb3d": {
"properties": {
"CWE": {
"description": "CWE",
"readOnly": true,
"type": "object"
},
"Type": {
"description": "Type",
"readOnly": true,
"type": "string"
},
"description": {
"description": "Description",
"readOnly": true,
"type": "string"
},
"id": {
"description": "Identifiant",
"readOnly": true,
"type": "string"
}
},
"type": "object"
},
"Evidence": {
"properties": {
"confidence": {
"description": "Confidence (number 0.0-1.0 or string)",
"type": "object"
},
"details": {
"description": "Implementation-specific details",
"type": "object"
},
"signal": {
"description": "Evidence signal (string or array of strings)",
"type": "object"
},
"source": {
"description": "Evidence source (required)",
"type": "string"
},
"type": {
"description": "Evidence type (optional)",
"enum": [
"incident_response",
"telemetry",
"honeypot",
"sinkhole",
"vendor_report",
"csirt_report",
"public_report",
"research_report",
"unknown"
],
"example": "incident_response",
"type": "string"
}
},
"required": [
"source"
],
"type": "object"
},
"GCVERoot": {
"properties": {
"gna": {
"description": "GNA ID identifying the origin of the KEV assertion (0-65535)",
"maximum": 65535,
"minimum": 0,
"type": "integer"
},
"object_uuid": {
"description": "UUID of the KEV assertion in the GCVE ecosystem",
"type": "string"
},
"origin_uuid": {
"description": "UUID of the origin instance where the KEV assertion originated",
"type": "string"
}
},
"type": "object"
},
"GNA": {
"properties": {
"cpe_vendor_name": {
"description": "Official CPE vendor name.",
"readOnly": true,
"type": "string"
},
"full_name": {
"description": "Full legal name of the organization.",
"readOnly": true,
"type": "string"
},
"gcve_allocation": {
"description": "URL of the interface used to allocate or register new vulnerabilities.",
"readOnly": true,
"type": "string"
},
"gcve_api": {
"description": "URL of the API endpoint providing vulnerability data.",
"readOnly": true,
"type": "string"
},
"gcve_dump": {
"description": "URL to a machine-readable dump (e.g., JSON) of vulnerability information.",
"readOnly": true,
"type": "string"
},
"gcve_pull_api": {
"description": "URL of the interface compatible to retrieve the local GNA publications.",
"readOnly": true,
"type": "string"
},
"gcve_url": {
"description": "URL to the public vulnerability disclosure website.",
"readOnly": true,
"type": "string"
},
"id": {
"description": "Unique identifier for the GCVE Numbering Authority.",
"readOnly": true,
"type": "string"
},
"short_name": {
"description": "Short name of the organization.",
"readOnly": true,
"type": "string"
}
},
"type": "object"
},
"GNAsList": {
"properties": {
"data": {
"description": "List of GNAs.",
"items": {
"$ref": "#/definitions/GNA"
},
"type": "array"
},
"metadata": {
"allOf": [
{
"$ref": "#/definitions/metadata"
}
],
"description": "Metadata related to the result."
}
},
"type": "object"
},
"GenericErrorModel": {
"$schema": "http://json-schema.org/draft-04/schema",
"properties": {
"error": {
"description": "Error name",
"type": "string"
},
"message": {
"description": "Error description",
"type": "string"
}
},
"type": "object"
},
"KEVEntry": {
"properties": {
"characteristics": {
"description": "Technical characteristics",
"type": "object"
},
"evidence": {
"description": "Supporting evidence",
"items": {
"$ref": "#/definitions/Evidence"
},
"type": "array"
},
"gcve": {
"allOf": [
{
"$ref": "#/definitions/GCVERoot"
}
],
"description": "GCVE origin metadata for the KEV assertion"
},
"references": {
"description": "Related references",
"type": "object"
},
"scope": {
"description": "Geographical/sectoral context",
"type": "object"
},
"status": {
"$ref": "#/definitions/Status"
},
"timestamps": {
"description": "Temporal context",
"type": "object"
},
"uuid": {
"description": "KEV entry UUID",
"readOnly": true,
"type": "string"
},
"vulnerability": {
"$ref": "#/definitions/Vulnerability"
}
},
"type": "object"
},
"KEVList": {
"properties": {
"data": {
"items": {
"$ref": "#/definitions/KEVEntry"
},
"type": "array"
},
"metadata": {
"$ref": "#/definitions/ListMetadata"
}
},
"type": "object"
},
"ListMetadata": {
"properties": {
"count": {
"description": "Total number of the items of the data.",
"readOnly": true,
"type": "integer"
},
"page": {
"description": "Number of the page.",
"readOnly": true,
"type": "integer"
},
"per_page": {
"description": "Requested limit data.",
"readOnly": true,
"type": "integer"
}
},
"type": "object"
},
"MappingNotes": {
"properties": {
"Usage": {
"description": "Mapping usage of the CWE (Allowed, Allowed-with-Review, Discouraged, Prohibited)",
"type": "string"
}
},
"type": "object"
},
"Mitigation": {
"properties": {
"@Mitigation_ID": {
"description": "Id of the mitigation",
"type": "string"
},
"Description": {
"description": "Description of the mitigation",
"type": "string"
}
},
"required": [
"@Mitigation_ID",
"Description"
],
"type": "object"
},
"Mitigations": {
"properties": {
"Mitigation": {
"description": "List of potential mitigations",
"items": {
"$ref": "#/definitions/Mitigation"
},
"type": "array"
}
},
"type": "object"
},
"Organization": {
"properties": {
"creation_timestamp": {
"description": "Creation time of the organization.",
"format": "date-time",
"readOnly": true,
"type": "string"
},
"description": {
"description": "Description.",
"type": "string"
},
"gna_id": {
"description": "The reserved GNA identifier of the organization.",
"type": "integer"
},
"id": {
"description": "Organization id.",
"type": "string"
},
"name": {
"description": "Organization name.",
"type": "string"
},
"short_name": {
"description": "Organization short name.",
"type": "string"
},
"updated_timestamp": {
"description": "Updated time of the organization.",
"format": "date-time",
"readOnly": true,
"type": "string"
},
"uuid": {
"description": "Organization uuid.",
"type": "string"
}
},
"type": "object"
},
"OrganizationsList": {
"properties": {
"data": {
"description": "List of organizations.",
"items": {
"$ref": "#/definitions/Organization"
},
"type": "array"
},
"metadata": {
"allOf": [
{
"$ref": "#/definitions/metadata"
}
],
"description": "Metadata related to the result."
}
},
"type": "object"
},
"PartialReservedCveIdsResponseModel": {
"$schema": "http://json-schema.org/draft-04/schema",
"properties": {
"cve_ids": {
"items": {
"properties": {
"cve_id": {
"pattern": "^CVE-[0-9]{4}-[0-9]{4,}$",
"type": "string"
},
"cve_year": {
"pattern": "^[0-9]{4}$",
"type": "string"
},
"owning_cna": {
"description": "The shortname for the organization that owns the CVE ID",
"type": "string"
},
"requested_by": {
"properties": {
"cna": {
"description": "The shortname for the organization of the user that requested the ID",
"type": "string"
},
"user": {
"description": "The username for the account that requested the ID",
"type": "string"
}
},
"type": "object"
},
"reserved": {
"description": "The time the ID was reserved",
"format": "date-time",
"type": "string"
},
"state": {
"enum": [
"RESERVED",
"PUBLISHED",
"REJECTED"
],
"type": "string"
}
}
},
"type": "array"
},
"details": {
"properties": {
"amount_reserved": {
"description": "The quantity of IDs reserved in the system",
"format": "int32",
"type": "integer"
}
},
"type": "object"
},
"error": {
"type": "string"
},
"message": {
"type": "string"
}
},
"type": "object"
},
"Product": {
"properties": {
"creation_timestamp": {
"description": "Creation time of the product.",
"format": "date-time",
"readOnly": true,
"type": "string"
},
"description": {
"description": "Description.",
"type": "string"
},
"id": {
"description": "Product id.",
"type": "string"
},
"name": {
"description": "Product name.",
"type": "string"
},
"updated_timestamp": {
"description": "Updated time of the product.",
"format": "date-time",
"readOnly": true,
"type": "string"
},
"uuid": {
"description": "Product uuid.",
"type": "string"
}
},
"type": "object"
},
"ProductsList": {
"properties": {
"data": {
"description": "List of products.",
"items": {
"$ref": "#/definitions/Product"
},
"type": "array"
},
"metadata": {
"allOf": [
{
"$ref": "#/definitions/metadata"
}
],
"description": "Metadata related to the result."
}
},
"type": "object"
},
"RecordCountModel": {
"$schema": "http://json-schema.org/draft-04/schema",
"properties": {
"totalCount": {
"format": "int32",
"type": "integer"
}
},
"type": "object"
},
"RelatedWeakness": {
"properties": {
"@CWE_ID": {
"description": "CWE ID of the related weakness",
"type": "string"
},
"@Nature": {
"description": "Nature of the relationship",
"type": "string"
},
"@Ordinal": {
"description": "Ordinal of the relationship",
"type": "string"
},
"@View_ID": {
"description": "View ID of the related weakness",
"type": "string"
}
},
"required": [
"@CWE_ID",
"@Nature",
"@Ordinal",
"@View_ID"
],
"type": "object"
},
"RelatedWeaknesses": {
"properties": {
"Related_Weakness": {
"description": "List of related weaknesses",
"items": {
"$ref": "#/definitions/RelatedWeakness"
},
"type": "array"
}
},
"type": "object"
},
"ReservedCveIdsResonseModel": {
"$schema": "http://json-schema.org/draft-04/schema",
"properties": {
"cve_ids": {
"items": {
"properties": {
"cve_id": {
"description": "^CVE-[0-9]{4}-[0-9]{4,}$",
"type": "string"
},
"cve_year": {
"description": "^[0-9]{4}$",
"type": "string"
},
"owning_cna": {
"description": "The shortname for the organization that owns the CVE ID",
"type": "string"
},
"requested_by": {
"properties": {
"cna": {
"description": "The shortname for the organization of the user that requested the ID",
"type": "string"
},
"user": {
"description": "The username for the account that requested the ID",
"type": "string"
}
},
"type": "object"
},
"reserved": {
"description": "The time the ID was reserved",
"format": "date-time",
"type": "string"
},
"state": {
"enum": [
"RESERVED",
"PUBLISHED",
"REJECTED"
],
"type": "string"
}
}
},
"type": "array"
},
"meta": {
"properties": {
"remaining_quota": {
"format": "int32",
"type": "integer"
}
},
"type": "object"
}
},
"type": "object"
},
"Rule": {
"properties": {
"creation_date": {
"description": "Date the ule was created.",
"type": "string"
},
"description": {
"description": "Description of the rule.",
"type": "string"
},
"detail_url": {
"description": "URL of the rule.",
"type": "string"
},
"format": {
"description": "Format of the rule.",
"type": "string"
},
"id": {
"description": "Rule ID.",
"type": "integer"
},
"raw": {
"description": "raw version of the rule.",
"type": "string"
},
"title": {
"description": "Title of the rule.",
"type": "string"
},
"updated_date": {
"description": "Date the rule was updated.",
"type": "string"
},
"uuid": {
"description": "Rule UUID.",
"type": "string"
},
"vulnerability_id": {
"description": "Related vulnerability.",
"type": "string"
}
},
"required": [
"creation_date",
"description",
"detail_url",
"format",
"id",
"raw",
"title",
"updated_date",
"uuid",
"vulnerability_id"
],
"type": "object"
},
"RulesList": {
"properties": {
"data": {
"description": "List of rules.",
"items": {
"$ref": "#/definitions/Rule"
},
"type": "array"
},
"metadata": {
"allOf": [
{
"$ref": "#/definitions/RulezetMetadata"
}
],
"description": "Metadata related to the result."
}
},
"type": "object"
},
"RulezetMetadata": {
"properties": {
"count": {
"description": "Total number of the items of the data.",
"readOnly": true,
"type": "integer"
},
"page": {
"description": "Number of the page.",
"readOnly": true,
"type": "integer"
},
"pages": {
"description": "Total number of pages.",
"readOnly": true,
"type": "integer"
},
"per_page": {
"description": "Requested limit data.",
"readOnly": true,
"type": "integer"
}
},
"type": "object"
},
"ScorecardAssigner": {
"properties": {
"all": {
"description": "The same tallies over every publication.",
"type": "object"
},
"assigner": {
"description": "The assigner reported on.",
"type": "string"
},
"available": {
"description": "False when nothing was prepared for this source or assigner.",
"type": "boolean"
},
"meta": {
"$ref": "#/definitions/ScorecardMeta"
},
"ranked": {
"description": "Whether the assigner reaches the volume threshold in the window.",
"type": "boolean"
},
"source": {
"description": "The source reported on.",
"type": "string"
},
"window": {
"description": "The rolling window's tallies: score, grade, pillars, checks, context.",
"type": "object"
},
"years": {
"description": "Score and record count per publication year.",
"type": "object"
}
},
"type": "object"
},
"ScorecardEntry": {
"properties": {
"assigner": {
"description": "The CNA short name, or the GNA source name.",
"type": "string"
},
"grade": {
"description": "A to E, from the mean score.",
"type": "string"
},
"ranked": {
"description": "False under the volume threshold: the score is shown, not ranked.",
"type": "boolean"
},
"records": {
"description": "Published records scored in the period.",
"type": "integer"
},
"score": {
"description": "Mean record score over the period, 0..100.",
"type": "number"
},
"source": {
"description": "The source the entry was read from (GNA ranking only).",
"type": "string"
}
},
"type": "object"
},
"ScorecardGNARanking": {
"properties": {
"available": {
"description": "False when no GNA source has a prepared scorecard.",
"type": "boolean"
},
"period": {
"description": "window, all, or the publication year.",
"type": "string"
},
"ranking": {
"description": "Ranked GNAs first, best first.",
"items": {
"$ref": "#/definitions/ScorecardEntry"
},
"type": "array"
},
"sources": {
"description": "The GNA sources the ranking was read from.",
"items": {
"type": "string"
},
"type": "array"
}
},
"type": "object"
},
"ScorecardMeta": {
"properties": {
"assigners": {
"description": "Assigners with at least one scored record.",
"type": "integer"
},
"computed_at": {
"description": "When the figures were prepared.",
"type": "string"
},
"methodology": {
"description": "Version of the rules the figures were computed under.",
"type": "integer"
},
"methodology_change": {
"description": "What that version changed, in one sentence.",
"type": "string"
},
"methodology_reference": {
"description": "The pull request or commit that made the change.",
"type": "string"
},
"methodology_since": {
"description": "The day that version of the rules took effect (ISO 8601).",
"type": "string"
},
"min_records": {
"description": "Publications an assigner needs in the window to be ranked.",
"type": "integer"
},
"records": {
"description": "Published records scored by the last full pass.",
"type": "integer"
},
"vl_version": {
"description": "The Vulnerability-Lookup release that prepared the figures.",
"type": "string"
},
"window_days": {
"description": "Length of the rolling window the ranking is built on.",
"type": "integer"
}
},
"type": "object"
},
"ScorecardRanking": {
"properties": {
"available": {
"description": "False when the scorecard has never been prepared for this source.",
"type": "boolean"
},
"meta": {
"$ref": "#/definitions/ScorecardMeta"
},
"period": {
"description": "window, all, or the publication year.",
"type": "string"
},
"ranking": {
"description": "Ranked assigners first, best first.",
"items": {
"$ref": "#/definitions/ScorecardEntry"
},
"type": "array"
},
"source": {
"description": "The source reported on.",
"type": "string"
}
},
"type": "object"
},
"ScorecardSignals": {
"properties": {
"available": {
"description": "False when the scorecard has never been prepared for this source.",
"type": "boolean"
},
"signals": {
"description": "Per signal: its label, unit and the ranked assigners tripping it.",
"type": "object"
},
"source": {
"description": "The source reported on.",
"type": "string"
}
},
"type": "object"
},
"Sighting": {
"properties": {
"author": {
"allOf": [
{
"$ref": "#/definitions/User"
}
],
"readOnly": true
},
"content": {
"default": "",
"description": "Optional content of the sighting (e.g. the body of a Telegram message, a Bluesky/Mastodon post, a GitHub Gist or a blog article).",
"type": "string"
},
"creation_timestamp": {
"description": "When the vulnerability was observed (ISO 8601). Set by the client; defaults to the time the server receives the sighting, and a time in the future is brought back to it.",
"format": "date-time",
"type": "string"
},
"source": {
"description": "The source of the sighting (Fediverse status URI, link, tool, etc.).",
"type": "string"
},
"type": {
"description": "Type of the sighting.",
"type": "string"
},
"uuid": {
"description": "Sighting UUID.",
"readOnly": true,
"type": "string"
},
"vulnerability": {
"description": "Vulnerability id.",
"type": "string"
},
"vulnerability_lookup_origin": {
"default": "8627204d-fee7-4bdf-8707-5f0833b57c82",
"description": "UUID of the Vulnerability-Lookup origin instance.",
"readOnly": true,
"type": "string"
}
},
"type": "object"
},
"SightingsList": {
"properties": {
"data": {
"description": "List of sightings.",
"items": {
"$ref": "#/definitions/Sighting"
},
"type": "array"
},
"metadata": {
"allOf": [
{
"$ref": "#/definitions/metadata"
}
],
"description": "Metadata related to the result."
}
},
"type": "object"
},
"StatsCounts": {
"properties": {
"available": {
"description": "False when the counters have never been prepared; counts is then empty.",
"type": "boolean"
},
"counts": {
"description": "Period (YYYY or YYYY-MM) -> record count.",
"type": "object"
},
"granularity": {
"description": "year or month.",
"type": "string"
},
"source": {
"description": "The source reported on.",
"type": "string"
},
"state": {
"description": "published or reserved: the date the records are counted by.",
"type": "string"
}
},
"type": "object"
},
"StatsDistribution": {
"properties": {
"available": {
"description": "False when the distribution has never been prepared; distribution is then empty.",
"type": "boolean"
},
"distribution": {
"description": "Bucket -> record count.",
"type": "object"
},
"period": {
"description": "The publication year the distribution covers, or null for all of it.",
"type": "string"
},
"source": {
"description": "The source reported on.",
"type": "string"
}
},
"type": "object"
},
"StatsError": {
"properties": {
"message": {
"description": "Why the request could not be answered.",
"type": "string"
}
},
"type": "object"
},
"StatsKEV": {
"properties": {
"available": {
"description": "False when this source does not maintain a known-exploited index.",
"type": "boolean"
},
"catalogs": {
"description": "Catalogue short name -> record count. These overlap: a record listed by two catalogues is counted by both, so they do not sum to `exploited`.",
"type": "object"
},
"exploited": {
"description": "Records appearing in at least one known-exploited catalogue.",
"type": "integer"
},
"ratio": {
"description": "exploited / total, or null when the source is empty.",
"type": "number"
},
"source": {
"description": "The source reported on.",
"type": "string"
},
"total": {
"description": "Records held.",
"type": "integer"
},
"unattributed": {
"description": "Exploited records held under a catalogue this instance cannot name. Non-zero means the local catalogue reference data is absent or stale.",
"type": "integer"
}
},
"type": "object"
},
"StatsStatus": {
"properties": {
"published": {
"description": "Records carrying a publication date.",
"type": "integer"
},
"reserved": {
"description": "Records carrying a reservation date.",
"type": "integer"
},
"source": {
"description": "The source reported on.",
"type": "string"
},
"total": {
"description": "Records held.",
"type": "integer"
}
},
"type": "object"
},
"StatsTimeToExploit": {
"properties": {
"available": {
"description": "False when the cross-store scan has never run.",
"type": "boolean"
},
"computed_at": {
"description": "When the snapshot was taken.",
"type": "string"
},
"count": {
"description": "Records the figure rests on -- those ever exploited.",
"type": "integer"
},
"cves_exploited": {
"description": "Distinct CVEs those entries named -- the denominator of the two unmatched counts.",
"type": "integer"
},
"entries_scanned": {
"description": "Known-exploited catalogue entries the scan read.",
"type": "integer"
},
"exploited_before_publication": {
"description": "Of count, how many were listed before the record was published.",
"type": "integer"
},
"max_days": {
"description": "Longest observed interval.",
"type": "number"
},
"mean_days": {
"description": "Mean days from publication to first listing.",
"type": "number"
},
"median_days": {
"description": "Median days, reported alongside the mean.",
"type": "number"
},
"min_days": {
"description": "Shortest observed interval.",
"type": "number"
},
"p90_days": {
"description": "90th percentile, nearest rank.",
"type": "number"
},
"source": {
"description": "The source reported on.",
"type": "string"
},
"unmatched_no_publication_date": {
"description": "Exploited records carrying no publication date, so they could not be dated.",
"type": "integer"
},
"unmatched_no_record": {
"description": "Exploited CVEs this source holds no record for, so they could not be dated. Reported rather than dropped: the figures above are a mean over what remains.",
"type": "integer"
}
},
"type": "object"
},
"Status": {
"properties": {
"exploited": {
"description": "Exploitation observed",
"type": "boolean"
},
"status_reason": {
"description": "Status reason",
"enum": [
"confirmed",
"suspected",
"disputed",
"historical",
"unknown"
],
"example": "confirmed",
"type": "string"
},
"status_updated_at": {
"description": "Status update time",
"format": "date-time",
"type": "string"
}
},
"required": [
"exploited",
"status_reason",
"status_updated_at"
],
"type": "object"
},
"User": {
"properties": {
"login": {
"description": "Login of the user.",
"readOnly": true,
"type": "string"
}
},
"type": "object"
},
"UserFull": {
"properties": {
"created_at": {
"description": "Creation time of the user.",
"format": "date-time",
"readOnly": true,
"type": "string"
},
"last_seen": {
"description": "Last seen time of the user.",
"format": "date-time",
"readOnly": true,
"type": "string"
},
"login": {
"description": "User login.",
"type": "string"
},
"uuid": {
"description": "User UUID.",
"type": "string"
}
},
"type": "object"
},
"UsersList": {
"properties": {
"data": {
"description": "List of users.",
"items": {
"$ref": "#/definitions/UserFull"
},
"type": "array"
},
"metadata": {
"allOf": [
{
"$ref": "#/definitions/metadata"
}
],
"description": "Metadata related to the result."
}
},
"type": "object"
},
"Vulnerability": {
"properties": {
"altId": {
"description": "Alternative vulnerability identifiers",
"items": {
"type": "string"
},
"type": "array"
},
"vulnId": {
"description": "Vulnerability ID",
"type": "string"
}
},
"required": [
"vulnId"
],
"type": "object"
},
"VulnerabilityBulkLookup": {
"properties": {
"ids": {
"description": "One to 100 vulnerability identifiers.",
"items": {
"description": "A vulnerability identifier.",
"pattern": "\\S",
"type": "string"
},
"maxItems": 100,
"minItems": 1,
"type": "array"
},
"with_bundles": {
"description": "Include bundles.",
"type": "boolean"
},
"with_comments": {
"description": "Include comments.",
"type": "boolean"
},
"with_linked": {
"description": "Include linked vulnerabilities. Accepted for at most 10 identifiers per request.",
"type": "boolean"
},
"with_meta": {
"description": "Include storage metadata.",
"type": "boolean"
},
"with_sightings": {
"description": "Include sightings.",
"type": "boolean"
}
},
"required": [
"ids"
],
"type": "object"
},
"metadata": {
"properties": {
"count": {
"description": "Total number of the items of the data.",
"readOnly": true,
"type": "integer"
},
"page": {
"description": "Number of the page.",
"readOnly": true,
"type": "integer"
},
"per_page": {
"description": "Requested limit data.",
"readOnly": true,
"type": "integer"
}
},
"type": "object"
}
},
"info": {
"description": "
API to query Vulnerability-Lookup. A project from CIRCL.
Back to the main page
Official documentation of the project.",
"license": {
"name": "GNU Affero General Public License version 3",
"url": "https://www.gnu.org/licenses/agpl-3.0.html"
},
"title": "Vulnerability-Lookup API",
"version": "6.2.1"
},
"paths": {
"/banner": {
"get": {
"operationId": "get_banner",
"parameters": [
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/Banner"
}
}
},
"summary": "Read the site notice",
"tags": [
"banner"
]
},
"put": {
"description": "Only available to administrators.\n\nGuarded by ``admin:access`` rather than a notice-specific permission, and\nthat is deliberate. A new permission is created by the RBAC seed but not\nadded to any existing role -- roles keep their configured permission sets\nunless the seed is run with ``reset``, which would discard an instance's\ncustomisations. The endpoint would then be callable by nobody on precisely\nthe instances that have been running longest, and would be found out during\nthe incident someone was trying to announce.",
"operationId": "put_banner",
"parameters": [
{
"in": "body",
"name": "payload",
"required": true,
"schema": {
"properties": {
"enabled": {
"description": "Whether a maintenance notice should be displayed.",
"type": "boolean"
},
"message": {
"default": "",
"description": "The notice to display (at most 2000 characters). Stored and returned verbatim; this instance's own pages render a small Markdown subset of it -- emphasis, code, lists and links -- and strip everything else.",
"type": "string"
}
},
"required": [
"enabled"
],
"type": "object"
}
},
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/Banner"
}
},
"400": {
"description": "Invalid banner."
},
"401": {
"description": "Authentication required."
},
"403": {
"description": "Admin permission required."
}
},
"summary": "Set the site notice",
"tags": [
"banner"
]
}
},
"/browse/": {
"get": {
"deprecated": true,
"description": "Deprecated: use GET /api/browse/vendors instead. Get the known vendors.\nDeprecated in favor of /api/browse/vendors.",
"operationId": "get_vendors",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Get the known vendors",
"tags": [
"browse"
]
}
},
"/browse/vendors": {
"get": {
"description": "Get the known vendors with the date of their most recent vulnerability change, most recently changed first. Vendors without a known last change date are listed last with a null last_change.",
"operationId": "get_vendors_last_change",
"parameters": [
{
"description": "Case-insensitive substring filter on the name.",
"in": "query",
"name": "q",
"type": "string"
},
{
"description": "Only return entries whose last change is at or after this date (ISO 8601 datetime or Unix timestamp). Entries without a known last change date are excluded.",
"in": "query",
"name": "since",
"type": "string"
},
{
"default": 1,
"description": "Number of the page.",
"in": "query",
"name": "page",
"type": "integer"
},
{
"default": 100,
"description": "Maximum number of elements to return (capped at 1000).",
"in": "query",
"name": "per_page",
"type": "integer"
}
],
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Get the known vendors with their last vulnerability change date",
"tags": [
"browse"
]
}
},
"/browse/vendors/{vendor}/products": {
"get": {
"description": "Get the known products of a vendor with the date of their most recent vulnerability change, most recently changed first. Products without a known last change date are listed last with a null last_change.",
"operationId": "get_vendor_products_last_change",
"parameters": [
{
"description": "Case-insensitive substring filter on the name.",
"in": "query",
"name": "q",
"type": "string"
},
{
"description": "Only return entries whose last change is at or after this date (ISO 8601 datetime or Unix timestamp). Entries without a known last change date are excluded.",
"in": "query",
"name": "since",
"type": "string"
},
{
"default": 1,
"description": "Number of the page.",
"in": "query",
"name": "page",
"type": "integer"
},
{
"default": 100,
"description": "Maximum number of elements to return (capped at 1000).",
"in": "query",
"name": "per_page",
"type": "integer"
}
],
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Get the products of a vendor with their last vulnerability change date",
"tags": [
"browse"
]
},
"parameters": [
{
"in": "path",
"name": "vendor",
"required": true,
"type": "string"
}
]
},
"/browse/{vendor}": {
"get": {
"deprecated": true,
"description": "Deprecated: use GET /api/browse/vendors//products instead. Get the known products for a vendor.\nDeprecated in favor of /api/browse/vendors//products.",
"operationId": "get_vendor_products",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Get the known products for a vendor",
"tags": [
"browse"
]
},
"parameters": [
{
"in": "path",
"name": "vendor",
"required": true,
"type": "string"
}
]
},
"/bundle/": {
"delete": {
"description": "Delete bundles by vulnerability_lookup_origin (admin only).",
"operationId": "delete_bundles_list",
"parameters": [
{
"description": "Delete bundles from this origin instance UUID.",
"in": "query",
"name": "vulnerability_lookup_origin",
"required": true,
"type": "string"
}
],
"responses": {
"200": {
"description": "Deleted bundles successfully."
},
"400": {
"description": "Invalid UUID format."
},
"403": {
"description": "Admin permission required."
},
"404": {
"description": "No bundles matched the filter."
}
},
"summary": "Delete bundles by vulnerability_lookup_origin",
"tags": [
"bundle"
]
},
"get": {
"operationId": "list_bundles",
"parameters": [
{
"default": 1,
"description": "Number of the page.",
"in": "query",
"name": "page",
"type": "integer"
},
{
"default": 100,
"description": "Maximum number of elements to return.",
"in": "query",
"name": "per_page",
"type": "integer"
},
{
"description": "UUID of the bundle.",
"in": "query",
"name": "uuid",
"type": "string"
},
{
"description": "Author (login) of the bundle.",
"in": "query",
"name": "author",
"type": "string"
},
{
"description": "Id of a vulnerability referenced by the bundle.",
"in": "query",
"name": "vuln_id",
"type": "string"
},
{
"description": "Query for the meta JSON field. Example: meta=[{'tags': ['tcp']}]",
"in": "query",
"name": "meta",
"type": "string"
},
{
"description": "The date of the bundles must be bigger or equal than this value. Format: YYYY-MM-DD",
"format": "date",
"in": "query",
"name": "date_from",
"type": "string"
},
{
"description": "The date of the bundles must be smaller or equal than this value. Format: YYYY-MM-DD",
"format": "date",
"in": "query",
"name": "date_to",
"type": "string"
},
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success",
"schema": {
"items": {
"$ref": "#/definitions/BundlesList"
},
"type": "array"
}
}
},
"summary": "List all bundles",
"tags": [
"bundle"
]
},
"post": {
"description": "Create a bundle.",
"operationId": "post_bundles_list",
"parameters": [
{
"in": "body",
"name": "payload",
"required": true,
"schema": {
"$ref": "#/definitions/Bundle"
}
},
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"201": {
"description": "Success.",
"schema": {
"items": {
"$ref": "#/definitions/BundlesList"
},
"type": "array"
}
},
"400": {
"description": "JSON validation failed or incorrect payload to instantiate a bundle."
},
"403": {
"description": "Administrator permission required."
}
},
"tags": [
"bundle"
]
}
},
"/bundle/{bundle_uuid}": {
"delete": {
"description": "Delete a bundle.\nOnly an admin can delete a bundle.",
"operationId": "delete_bundle_item",
"responses": {
"204": {
"description": "Success."
},
"403": {
"description": "Administrator permission required or not the author of the bundle."
},
"404": {
"description": "Bundle not found."
}
},
"summary": "Endpoint for deleting a bundle",
"tags": [
"bundle"
]
},
"get": {
"description": "Get a bundle with its UUID.",
"operationId": "get_bundle_item",
"parameters": [
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/Bundle"
}
},
"404": {
"description": "Bundle not found."
}
},
"tags": [
"bundle"
]
},
"parameters": [
{
"in": "path",
"name": "bundle_uuid",
"required": true,
"type": "string"
}
]
},
"/capec/": {
"get": {
"operationId": "list_capecs",
"parameters": [
{
"default": 1,
"description": "Number of the page.",
"in": "query",
"name": "page",
"type": "integer"
},
{
"default": 100,
"description": "Maximum number of elements to return.",
"in": "query",
"name": "per_page",
"type": "integer"
},
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success",
"schema": {
"items": {
"$ref": "#/definitions/CAPECsList"
},
"type": "array"
}
}
},
"summary": "List all CAPECs",
"tags": [
"capec"
]
}
},
"/capec/{capec_id}": {
"get": {
"description": "Get detailed information about a CAPEC.",
"operationId": "get_capec_item",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Get detailed information about a CAPEC",
"tags": [
"capec"
]
},
"parameters": [
{
"in": "path",
"name": "capec_id",
"required": true,
"type": "string"
}
]
},
"/cna/cve": {
"get": {
"operationId": "get_cve",
"parameters": [
{
"description": "Organization shortname is required",
"in": "header",
"name": "CVE-API-ORG",
"type": "string"
},
{
"description": "Username is required",
"in": "header",
"name": "CVE-API-USER",
"type": "string"
},
{
"description": "API key is required",
"in": "header",
"name": "CVE-API-KEY",
"type": "string"
},
{
"description": "Most recent CVE record modified timestamp to retrieve (format: yyyy-MM-ddTHH:mm:ssZZZZ)",
"format": "date-time",
"in": "query",
"name": "time_modified.lt",
"type": "string"
},
{
"description": "Earliest CVE record modified timestamp to retrieve (format: yyyy-MM-ddTHH:mm:ssZZZZ)",
"format": "date-time",
"in": "query",
"name": "time_modified.gt",
"type": "string"
},
{
"description": "Filter by state",
"enum": [
"PUBLISHED",
"REJECTED"
],
"in": "query",
"name": "state",
"type": "string"
},
{
"description": "Filter by assignerShortName",
"in": "query",
"name": "assigner_short_name",
"type": "string"
},
{
"description": "Filter by assigner org UUID",
"in": "query",
"name": "assigner",
"type": "string"
},
{
"default": 1,
"description": "The current page in the paginator",
"in": "query",
"name": "page",
"type": "integer"
},
{
"description": "Filter by ADP short name",
"in": "query",
"name": "adp_short_name",
"type": "string"
},
{
"description": "Get count of records that match query",
"in": "query",
"name": "count_only",
"type": "boolean"
},
{
"description": "Only get CVE records with cnaContainers modified/created within the time_modified range",
"in": "query",
"name": "cna_modified",
"type": "boolean"
}
],
"responses": {
"200": {
"description": "A filtered list of CVE Records, along with pagination fields if results span multiple pages of data",
"schema": {
"$ref": "#/definitions/CveListUnionResponse"
}
},
"400": {
"description": "Bad Request",
"schema": {
"$ref": "#/definitions/BadRequestModel"
}
},
"401": {
"description": "Not Authenticated",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"403": {
"description": "Forbidden",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"404": {
"description": "Not Found",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"500": {
"description": "Internal Server Error",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
}
},
"summary": "Retrieves all CVE Records after applying the query parameters as filters (accessible to Secretariat)",
"tags": [
"cna"
]
}
},
"/cna/cve-id": {
"get": {
"operationId": "get_cve_id_info",
"parameters": [
{
"description": "Organization shortname is required",
"in": "header",
"name": "CVE-API-ORG",
"type": "string"
},
{
"description": "Username is required",
"in": "header",
"name": "CVE-API-USER",
"type": "string"
},
{
"description": "API key is required",
"in": "header",
"name": "CVE-API-KEY",
"type": "string"
},
{
"description": "Filter by state",
"enum": [
"RESERVED",
"PUBLISHED",
"REJECTED"
],
"in": "query",
"name": "state",
"type": "string"
},
{
"description": "Filter by the year of the CVE IDs",
"in": "query",
"name": "cve_id_year",
"type": "string"
},
{
"description": "Most recent reserved timestamp to retrieve",
"format": "date-time",
"in": "query",
"name": "time_reserved.lt",
"type": "string"
},
{
"description": "Earliest CVE ID reserved timestamp to retrieve",
"format": "date-time",
"in": "query",
"name": "time_reserved.gt",
"type": "string"
},
{
"description": "Most recent modified timestamp to retrieve",
"format": "date-time",
"in": "query",
"name": "time_modified.lt",
"type": "string"
},
{
"description": "Earliest CVE ID modified timestamp to retrieve",
"format": "date-time",
"in": "query",
"name": "time_modified.gt",
"type": "string"
},
{
"default": 1,
"description": "The current page in the paginator",
"in": "query",
"name": "page",
"type": "integer"
},
{
"default": "modified",
"description": "Sort field (default: modified)",
"enum": [
"created",
"modified"
],
"in": "query",
"name": "sort_by",
"type": "string"
},
{
"default": "desc",
"description": "Sort direction (default: desc)",
"enum": [
"asc",
"desc"
],
"in": "query",
"name": "sort_dir",
"type": "string"
},
{
"description": "Substring filter on vuln_id (case-insensitive)",
"in": "query",
"name": "search",
"type": "string"
}
],
"responses": {
"200": {
"description": "Filtered CVE IDs",
"schema": {
"$ref": "#/definitions/CveIdListResponseModel"
}
},
"400": {
"description": "Bad Request",
"schema": {
"$ref": "#/definitions/BadRequestModel"
}
},
"401": {
"description": "Not Authenticated",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"403": {
"description": "Forbidden",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"404": {
"description": "Not Found",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"500": {
"description": "Internal Server Error",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
}
},
"summary": "Retrieves information about CVE IDs after applying the query parameters as filters (accessible to all registered users)",
"tags": [
"cna"
]
},
"post": {
"operationId": "post_cve_id_info",
"parameters": [
{
"description": "Organization shortname is required",
"in": "header",
"name": "CVE-API-ORG",
"type": "string"
},
{
"description": "Username is required",
"in": "header",
"name": "CVE-API-USER",
"type": "string"
},
{
"description": "API key is required",
"in": "header",
"name": "CVE-API-KEY",
"type": "string"
},
{
"description": "Quantity of CVE IDs to reserve",
"in": "query",
"name": "amount",
"required": true,
"type": "integer"
},
{
"description": "Required when amount is greater than one",
"enum": [
"sequential",
"non-sequential",
"nonsequential"
],
"in": "query",
"name": "batch_type",
"type": "string"
},
{
"description": "The year the CVE IDs will be reserved for",
"in": "query",
"name": "cve_year",
"required": true,
"type": "integer"
},
{
"description": "The CNA that will own the reserved CVE IDs",
"in": "query",
"name": "short_name",
"type": "string"
}
],
"responses": {
"200": {
"description": "Reseved CVE IDs",
"schema": {
"$ref": "#/definitions/ReservedCveIdsResonseModel"
}
},
"206": {
"description": "Partially Reserved CVE IDs",
"schema": {
"$ref": "#/definitions/PartialReservedCveIdsResponseModel"
}
},
"400": {
"description": "Bad Request",
"schema": {
"$ref": "#/definitions/BadRequestModel"
}
},
"401": {
"description": "Not Authenticated",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"403": {
"description": "Forbidden",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"404": {
"description": "Not Found",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"500": {
"description": "Internal Server Error",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
}
},
"summary": "Reserves CVE IDs for the organization provided in the short_name query parameter (accessible to CNAs and Secretariat)",
"tags": [
"cna"
]
}
},
"/cna/cve-id-range/{year}": {
"parameters": [
{
"in": "path",
"name": "year",
"required": true,
"type": "integer"
}
],
"post": {
"operationId": "post_cve_id_range",
"parameters": [
{
"description": "Organization shortname is required",
"in": "header",
"name": "CVE-API-ORG",
"type": "string"
},
{
"description": "Username is required",
"in": "header",
"name": "CVE-API-USER",
"type": "string"
},
{
"description": "API key is required",
"in": "header",
"name": "CVE-API-KEY",
"type": "string"
}
],
"responses": {
"200": {
"description": "The CVE-ID-Range was created"
},
"400": {
"description": "Bad Request",
"schema": {
"$ref": "#/definitions/BadRequestModel"
}
},
"401": {
"description": "Not Authenticated",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"403": {
"description": "Forbidden",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"404": {
"description": "Not Found",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"500": {
"description": "Internal Server Error",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
}
},
"summary": "Creates a CVE-ID-Range for the specified year (accessible to Secretariat)",
"tags": [
"cna"
]
}
},
"/cna/cve-id/{id}": {
"get": {
"operationId": "get_cve_id_by_id",
"parameters": [
{
"description": "Organization shortname is required",
"in": "header",
"name": "CVE-API-ORG",
"type": "string"
},
{
"description": "Username is required",
"in": "header",
"name": "CVE-API-USER",
"type": "string"
},
{
"description": "API key is required",
"in": "header",
"name": "CVE-API-KEY",
"type": "string"
}
],
"responses": {
"200": {
"description": "The requested CVE ID information is returned",
"headers": {
"RateLimit-Limit": {
"description": "Indicates the service limit associated with the client in the current time window.",
"type": "string"
},
"RateLimit-Policy": {
"description": "Indicates a service policy currently associated with the client.",
"type": "string"
},
"RateLimit-Remaining": {
"description": "Indicates the remaining quota units associated with the expiring-limit.",
"type": "string"
},
"RateLimit-Reset": {
"description": "Indicates the number of seconds until the quota resets.",
"type": "string"
}
},
"schema": {
"$ref": "#/definitions/CveIdGetModel"
}
},
"400": {
"description": "Bad Request",
"headers": {
"RateLimit-Limit": {
"description": "Indicates the service limit associated with the client in the current time window.",
"type": "string"
},
"RateLimit-Policy": {
"description": "Indicates a service policy currently associated with the client.",
"type": "string"
},
"RateLimit-Remaining": {
"description": "Indicates the remaining quota units associated with the expiring-limit.",
"type": "string"
},
"RateLimit-Reset": {
"description": "Indicates the number of seconds until the quota resets.",
"type": "string"
}
},
"schema": {
"$ref": "#/definitions/BadRequestModel"
}
},
"401": {
"description": "Not Authenticated",
"headers": {
"RateLimit-Limit": {
"description": "Indicates the service limit associated with the client in the current time window.",
"type": "string"
},
"RateLimit-Policy": {
"description": "Indicates a service policy currently associated with the client.",
"type": "string"
},
"RateLimit-Remaining": {
"description": "Indicates the remaining quota units associated with the expiring-limit.",
"type": "string"
},
"RateLimit-Reset": {
"description": "Indicates the number of seconds until the quota resets.",
"type": "string"
}
},
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"403": {
"description": "Forbidden",
"headers": {
"RateLimit-Limit": {
"description": "Indicates the service limit associated with the client in the current time window.",
"type": "string"
},
"RateLimit-Policy": {
"description": "Indicates a service policy currently associated with the client.",
"type": "string"
},
"RateLimit-Remaining": {
"description": "Indicates the remaining quota units associated with the expiring-limit.",
"type": "string"
},
"RateLimit-Reset": {
"description": "Indicates the number of seconds until the quota resets.",
"type": "string"
}
},
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"404": {
"description": "Not Found",
"headers": {
"RateLimit-Limit": {
"description": "Indicates the service limit associated with the client in the current time window.",
"type": "string"
},
"RateLimit-Policy": {
"description": "Indicates a service policy currently associated with the client.",
"type": "string"
},
"RateLimit-Remaining": {
"description": "Indicates the remaining quota units associated with the expiring-limit.",
"type": "string"
},
"RateLimit-Reset": {
"description": "Indicates the number of seconds until the quota resets.",
"type": "string"
}
},
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"429": {
"description": "Too Many Requests",
"headers": {
"RateLimit-Limit": {
"description": "Indicates the service limit associated with the client in the current time window.",
"type": "string"
},
"RateLimit-Policy": {
"description": "Indicates a service policy currently associated with the client.",
"type": "string"
},
"RateLimit-Remaining": {
"description": "Indicates the remaining quota units associated with the expiring-limit.",
"type": "string"
},
"RateLimit-Reset": {
"description": "Indicates the number of seconds until the quota resets.",
"type": "string"
}
},
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"500": {
"description": "Internal Server Error",
"headers": {
"RateLimit-Limit": {
"description": "Indicates the service limit associated with the client in the current time window.",
"type": "string"
},
"RateLimit-Policy": {
"description": "Indicates a service policy currently associated with the client.",
"type": "string"
},
"RateLimit-Remaining": {
"description": "Indicates the remaining quota units associated with the expiring-limit.",
"type": "string"
},
"RateLimit-Reset": {
"description": "Indicates the number of seconds until the quota resets.",
"type": "string"
}
},
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
}
},
"summary": "Retrieves information about the specified CVE ID (accessible to all users)",
"tags": [
"cna"
]
},
"parameters": [
{
"in": "path",
"name": "id",
"required": true,
"type": "string"
}
],
"put": {
"operationId": "put_cve_id_by_id",
"parameters": [
{
"description": "Organization shortname is required",
"in": "header",
"name": "CVE-API-ORG",
"type": "string"
},
{
"description": "Username is required",
"in": "header",
"name": "CVE-API-USER",
"type": "string"
},
{
"description": "API key is required",
"in": "header",
"name": "CVE-API-KEY",
"type": "string"
},
{
"description": "The shortname of the new owning_cna for the CVE ID",
"in": "query",
"name": "org",
"type": "string"
},
{
"description": "The id of the CVE ID to update",
"enum": [
"RESERVED",
"REJECTED"
],
"in": "query",
"name": "state",
"type": "string"
}
],
"responses": {
"200": {
"description": "The requested CVE ID information is returned",
"schema": {
"$ref": "#/definitions/CveIdUpdateModel"
}
},
"400": {
"description": "Bad Request",
"schema": {
"$ref": "#/definitions/BadRequestModel"
}
},
"401": {
"description": "Not Authenticated",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"403": {
"description": "Forbidden",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"404": {
"description": "Not Found",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"500": {
"description": "Internal Server Error",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
}
},
"summary": "Updates information related to the specified CVE ID (accessible to CNAs and Secretariat)",
"tags": [
"cna"
]
}
},
"/cna/cve/{id}": {
"delete": {
"operationId": "delete_cve_id",
"responses": {
"400": {
"description": "Bad Request",
"schema": {
"$ref": "#/definitions/BadRequestModel"
}
},
"401": {
"description": "Not Authenticated",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"403": {
"description": "Forbidden",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"404": {
"description": "Not Found",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"500": {
"description": "Internal Server Error",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
}
},
"tags": [
"cna"
]
},
"get": {
"operationId": "get_cve_id",
"responses": {
"200": {
"description": "The requested CVE Record",
"schema": {
"$ref": "#/definitions/CveGetUnionResponse"
}
},
"400": {
"description": "Bad Request",
"headers": {
"RateLimit-Limit": {
"description": "Indicates the service limit associated with the client in the current time window.",
"type": "string"
},
"RateLimit-Policy": {
"description": "Indicates a service policy currently associated with the client.",
"type": "string"
},
"RateLimit-Remaining": {
"description": "Indicates the remaining quota units associated with the expiring-limit.",
"type": "string"
},
"RateLimit-Reset": {
"description": "Indicates the number of seconds until the quota resets.",
"type": "string"
}
},
"schema": {
"$ref": "#/definitions/BadRequestModel"
}
},
"403": {
"description": "Forbidden",
"headers": {
"RateLimit-Limit": {
"description": "Indicates the service limit associated with the client in the current time window.",
"type": "string"
},
"RateLimit-Policy": {
"description": "Indicates a service policy currently associated with the client.",
"type": "string"
},
"RateLimit-Remaining": {
"description": "Indicates the remaining quota units associated with the expiring-limit.",
"type": "string"
},
"RateLimit-Reset": {
"description": "Indicates the number of seconds until the quota resets.",
"type": "string"
}
},
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"404": {
"description": "Not Found",
"headers": {
"RateLimit-Limit": {
"description": "Indicates the service limit associated with the client in the current time window.",
"type": "string"
},
"RateLimit-Policy": {
"description": "Indicates a service policy currently associated with the client.",
"type": "string"
},
"RateLimit-Remaining": {
"description": "Indicates the remaining quota units associated with the expiring-limit.",
"type": "string"
},
"RateLimit-Reset": {
"description": "Indicates the number of seconds until the quota resets.",
"type": "string"
}
},
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"429": {
"description": "Too Many Requests",
"headers": {
"RateLimit-Limit": {
"description": "Indicates the service limit associated with the client in the current time window.",
"type": "string"
},
"RateLimit-Policy": {
"description": "Indicates a service policy currently associated with the client.",
"type": "string"
},
"RateLimit-Remaining": {
"description": "Indicates the remaining quota units associated with the expiring-limit.",
"type": "string"
},
"RateLimit-Reset": {
"description": "Indicates the number of seconds until the quota resets.",
"type": "string"
}
},
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"500": {
"description": "Internal Server Error",
"headers": {
"RateLimit-Limit": {
"description": "Indicates the service limit associated with the client in the current time window.",
"type": "string"
},
"RateLimit-Policy": {
"description": "Indicates a service policy currently associated with the client.",
"type": "string"
},
"RateLimit-Remaining": {
"description": "Indicates the remaining quota units associated with the expiring-limit.",
"type": "string"
},
"RateLimit-Reset": {
"description": "Indicates the number of seconds until the quota resets.",
"type": "string"
}
},
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
}
},
"summary": "Returns a CVE Record by CVE ID (accessible to all users)",
"tags": [
"cna"
]
},
"parameters": [
{
"in": "path",
"name": "id",
"required": true,
"type": "string"
}
],
"post": {
"description": ")",
"operationId": "post_cve_id",
"parameters": [
{
"description": "Organization shortname is required",
"in": "header",
"name": "CVE-API-ORG",
"type": "string"
},
{
"description": "Username is required",
"in": "header",
"name": "CVE-API-USER",
"type": "string"
},
{
"description": "API key is required",
"in": "header",
"name": "CVE-API-KEY",
"type": "string"
}
],
"responses": {
"200": {
"description": "The CVE Record created",
"schema": {
"$ref": "#/definitions/CveRecordResponseModel"
}
},
"400": {
"description": "Bad Request",
"schema": {
"$ref": "#/definitions/BadRequestModel"
}
},
"401": {
"description": "Not Authenticated",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"403": {
"description": "Forbidden",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"404": {
"description": "Not Found",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"500": {
"description": "Internal Server Error",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
}
},
"summary": "Creates a CVE Record from full CVE Record JSON for the specified ID (accessible to Secretariat",
"tags": [
"cna"
]
},
"put": {
"description": ")",
"operationId": "put_cve_id",
"responses": {
"200": {
"description": "The CVE Record created",
"schema": {
"$ref": "#/definitions/CveRecordUpdateresponseModel"
}
},
"400": {
"description": "Bad Request",
"schema": {
"$ref": "#/definitions/BadRequestModel"
}
},
"401": {
"description": "Not Authenticated",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"403": {
"description": "Forbidden",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"404": {
"description": "Not Found",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"500": {
"description": "Internal Server Error",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
}
},
"summary": "Updates a CVE Record from full CVE Record JSON for the specified ID (accessible to Secretariat",
"tags": [
"cna"
]
}
},
"/cna/cve/{id}/adp": {
"parameters": [
{
"in": "path",
"name": "id",
"required": true,
"type": "string"
}
],
"put": {
"operationId": "put_cve_adp",
"parameters": [
{
"description": "Organization shortname is required",
"in": "header",
"name": "CVE-API-ORG",
"type": "string"
},
{
"description": "Username is required",
"in": "header",
"name": "CVE-API-USER",
"type": "string"
},
{
"description": "API key is required",
"in": "header",
"name": "CVE-API-KEY",
"type": "string"
},
{
"in": "body",
"name": "payload",
"required": true,
"schema": {
"$ref": "#/definitions/CnaRequestModel"
}
}
],
"responses": {
"200": {
"description": "The CVE Record created",
"schema": {
"$ref": "#/definitions/CreateCveRecordModel"
}
},
"400": {
"description": "Bad Request",
"schema": {
"$ref": "#/definitions/BadRequestModel"
}
},
"401": {
"description": "Not Authenticated",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"403": {
"description": "Forbidden",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"404": {
"description": "Not Found",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"500": {
"description": "Internal Server Error",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
}
},
"summary": "Inserts or replaces the ADP container for the caller org on an existing CVE Record",
"tags": [
"cna"
]
}
},
"/cna/cve/{id}/cna": {
"parameters": [
{
"in": "path",
"name": "id",
"required": true,
"type": "string"
}
],
"post": {
"operationId": "post_cve_cna",
"parameters": [
{
"description": "Organization shortname is required",
"in": "header",
"name": "CVE-API-ORG",
"type": "string"
},
{
"description": "Username is required",
"in": "header",
"name": "CVE-API-USER",
"type": "string"
},
{
"description": "API key is required",
"in": "header",
"name": "CVE-API-KEY",
"type": "string"
},
{
"description": "Enable ERL check",
"in": "query",
"name": "erlcheck",
"type": "boolean"
},
{
"in": "body",
"name": "payload",
"required": true,
"schema": {
"$ref": "#/definitions/CnaRequestModel"
}
}
],
"responses": {
"200": {
"description": "The CVE Record created",
"schema": {
"$ref": "#/definitions/CreateCveRecordModel"
}
},
"400": {
"description": "Bad Request",
"schema": {
"$ref": "#/definitions/BadRequestModel"
}
},
"401": {
"description": "Not Authenticated",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"403": {
"description": "Forbidden",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"404": {
"description": "Not Found",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"500": {
"description": "Internal Server Error",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
}
},
"summary": "Creates a CVE Record from CNA Container JSON for the specified ID (accessible to CNAs and Secretariat)",
"tags": [
"cna"
]
},
"put": {
"operationId": "put_cve_cna",
"parameters": [
{
"description": "Organization shortname is required",
"in": "header",
"name": "CVE-API-ORG",
"type": "string"
},
{
"description": "Username is required",
"in": "header",
"name": "CVE-API-USER",
"type": "string"
},
{
"description": "API key is required",
"in": "header",
"name": "CVE-API-KEY",
"type": "string"
},
{
"description": "Enable ERL check",
"in": "query",
"name": "erlcheck",
"type": "boolean"
},
{
"in": "body",
"name": "payload",
"required": true,
"schema": {
"$ref": "#/definitions/CnaRequestModel"
}
}
],
"responses": {
"200": {
"description": "The CVE Record created",
"schema": {
"$ref": "#/definitions/CreateCveRecordModel"
}
},
"400": {
"description": "Bad Request",
"schema": {
"$ref": "#/definitions/BadRequestModel"
}
},
"401": {
"description": "Not Authenticated",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"403": {
"description": "Forbidden",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"404": {
"description": "Not Found",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"500": {
"description": "Internal Server Error",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
}
},
"tags": [
"cna"
]
}
},
"/cna/cve/{id}/reject": {
"parameters": [
{
"in": "path",
"name": "id",
"required": true,
"type": "string"
}
],
"post": {
"operationId": "post_cve_reject",
"responses": {
"200": {
"description": "The CVE Record created",
"schema": {
"$ref": "#/definitions/CreateCveRecordModel"
}
},
"400": {
"description": "Bad Request",
"schema": {
"$ref": "#/definitions/BadRequestModel"
}
},
"401": {
"description": "Not Authenticated",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"403": {
"description": "Forbidden",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"404": {
"description": "Not Found",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"500": {
"description": "Internal Server Error",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
}
},
"summary": "Creates a rejected CVE Record for the specified ID if no record yet exists (accessible to CNAs and Secretariat)",
"tags": [
"cna"
]
},
"put": {
"operationId": "put_cve_reject",
"responses": {
"200": {
"description": "The CVE Record created",
"schema": {
"$ref": "#/definitions/CreateCveRecordModel"
}
},
"400": {
"description": "Bad Request",
"schema": {
"$ref": "#/definitions/BadRequestModel"
}
},
"401": {
"description": "Not Authenticated",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"403": {
"description": "Forbidden",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"404": {
"description": "Not Found",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"500": {
"description": "Internal Server Error",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
}
},
"tags": [
"cna"
]
}
},
"/cna/cve_count": {
"get": {
"operationId": "get_cve_count",
"parameters": [
{
"description": "Filter by state",
"enum": [
"PUBLISHED",
"REJECTED"
],
"in": "query",
"name": "state",
"type": "string"
}
],
"responses": {
"200": {
"description": "\tA count of the total number of filtered CVE records",
"schema": {
"$ref": "#/definitions/RecordCountModel"
}
},
"400": {
"description": "Bad Request",
"schema": {
"$ref": "#/definitions/BadRequestModel"
}
},
"404": {
"description": "Not Found",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"500": {
"description": "Internal Server Error",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
}
},
"summary": "Retrieves the count of all the CVE Records after applying the query parameters as filters (accessible to all users)",
"tags": [
"cna"
]
}
},
"/cna/cve_cursor": {
"get": {
"operationId": "get_cve_cursor",
"parameters": [
{
"description": "Most recent CVE record modified timestamp to retrieve",
"format": "date-time",
"in": "query",
"name": "time_modified.lt",
"type": "string"
},
{
"description": "Earliest CVE record modified timestamp to retrieve",
"format": "date-time",
"in": "query",
"name": "time_modified.gt",
"type": "string"
},
{
"description": "Filter by state",
"enum": [
"PUBLISHED",
"REJECTED"
],
"in": "query",
"name": "state",
"type": "string"
},
{
"description": "Get count of records that match query",
"in": "query",
"name": "count_only",
"type": "boolean"
},
{
"description": "Filter by assignerShortName",
"in": "query",
"name": "assigner_short_name",
"type": "string"
},
{
"description": "Filter by assigner org UUID",
"in": "query",
"name": "assigner",
"type": "string"
},
{
"description": "Only get CVE records with cnaContainers that have been modified/created within the set time_modified range",
"in": "query",
"name": "cna_modified",
"type": "boolean"
},
{
"description": "Only get CVE records that have an adpContainer owned by this org",
"in": "query",
"name": "adp_short_name",
"type": "string"
},
{
"description": "Key returned by a GET /cve_cursor call that must be used to get the next page of results in a subsequent call",
"in": "query",
"name": "next_page",
"type": "string"
},
{
"description": "Key returned by a GET /cve_cursor call that must be used to get the previous page of results in a subsequent call",
"in": "query",
"name": "previous_page",
"type": "string"
},
{
"description": "Maximum number of records to return",
"in": "query",
"name": "limit",
"type": "integer"
}
],
"responses": {
"200": {
"description": "A filtered list of CVE Records, along with pagination fields if results span multiple pages of data",
"schema": {
"$ref": "#/definitions/CveCursorUnionResponse"
}
},
"400": {
"description": "Bad Request",
"schema": {
"$ref": "#/definitions/BadRequestModel"
}
},
"401": {
"description": "Not Authenticated",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"403": {
"description": "Forbidden",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"404": {
"description": "Not Found",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"500": {
"description": "Internal Server Error",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
}
},
"summary": "Retrieves all CVE Records after applying the query parameters as filters (accessible to Secretariat)",
"tags": [
"cna"
]
}
},
"/cna/health-check": {
"get": {
"description": "Checks that the system is running (accessible to all users)",
"operationId": "get_health_check",
"responses": {
"200": {
"description": "Returns a 200 respose code"
}
},
"summary": "Check that the system is running",
"tags": [
"cna"
]
}
},
"/cna/org": {
"get": {
"operationId": "get_org",
"parameters": [
{
"description": "Organization shortname is required",
"in": "header",
"name": "CVE-API-ORG",
"type": "string"
},
{
"description": "Username is required",
"in": "header",
"name": "CVE-API-USER",
"type": "string"
},
{
"description": "API key is required",
"in": "header",
"name": "CVE-API-KEY",
"type": "string"
},
{
"default": 1,
"description": "The current page in the paginator",
"in": "query",
"name": "page",
"type": "integer"
}
],
"responses": {
"400": {
"description": "Bad Request",
"schema": {
"$ref": "#/definitions/BadRequestModel"
}
},
"401": {
"description": "Not Authenticated",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"403": {
"description": "Forbidden",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"404": {
"description": "Not Found",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"500": {
"description": "Internal Server Error",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
}
},
"tags": [
"cna"
]
}
},
"/cna/org/{identifier}": {
"get": {
"operationId": "get_org_id",
"parameters": [
{
"description": "Organization shortname is required",
"in": "header",
"name": "CVE-API-ORG",
"type": "string"
},
{
"description": "Username is required",
"in": "header",
"name": "CVE-API-USER",
"type": "string"
},
{
"description": "API key is required",
"in": "header",
"name": "CVE-API-KEY",
"type": "string"
}
],
"responses": {
"400": {
"description": "Bad Request",
"schema": {
"$ref": "#/definitions/BadRequestModel"
}
},
"401": {
"description": "Not Authenticated",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"403": {
"description": "Forbidden",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"404": {
"description": "Not Found",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"500": {
"description": "Internal Server Error",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
}
},
"tags": [
"cna"
]
},
"parameters": [
{
"in": "path",
"name": "identifier",
"required": true,
"type": "string"
}
]
},
"/cna/users": {
"get": {
"operationId": "get_users",
"parameters": [
{
"description": "Organization shortname is required",
"in": "header",
"name": "CVE-API-ORG",
"type": "string"
},
{
"description": "Username is required",
"in": "header",
"name": "CVE-API-USER",
"type": "string"
},
{
"description": "API key is required",
"in": "header",
"name": "CVE-API-KEY",
"type": "string"
},
{
"default": 1,
"description": "The current page in the paginator",
"in": "query",
"name": "page",
"type": "integer"
}
],
"responses": {
"400": {
"description": "Bad Request",
"schema": {
"$ref": "#/definitions/BadRequestModel"
}
},
"401": {
"description": "Not Authenticated",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"403": {
"description": "Forbidden",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"404": {
"description": "Not Found",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
},
"500": {
"description": "Internal Server Error",
"schema": {
"$ref": "#/definitions/GenericErrorModel"
}
}
},
"tags": [
"cna"
]
}
},
"/cna_credential/": {
"get": {
"description": "Only available to administrators.",
"operationId": "list_cna_credentials",
"parameters": [
{
"default": 1,
"description": "Number of the page.",
"in": "query",
"name": "page",
"type": "integer"
},
{
"default": 10,
"description": "Maximum number of elements to return.",
"in": "query",
"name": "per_page",
"type": "integer"
},
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"items": {
"$ref": "#/definitions/CNACredentialsList"
},
"type": "array"
}
},
"403": {
"description": "Admin permission required."
}
},
"summary": "List the CNA credentials",
"tags": [
"cna_credential"
]
}
},
"/cna_credential/{credential_id}": {
"get": {
"description": "Get a CNA credential. Only available to administrators.\nOnly available to administrators.",
"operationId": "get_cna_credential_item",
"parameters": [
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/CNACredential"
}
},
"403": {
"description": "Admin permission required."
},
"404": {
"description": "CNA credential not found."
}
},
"summary": "Get a CNA credential",
"tags": [
"cna_credential"
]
},
"parameters": [
{
"in": "path",
"name": "credential_id",
"required": true,
"type": "integer"
}
],
"put": {
"description": "Enable or disable CNA publication for the user bound to a credential. Only available to administrators.",
"operationId": "put_cna_credential_item",
"parameters": [
{
"in": "body",
"name": "payload",
"required": true,
"schema": {
"properties": {
"enabled": {
"description": "Whether CNA publication is allowed for the user bound to this credential.",
"type": "boolean"
}
},
"required": [
"enabled"
],
"type": "object"
}
},
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/CNACredential"
}
},
"403": {
"description": "Admin permission required."
},
"404": {
"description": "CNA credential not found."
}
},
"summary": "Enable or disable CNA publication for the user bound to a credential",
"tags": [
"cna_credential"
]
}
},
"/comment/": {
"delete": {
"description": "Delete comments by vulnerability_lookup_origin (admin only).",
"operationId": "delete_comments_list",
"parameters": [
{
"description": "Delete comments from this origin instance UUID.",
"in": "query",
"name": "vulnerability_lookup_origin",
"required": true,
"type": "string"
}
],
"responses": {
"200": {
"description": "Deleted comments successfully."
},
"400": {
"description": "Invalid UUID format."
},
"403": {
"description": "Admin permission required."
},
"404": {
"description": "No comments matched the filter."
}
},
"summary": "Delete comments by vulnerability_lookup_origin",
"tags": [
"comment"
]
},
"get": {
"operationId": "list_comments",
"parameters": [
{
"default": 1,
"description": "Number of the page.",
"in": "query",
"name": "page",
"type": "integer"
},
{
"default": 100,
"description": "Maximum number of elements to return.",
"in": "query",
"name": "per_page",
"type": "integer"
},
{
"description": "UUID of the comment.",
"in": "query",
"name": "uuid",
"type": "string"
},
{
"description": "Vulnerability related to the comment.",
"in": "query",
"name": "vuln_id",
"type": "string"
},
{
"description": "Author of the comment.",
"in": "query",
"name": "author",
"type": "string"
},
{
"description": "Query for the meta JSON field. Tags are matched exactly. Example: meta=[{'tags': ['vulnerability:information=PoC']}]",
"in": "query",
"name": "meta",
"type": "string"
},
{
"description": "The date of the comments must be bigger or equal than this value. Format: YYYY-MM-DD",
"format": "date",
"in": "query",
"name": "date_from",
"type": "string"
},
{
"description": "The date of the comments must be smaller or equal than this value. Format: YYYY-MM-DD",
"format": "date",
"in": "query",
"name": "date_to",
"type": "string"
},
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success",
"schema": {
"items": {
"$ref": "#/definitions/CommentsList"
},
"type": "array"
}
}
},
"summary": "List all comments",
"tags": [
"comment"
]
},
"post": {
"description": "Create or update a comment related to a security advisory.",
"operationId": "post_comments_list",
"parameters": [
{
"in": "body",
"name": "payload",
"required": true,
"schema": {
"$ref": "#/definitions/Comment"
}
},
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"201": {
"description": "Comment created or updated.",
"schema": {
"items": {
"$ref": "#/definitions/CommentsList"
},
"type": "array"
}
},
"400": {
"description": "Invalid comment payload or comment update failed."
},
"403": {
"description": "Insufficient permission."
},
"404": {
"description": "Vulnerability not found."
}
},
"summary": "Create a new comment or update an existing one",
"tags": [
"comment"
]
}
},
"/comment/{comment_uuid}": {
"delete": {
"description": "Delete a comment.",
"operationId": "delete_comment_item",
"responses": {
"204": {
"description": "Success."
},
"403": {
"description": "Commenter permission required or not the author of the comment."
},
"404": {
"description": "Comment not found."
}
},
"summary": "Delete a comment",
"tags": [
"comment"
]
},
"get": {
"description": "Get a comment with its UUID.",
"operationId": "get_comment_item",
"parameters": [
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/Comment"
}
},
"404": {
"description": "Comment not found."
}
},
"tags": [
"comment"
]
},
"parameters": [
{
"in": "path",
"name": "comment_uuid",
"required": true,
"type": "string"
}
]
},
"/cpe_editor/status/{vulnerability_id}": {
"get": {
"description": "Check whether the CPEs referenced by a cvelistv5 vulnerability already exist in the CPE Editor catalog.",
"operationId": "get_cpe_editor_status",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Get the CPE Editor catalog status for a vulnerability's affected products",
"tags": [
"cpe_editor"
]
},
"parameters": [
{
"in": "path",
"name": "vulnerability_id",
"required": true,
"type": "string"
}
]
},
"/cwe/": {
"get": {
"operationId": "list_cwes",
"parameters": [
{
"description": "ID of a vulnerability that references one or more CWE identifiers.",
"in": "query",
"name": "vuln_id",
"type": "string"
},
{
"default": 1,
"description": "Number of the page.",
"in": "query",
"name": "page",
"type": "integer"
},
{
"default": 100,
"description": "Maximum number of elements to return.",
"in": "query",
"name": "per_page",
"type": "integer"
},
{
"default": false,
"description": "Exclude CWEs whose Mapping_Notes Usage is Discouraged.",
"in": "query",
"name": "exclude_discouraged",
"type": "boolean"
},
{
"default": false,
"description": "Exclude CWEs whose Mapping_Notes Usage is Prohibited.",
"in": "query",
"name": "exclude_prohibited",
"type": "boolean"
},
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success",
"schema": {
"items": {
"$ref": "#/definitions/CWEsList"
},
"type": "array"
}
}
},
"summary": "List all CWEs",
"tags": [
"cwe"
]
}
},
"/cwe/{cwe_id}": {
"get": {
"description": "Get detailed information about a CWE.",
"operationId": "get_cwe_item",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Get detailed information about a CWE",
"tags": [
"cwe"
]
},
"parameters": [
{
"in": "path",
"name": "cwe_id",
"required": true,
"type": "string"
}
]
},
"/emb3d/": {
"get": {
"operationId": "list_emb3ds",
"parameters": [
{
"default": 1,
"description": "Number of the page.",
"in": "query",
"name": "page",
"type": "integer"
},
{
"default": 100,
"description": "Maximum number of elements to return.",
"in": "query",
"name": "per_page",
"type": "integer"
},
{
"description": "Vulnerability identifier.",
"in": "query",
"name": "vuln_id",
"type": "string"
},
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success",
"schema": {
"items": {
"$ref": "#/definitions/EMB3DsList"
},
"type": "array"
}
}
},
"summary": "List all Adversarial Techniques from MITRE EMB3D",
"tags": [
"emb3d"
]
}
},
"/emb3d/{emb3d_id}": {
"get": {
"description": "Get detailed information about a MITRE EMB3D Adversarial Technique.",
"operationId": "get_emb3_d_item",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Get detailed information about a MITRE EMB3D Adversarial Technique",
"tags": [
"emb3d"
]
},
"parameters": [
{
"in": "path",
"name": "emb3d_id",
"required": true,
"type": "string"
}
]
},
"/epss/{vulnerability_id}": {
"get": {
"description": "Get the EPSS score of a vulnerability.",
"operationId": "get_epss_item",
"responses": {
"200": {
"description": "Success."
},
"404": {
"description": "EPSS score not found."
},
"502": {
"description": "Bad Gateway: Invalid response from EPSS service."
},
"503": {
"description": "Service Unavailable: Unable to reach EPSS service or misconfigured."
}
},
"summary": "Get the EPSS score of a vulnerability",
"tags": [
"epss"
]
},
"parameters": [
{
"in": "path",
"name": "vulnerability_id",
"required": true,
"type": "string"
}
]
},
"/euvd/": {
"get": {
"operationId": "get_euvd_list",
"parameters": [
{
"default": 10,
"description": "Maximum number of entries to return (1 to 100).",
"in": "query",
"maximum": 100,
"minimum": 1,
"name": "limit",
"type": "integer"
},
{
"default": false,
"description": "Only entries whose linked CVE was assigned by a coordinated (EU CSIRT) CNA.",
"in": "query",
"name": "coordinated",
"type": "boolean"
},
{
"description": "Only entries whose linked CVE has a CVSS base score strictly above this.",
"in": "query",
"name": "cvss_min",
"type": "string"
},
{
"default": false,
"description": "Only entries whose linked CVE is listed in a KEV catalog.",
"in": "query",
"name": "exploited",
"type": "boolean"
},
{
"default": false,
"description": "Include the affected-product rows (one per affected version).",
"in": "query",
"name": "with_products",
"type": "boolean"
},
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success",
"schema": {
"$ref": "#/definitions/EUVDList"
}
},
"503": {
"description": "The exploited-vulnerability data is unavailable.",
"schema": {
"$ref": "#/definitions/EUVDError"
}
}
},
"summary": "List EUVD entries, most recently updated first",
"tags": [
"euvd"
]
}
},
"/euvd/advisory/{identifier}": {
"get": {
"operationId": "get_euvd_advisory",
"parameters": [
{
"default": true,
"description": "Include the advisory's affected-product rows.",
"in": "query",
"name": "with_products",
"type": "boolean"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/EUVDAdvisory"
}
},
"404": {
"description": "No advisory with this identifier.",
"schema": {
"$ref": "#/definitions/EUVDError"
}
}
},
"summary": "One CSAF advisory, by its own tracking id",
"tags": [
"euvd"
]
},
"parameters": [
{
"description": "The advisory's tracking id, e.g. TEST-SA-2026-0001.",
"in": "path",
"name": "identifier",
"required": true,
"type": "string"
}
]
},
"/euvd/assigners/names": {
"get": {
"operationId": "get_euvd_assigner_names",
"responses": {
"200": {
"description": "Success.",
"schema": {
"items": {
"description": "Assigner name.",
"type": "string"
},
"type": "array"
}
}
},
"summary": "List the coordinated assigner names",
"tags": [
"euvd"
]
}
},
"/euvd/search": {
"get": {
"operationId": "get_euvd_search_endpoint",
"parameters": [
{
"default": 1,
"description": "Page number (1 to 1000).",
"in": "query",
"maximum": 1000,
"minimum": 1,
"name": "page",
"type": "integer"
},
{
"default": 10,
"description": "Entries per page (1 to 100).",
"in": "query",
"maximum": 100,
"minimum": 1,
"name": "per_page",
"type": "integer"
},
{
"default": "updated",
"description": "Dimension to order by. 'published' and 'reserved' also restrict the result to entries that carry that date, so they can return fewer entries than 'updated'; 'updated' is set for every entry and never restricts.",
"enum": [
"updated",
"published",
"reserved"
],
"in": "query",
"name": "sort",
"type": "string"
},
{
"default": "desc",
"description": "Ordering direction.",
"enum": [
"asc",
"desc"
],
"in": "query",
"name": "order",
"type": "string"
},
{
"description": "Earliest publication date (ISO-8601).",
"in": "query",
"name": "published_from",
"type": "string"
},
{
"description": "Latest publication date (ISO-8601).",
"in": "query",
"name": "published_to",
"type": "string"
},
{
"description": "Earliest update date (ISO-8601).",
"in": "query",
"name": "updated_from",
"type": "string"
},
{
"description": "Latest update date (ISO-8601).",
"in": "query",
"name": "updated_to",
"type": "string"
},
{
"description": "Earliest exploited-since date (ISO-8601).",
"in": "query",
"name": "exploited_from",
"type": "string"
},
{
"description": "Latest exploited-since date (ISO-8601).",
"in": "query",
"name": "exploited_to",
"type": "string"
},
{
"description": "Free text matched against the linked CVE's indexed content. Requires full-text search to be enabled on the instance.",
"in": "query",
"name": "text",
"type": "string"
},
{
"description": "Assigner (CNA) of the linked CVE. Matched exactly, as upstream does.",
"in": "query",
"name": "assigner",
"type": "string"
},
{
"description": "Lowest CVSS base score (0..10) to include. Entries whose linked CVE has no score at all are excluded, since nothing about them can satisfy a lower bound.",
"in": "query",
"name": "cvss_min",
"type": "string"
},
{
"description": "Highest CVSS base score (0..10) to include. Unscored entries are kept, so cvss_max=10 is a no-op rather than a filter.",
"in": "query",
"name": "cvss_max",
"type": "string"
},
{
"description": "Lowest EPSS probability (0..1) to include. Entries with no EPSS score are excluded, as for cvss_min.",
"in": "query",
"name": "epss_min",
"type": "string"
},
{
"description": "Highest EPSS probability (0..1) to include. Unscored entries are kept, so epss_max=1 is a no-op.",
"in": "query",
"name": "epss_max",
"type": "string"
},
{
"description": "Restrict to entries listed (true) or not listed (false) in a KEV catalog.",
"in": "query",
"name": "exploited",
"type": "boolean"
},
{
"description": "Restrict to entries exploited in this KEV catalog.",
"in": "query",
"name": "kev_catalog",
"type": "string"
},
{
"description": "Affected vendor. Matches any vendor starting with this.",
"in": "query",
"name": "vendor",
"type": "string"
},
{
"description": "Affected product. Matches any product starting with this.",
"in": "query",
"name": "product",
"type": "string"
},
{
"default": false,
"description": "Include the affected-product rows (one per affected version).",
"in": "query",
"name": "with_products",
"type": "boolean"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/EUVDSearchResult"
}
},
"400": {
"description": "The request could not be satisfied.",
"schema": {
"$ref": "#/definitions/EUVDError"
}
},
"503": {
"description": "The exploited-vulnerability data is unavailable.",
"schema": {
"$ref": "#/definitions/EUVDError"
}
}
},
"summary": "Search EUVD entries",
"tags": [
"euvd"
]
}
},
"/euvd/stats/assigners/ranking": {
"get": {
"operationId": "get_euvd_stats_assigners_ranking",
"parameters": [
{
"default": 10,
"description": "How many entries to return, capped at 10.",
"in": "query",
"name": "limit",
"type": "integer"
},
{
"default": "",
"description": "Restrict the ranking to one period (YYYY or YYYY-MM). Omit for the whole catalogue.",
"in": "query",
"name": "period",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"items": {
"$ref": "#/definitions/EUVDStatsAssignerRank"
},
"type": "array"
}
},
"400": {
"description": "The request could not be satisfied.",
"schema": {
"$ref": "#/definitions/EUVDStatsError"
}
}
},
"summary": "List the top assigners",
"tags": [
"euvd-stats"
]
}
},
"/euvd/stats/count": {
"get": {
"operationId": "get_euvd_stats_count",
"parameters": [
{
"default": "year",
"description": "Period granularity of the counts.",
"enum": [
"year",
"month"
],
"in": "query",
"name": "granularity",
"type": "string"
},
{
"default": "",
"description": "With granularity=month, the year whose months are returned (YYYY). Defaults to the current year. Refused with granularity=year, where the answer already carries every year.",
"in": "query",
"name": "period",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/EUVDStatsCount"
}
},
"400": {
"description": "The request could not be satisfied.",
"schema": {
"$ref": "#/definitions/EUVDStatsError"
}
}
},
"summary": "Count the catalogue per year, or per month within one year",
"tags": [
"euvd-stats"
]
}
},
"/euvd/stats/cvss/scores": {
"get": {
"operationId": "get_euvd_stats_cvss_scores",
"parameters": [
{
"default": "",
"description": "Restrict the distribution to one publication year (YYYY). Omit for the whole catalogue.",
"in": "query",
"name": "period",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/EUVDStatsDistribution"
}
},
"400": {
"description": "The request could not be satisfied.",
"schema": {
"$ref": "#/definitions/EUVDStatsError"
}
}
},
"summary": "Distribution of records by severity band",
"tags": [
"euvd-stats"
]
}
},
"/euvd/stats/cvss/versions": {
"get": {
"operationId": "get_euvd_stats_cvss_versions",
"parameters": [
{
"default": "",
"description": "Restrict the distribution to one publication year (YYYY). Omit for the whole catalogue.",
"in": "query",
"name": "period",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/EUVDStatsDistribution"
}
},
"400": {
"description": "The request could not be satisfied.",
"schema": {
"$ref": "#/definitions/EUVDStatsError"
}
}
},
"summary": "Distribution of records by CVSS version",
"tags": [
"euvd-stats"
]
}
},
"/euvd/stats/kev": {
"get": {
"operationId": "get_euvd_stats_kev",
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/EUVDStatsKEV"
}
}
},
"summary": "Report known-exploited inclusion",
"tags": [
"euvd-stats"
]
}
},
"/euvd/stats/status": {
"get": {
"operationId": "get_euvd_stats_status",
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/EUVDStatsStatus"
}
}
},
"summary": "Report the catalogue's lifecycle split",
"tags": [
"euvd-stats"
]
}
},
"/euvd/stats/time_to_exploit": {
"get": {
"operationId": "get_euvd_stats_time_to_exploit",
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/EUVDStatsTimeToExploit"
}
}
},
"summary": "Report the publication-to-exploitation summary",
"tags": [
"euvd-stats"
]
}
},
"/euvd/stats/vendors/ranking": {
"get": {
"operationId": "get_euvd_stats_vendors_ranking",
"parameters": [
{
"default": 10,
"description": "How many entries to return, capped at 10.",
"in": "query",
"name": "limit",
"type": "integer"
},
{
"default": "",
"description": "Restrict the ranking to one period (YYYY or YYYY-MM). Omit for the whole catalogue.",
"in": "query",
"name": "period",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"items": {
"$ref": "#/definitions/EUVDStatsVendorRank"
},
"type": "array"
}
},
"400": {
"description": "The request could not be satisfied.",
"schema": {
"$ref": "#/definitions/EUVDStatsError"
}
}
},
"summary": "List the top vendors",
"tags": [
"euvd-stats"
]
}
},
"/euvd/{identifier}": {
"get": {
"operationId": "get_euvd_detail",
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/EUVDDetail"
}
},
"404": {
"description": "No EUVD entry for this identifier.",
"schema": {
"$ref": "#/definitions/EUVDError"
}
}
},
"summary": "One EUVD entry in full, by its own id or by any identifier it covers",
"tags": [
"euvd"
]
},
"parameters": [
{
"description": "An EUVD id, a CVE id, or any alias the entry covers.",
"in": "path",
"name": "identifier",
"required": true,
"type": "string"
}
]
},
"/exploit-hazard": {
"post": {
"description": "Compute the local exploit hazard for a vulnerability instance from an ELM probability such as EPSS, user-provided control effectiveness, optional KEV policy parameters, and exponential or Weibull hazard settings.",
"operationId": "post_exploit_hazard",
"responses": {
"200": {
"description": "Success."
},
"400": {
"description": "Invalid model parameters."
},
"503": {
"description": "Storage backend unavailable."
}
},
"tags": [
"exploit-hazard"
]
}
},
"/exploit-hazard/": {
"post": {
"description": "Compute the local exploit hazard for a vulnerability instance from an ELM probability such as EPSS, user-provided control effectiveness, optional KEV policy parameters, and exponential or Weibull hazard settings.",
"operationId": "post_exploit_hazard",
"responses": {
"200": {
"description": "Success."
},
"400": {
"description": "Invalid model parameters."
},
"503": {
"description": "Storage backend unavailable."
}
},
"tags": [
"exploit-hazard"
]
}
},
"/exploit-hazard/batch": {
"post": {
"description": "Aggregate the local exploit hazard of a set of vulnerability instances (section 3.6 of the referenced paper): per-instance hazards, their sum as the aggregate daily hazard, and the Poisson probability of at least one exploitation event over the common horizon. Instances are the same objects the single endpoint accepts \u2014 or plain vulnerability-id strings \u2014 and optional shared 'parameters' (controls, KEV policy, Weibull shape) apply to every instance.",
"operationId": "post_exploit_hazard_batch",
"responses": {
"200": {
"description": "Success."
},
"400": {
"description": "Invalid request or model parameters."
},
"503": {
"description": "Storage backend unavailable."
}
},
"tags": [
"exploit-hazard"
]
}
},
"/gcve/publication": {
"get": {
"operationId": "List the GCVE published by the local Vulnerability-Lookup instance (as a GNA).",
"parameters": [
{
"default": 1,
"description": "Number of the page.",
"in": "query",
"name": "page",
"type": "integer"
},
{
"default": 30,
"description": "Maximum number of elements to return.",
"in": "query",
"name": "per_page",
"type": "integer"
},
{
"default": "updated",
"description": "Field to sort by (published, updated, reserved).",
"in": "query",
"name": "date_sort",
"type": "string"
},
{
"default": "desc",
"description": "Sort order: asc or desc.",
"in": "query",
"name": "sort_order",
"type": "string"
},
{
"default": "",
"description": "Retrieve vulnerabilities published/updated after this date.",
"in": "query",
"name": "since",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success"
}
},
"summary": "List the GCVE published by the local Vulnerability-Lookup instance",
"tags": [
"gcve"
]
}
},
"/gcve/registry": {
"get": {
"operationId": "List the GNAs from the local GCVE registry of the Vulnerability-Lookup instance.",
"parameters": [
{
"default": 1,
"description": "Number of the page.",
"in": "query",
"name": "page",
"type": "integer"
},
{
"default": 100,
"description": "Maximum number of elements to return.",
"in": "query",
"name": "per_page",
"type": "integer"
},
{
"default": "",
"description": "Short name of the organization.",
"in": "query",
"name": "short_name",
"type": "string"
},
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success",
"schema": {
"items": {
"$ref": "#/definitions/GNAsList"
},
"type": "array"
}
}
},
"summary": "List the GNAs from the local GCVE registry of the Vulnerability-Lookup instance",
"tags": [
"gcve"
]
}
},
"/gcve/registry/integrity": {
"get": {
"operationId": "Verify the integrity of the registry.",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Verify the integrity of the local registry",
"tags": [
"gcve"
]
}
},
"/kev": {
"get": {
"operationId": "get_kev_list",
"parameters": [
{
"default": 1,
"description": "Page number",
"in": "query",
"name": "page",
"type": "integer"
},
{
"default": 100,
"description": "Items per page (max 1000)",
"in": "query",
"name": "per_page",
"type": "integer"
},
{
"description": "Filter by vulnerability ID",
"in": "query",
"name": "vuln_id",
"type": "string"
},
{
"enum": [
"confirmed",
"suspected",
"disputed",
"historical",
"unknown",
"withdrawn"
],
"in": "query",
"name": "status_reason",
"type": "string"
},
{
"description": "Filter by exploited status. Defaults to true: the current KEV set, which per BCP-07 excludes every exploited=false record (withdrawn assertions among them). Pass false for those records only, or all for every record. Filtering on a status_reason implies all.",
"enum": [
"true",
"false",
"all"
],
"in": "query",
"name": "exploited",
"type": "string"
},
{
"description": "Filter by origin instance UUID",
"in": "query",
"name": "vulnerability_lookup_origin",
"type": "string"
},
{
"description": "Filter from date (YYYY-MM-DD)",
"format": "date",
"in": "query",
"name": "date_from",
"type": "string"
},
{
"description": "Filter to date (YYYY-MM-DD)",
"format": "date",
"in": "query",
"name": "date_to",
"type": "string"
},
{
"description": "Filter by author login",
"in": "query",
"name": "author",
"type": "string"
},
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success",
"schema": {
"$ref": "#/definitions/KEVList"
}
}
},
"summary": "List KEV entries with pagination and filtering",
"tags": [
"kev"
]
},
"post": {
"operationId": "post_kev_list",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Create new KEV entry",
"tags": [
"kev"
]
}
},
"/kev/": {
"get": {
"operationId": "get_kev_list",
"parameters": [
{
"default": 1,
"description": "Page number",
"in": "query",
"name": "page",
"type": "integer"
},
{
"default": 100,
"description": "Items per page (max 1000)",
"in": "query",
"name": "per_page",
"type": "integer"
},
{
"description": "Filter by vulnerability ID",
"in": "query",
"name": "vuln_id",
"type": "string"
},
{
"enum": [
"confirmed",
"suspected",
"disputed",
"historical",
"unknown",
"withdrawn"
],
"in": "query",
"name": "status_reason",
"type": "string"
},
{
"description": "Filter by exploited status. Defaults to true: the current KEV set, which per BCP-07 excludes every exploited=false record (withdrawn assertions among them). Pass false for those records only, or all for every record. Filtering on a status_reason implies all.",
"enum": [
"true",
"false",
"all"
],
"in": "query",
"name": "exploited",
"type": "string"
},
{
"description": "Filter by origin instance UUID",
"in": "query",
"name": "vulnerability_lookup_origin",
"type": "string"
},
{
"description": "Filter from date (YYYY-MM-DD)",
"format": "date",
"in": "query",
"name": "date_from",
"type": "string"
},
{
"description": "Filter to date (YYYY-MM-DD)",
"format": "date",
"in": "query",
"name": "date_to",
"type": "string"
},
{
"description": "Filter by author login",
"in": "query",
"name": "author",
"type": "string"
},
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success",
"schema": {
"$ref": "#/definitions/KEVList"
}
}
},
"summary": "List KEV entries with pagination and filtering",
"tags": [
"kev"
]
},
"post": {
"operationId": "post_kev_list",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Create new KEV entry",
"tags": [
"kev"
]
}
},
"/kev/catalog/{catalog_uuid}": {
"delete": {
"operationId": "delete_kev_catalog_batch",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Delete all KEV entries from a specific catalog",
"tags": [
"kev"
]
},
"parameters": [
{
"in": "path",
"name": "catalog_uuid",
"required": true,
"type": "string"
}
]
},
"/kev/origin/{origin_uuid}/{vuln_id}": {
"delete": {
"operationId": "delete_kev_detail_by_identifier",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Delete KEV entry by (origin_uuid, vulnId) (admin only)",
"tags": [
"kev"
]
},
"get": {
"operationId": "get_kev_detail_by_identifier",
"parameters": [
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success",
"schema": {
"$ref": "#/definitions/KEVEntry"
}
}
},
"summary": "Get single KEV entry by (origin_uuid, vulnId)",
"tags": [
"kev"
]
},
"parameters": [
{
"in": "path",
"name": "origin_uuid",
"required": true,
"type": "string"
},
{
"in": "path",
"name": "vuln_id",
"required": true,
"type": "string"
}
],
"put": {
"operationId": "put_kev_detail_by_identifier",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Update KEV entry by (origin_uuid, vulnId) (author or admin only)",
"tags": [
"kev"
]
}
},
"/kev/{kev_uuid}": {
"delete": {
"operationId": "delete_kev_detail",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Delete KEV entry (admin only)",
"tags": [
"kev"
]
},
"get": {
"operationId": "get_kev_detail",
"parameters": [
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success",
"schema": {
"$ref": "#/definitions/KEVEntry"
}
}
},
"summary": "Get single KEV entry",
"tags": [
"kev"
]
},
"parameters": [
{
"in": "path",
"name": "kev_uuid",
"required": true,
"type": "string"
}
],
"put": {
"operationId": "put_kev_detail",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Update KEV entry (author or admin only)",
"tags": [
"kev"
]
}
},
"/organization/": {
"get": {
"operationId": "list_organizations",
"parameters": [
{
"default": 1,
"description": "Number of the page.",
"in": "query",
"name": "page",
"type": "integer"
},
{
"default": 1000,
"description": "Maximum number of elements to return.",
"in": "query",
"name": "per_page",
"type": "integer"
},
{
"description": "ID of the organization.",
"in": "query",
"name": "id",
"type": "integer"
},
{
"description": "UUID of the organization.",
"in": "query",
"name": "uuid",
"type": "string"
},
{
"description": "The name of the organization.",
"in": "query",
"name": "name",
"type": "string"
},
{
"description": "The reserved GNA identifier of the organization.",
"in": "query",
"name": "gna_id",
"type": "integer"
},
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success",
"schema": {
"items": {
"$ref": "#/definitions/OrganizationsList"
},
"type": "array"
}
}
},
"summary": "List all organizations",
"tags": [
"organization"
]
}
},
"/product/": {
"get": {
"operationId": "list_products",
"parameters": [
{
"default": 1,
"description": "Number of the page.",
"in": "query",
"name": "page",
"type": "integer"
},
{
"default": 1000,
"description": "Maximum number of elements to return.",
"in": "query",
"name": "per_page",
"type": "integer"
},
{
"description": "UUID of the product.",
"in": "query",
"name": "uuid",
"type": "string"
},
{
"description": "The name of the product.",
"in": "query",
"name": "name",
"type": "string"
},
{
"description": "The name of the organization related to the product.",
"in": "query",
"name": "organization_name",
"type": "string"
},
{
"description": "The id of the organization related to the product.",
"in": "query",
"name": "organization_id",
"type": "string"
},
{
"description": "The uuid of the organization related to the product.",
"in": "query",
"name": "organization_uuid",
"type": "string"
},
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success",
"schema": {
"items": {
"$ref": "#/definitions/ProductsList"
},
"type": "array"
}
}
},
"summary": "List all products",
"tags": [
"product"
]
}
},
"/rulezet/search_rules_by_vulnerabilities/{vulnerability_id}": {
"get": {
"description": "Get rules from Rulezet by vulnerability id.",
"operationId": "get_rulezet_item",
"parameters": [
{
"default": 1,
"description": "Number of the page.",
"in": "query",
"name": "page",
"type": "integer"
},
{
"default": 50,
"description": "Maximum number of elements to return.",
"in": "query",
"name": "per_page",
"type": "integer"
},
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"items": {
"$ref": "#/definitions/RulesList"
},
"type": "array"
}
},
"404": {
"description": "Rule not found in Rulezet."
},
"502": {
"description": "Bad Gateway: Invalid response from Rulezet."
},
"503": {
"description": "Service Unavailable: Unable to reach Rulezet or misconfigured."
}
},
"summary": "Get rules from Rulezet by vulnerability id",
"tags": [
"rulezet"
]
},
"parameters": [
{
"in": "path",
"name": "vulnerability_id",
"required": true,
"type": "string"
}
]
},
"/sighting": {
"delete": {
"description": "Delete sightings by filters (author, source, date). At least one filter must be specified.\nAt least one filter must be specified.",
"operationId": "delete_sightings_list",
"parameters": [
{
"description": "Author of the sightings to delete (login). Only the author themselves or an admin can delete.",
"in": "query",
"name": "author",
"type": "string"
},
{
"description": "Source of the sightings (supports partial match using ilike).",
"in": "query",
"name": "source",
"type": "string"
},
{
"description": "Delete sightings from this date (inclusive). Format: YYYY-MM-DD.",
"format": "date",
"in": "query",
"name": "date_from",
"type": "string"
},
{
"description": "Delete sightings up to this date (inclusive). Format: YYYY-MM-DD.",
"format": "date",
"in": "query",
"name": "date_to",
"type": "string"
},
{
"description": "Delete sightings from this origin instance UUID.",
"in": "query",
"name": "vulnerability_lookup_origin",
"type": "string"
}
],
"responses": {
"200": {
"description": "Deleted sightings successfully."
},
"403": {
"description": "Not allowed to delete these sightings."
},
"404": {
"description": "No sightings matched the filters."
}
},
"summary": "Delete sightings by filters (author, source, date)",
"tags": [
"sighting"
]
},
"get": {
"operationId": "list_sightings",
"parameters": [
{
"default": 1,
"description": "Number of the page.",
"in": "query",
"name": "page",
"type": "integer"
},
{
"default": 1000,
"description": "Maximum number of elements to return.",
"in": "query",
"name": "per_page",
"type": "integer"
},
{
"description": "UUID of the sighting.",
"in": "query",
"name": "uuid",
"type": "string"
},
{
"description": "Type of sightings:\n - Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.\n - Published Proof of Concept: A public proof of concept is available for this vulnerability.\n - Exploited: This vulnerability was exploited and seen by the user reporting the sighting.\n - Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.\n - Confirmed: The vulnerability is confirmed from an analyst perspective.\n - Not confirmed: The user expresses doubt about the veracity of the vulnerability.\n - Patched: This vulnerability was successfully patched by the user reporting the sighting.\n - Not patched: This vulnerability was not successfully patched by the user reporting the sighting.",
"enum": [
"seen",
"published-proof-of-concept",
"exploited",
"not-exploited",
"confirmed",
"not-confirmed",
"patched",
"not-patched"
],
"in": "query",
"name": "type",
"type": "string"
},
{
"description": "Vulnerability related to the sighting.",
"in": "query",
"name": "vuln_id",
"type": "string"
},
{
"description": "Author of the sighting (login).",
"in": "query",
"name": "author",
"type": "string"
},
{
"description": "The date of the sightings must be bigger or equal than this value. Format: YYYY-MM-DD",
"format": "date",
"in": "query",
"name": "date_from",
"type": "string"
},
{
"description": "The date of the sightings must be smaller or equal than this value. Format: YYYY-MM-DD",
"format": "date",
"in": "query",
"name": "date_to",
"type": "string"
},
{
"description": "Source of the sighting.",
"in": "query",
"name": "source",
"type": "string"
},
{
"description": "Filter sightings by the status of the related advisory.",
"enum": [
"unpublished"
],
"in": "query",
"name": "advisory_status",
"type": "string"
},
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success",
"schema": {
"items": {
"$ref": "#/definitions/SightingsList"
},
"type": "array"
}
}
},
"summary": "List all sightings",
"tags": [
"sighting"
]
},
"post": {
"description": "Create a new sighting.",
"operationId": "post_sightings_list",
"parameters": [
{
"in": "body",
"name": "payload",
"required": true,
"schema": {
"$ref": "#/definitions/Sighting"
}
},
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"201": {
"description": "Success.",
"schema": {
"items": {
"$ref": "#/definitions/SightingsList"
},
"type": "array"
}
},
"400": {
"description": "Incorrect payload to instantiate a sighting."
},
"409": {
"description": "Duplicate sighting."
}
},
"summary": "Create a new sighting",
"tags": [
"sighting"
]
}
},
"/sighting/": {
"delete": {
"description": "Delete sightings by filters (author, source, date). At least one filter must be specified.\nAt least one filter must be specified.",
"operationId": "delete_sightings_list",
"parameters": [
{
"description": "Author of the sightings to delete (login). Only the author themselves or an admin can delete.",
"in": "query",
"name": "author",
"type": "string"
},
{
"description": "Source of the sightings (supports partial match using ilike).",
"in": "query",
"name": "source",
"type": "string"
},
{
"description": "Delete sightings from this date (inclusive). Format: YYYY-MM-DD.",
"format": "date",
"in": "query",
"name": "date_from",
"type": "string"
},
{
"description": "Delete sightings up to this date (inclusive). Format: YYYY-MM-DD.",
"format": "date",
"in": "query",
"name": "date_to",
"type": "string"
},
{
"description": "Delete sightings from this origin instance UUID.",
"in": "query",
"name": "vulnerability_lookup_origin",
"type": "string"
}
],
"responses": {
"200": {
"description": "Deleted sightings successfully."
},
"403": {
"description": "Not allowed to delete these sightings."
},
"404": {
"description": "No sightings matched the filters."
}
},
"summary": "Delete sightings by filters (author, source, date)",
"tags": [
"sighting"
]
},
"get": {
"operationId": "list_sightings",
"parameters": [
{
"default": 1,
"description": "Number of the page.",
"in": "query",
"name": "page",
"type": "integer"
},
{
"default": 1000,
"description": "Maximum number of elements to return.",
"in": "query",
"name": "per_page",
"type": "integer"
},
{
"description": "UUID of the sighting.",
"in": "query",
"name": "uuid",
"type": "string"
},
{
"description": "Type of sightings:\n - Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.\n - Published Proof of Concept: A public proof of concept is available for this vulnerability.\n - Exploited: This vulnerability was exploited and seen by the user reporting the sighting.\n - Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.\n - Confirmed: The vulnerability is confirmed from an analyst perspective.\n - Not confirmed: The user expresses doubt about the veracity of the vulnerability.\n - Patched: This vulnerability was successfully patched by the user reporting the sighting.\n - Not patched: This vulnerability was not successfully patched by the user reporting the sighting.",
"enum": [
"seen",
"published-proof-of-concept",
"exploited",
"not-exploited",
"confirmed",
"not-confirmed",
"patched",
"not-patched"
],
"in": "query",
"name": "type",
"type": "string"
},
{
"description": "Vulnerability related to the sighting.",
"in": "query",
"name": "vuln_id",
"type": "string"
},
{
"description": "Author of the sighting (login).",
"in": "query",
"name": "author",
"type": "string"
},
{
"description": "The date of the sightings must be bigger or equal than this value. Format: YYYY-MM-DD",
"format": "date",
"in": "query",
"name": "date_from",
"type": "string"
},
{
"description": "The date of the sightings must be smaller or equal than this value. Format: YYYY-MM-DD",
"format": "date",
"in": "query",
"name": "date_to",
"type": "string"
},
{
"description": "Source of the sighting.",
"in": "query",
"name": "source",
"type": "string"
},
{
"description": "Filter sightings by the status of the related advisory.",
"enum": [
"unpublished"
],
"in": "query",
"name": "advisory_status",
"type": "string"
},
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success",
"schema": {
"items": {
"$ref": "#/definitions/SightingsList"
},
"type": "array"
}
}
},
"summary": "List all sightings",
"tags": [
"sighting"
]
},
"post": {
"description": "Create a new sighting.",
"operationId": "post_sightings_list",
"parameters": [
{
"in": "body",
"name": "payload",
"required": true,
"schema": {
"$ref": "#/definitions/Sighting"
}
},
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"201": {
"description": "Success.",
"schema": {
"items": {
"$ref": "#/definitions/SightingsList"
},
"type": "array"
}
},
"400": {
"description": "Incorrect payload to instantiate a sighting."
},
"409": {
"description": "Duplicate sighting."
}
},
"summary": "Create a new sighting",
"tags": [
"sighting"
]
}
},
"/sighting/stats": {
"get": {
"description": "Aggregated sighting counts over a date range. Returns pre-grouped (no pagination) rows so the homepage can render the top-N charts and the evolution table without fetching raw sightings.",
"operationId": "sightings_stats",
"parameters": [
{
"description": "Inclusive lower bound of creation date. Format: YYYY-MM-DD.",
"format": "date",
"in": "query",
"name": "date_from",
"type": "string"
},
{
"description": "Inclusive upper bound of creation date. Format: YYYY-MM-DD.",
"format": "date",
"in": "query",
"name": "date_to",
"type": "string"
},
{
"description": "Optional filter on sighting type.",
"enum": [
"seen",
"published-proof-of-concept",
"exploited",
"not-exploited",
"confirmed",
"not-confirmed",
"patched",
"not-patched"
],
"in": "query",
"name": "type",
"type": "string"
},
{
"description": "Grouping dimensions. 'type,vulnerability' returns per-type vulnerability counts (charts); 'vulnerability,date' returns daily counts per vulnerability (table).",
"enum": [
"type,vulnerability",
"vulnerability,date"
],
"in": "query",
"name": "group_by",
"required": true,
"type": "string"
}
],
"responses": {
"200": {
"description": "Success"
}
},
"tags": [
"sighting"
]
}
},
"/sighting/{sighting_uuid}": {
"delete": {
"description": "Delete a single sighting by its UUID.",
"operationId": "delete_sighting_item",
"responses": {
"200": {
"description": "Sighting deleted successfully."
},
"403": {
"description": "Not allowed to delete this sighting."
},
"404": {
"description": "Sighting not found."
}
},
"summary": "Delete a single sighting by UUID",
"tags": [
"sighting"
]
},
"get": {
"description": "Get a sighting with its UUID.",
"operationId": "get_sighting_item",
"parameters": [
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/Sighting"
}
},
"404": {
"description": "Sighting not found."
}
},
"tags": [
"sighting"
]
},
"parameters": [
{
"in": "path",
"name": "sighting_uuid",
"required": true,
"type": "string"
}
]
},
"/stats/assigners/ranking": {
"get": {
"description": "Returns the assigners ranking.",
"operationId": "get_assigners_ranking",
"parameters": [
{
"default": 10,
"description": "The top elements to take into account in the query.",
"in": "query",
"name": "limit",
"type": "integer"
},
{
"default": "json",
"description": "The format of the output.",
"enum": [
"json",
"markdown"
],
"in": "query",
"name": "output",
"type": "string"
},
{
"default": "",
"description": "The period of the stats. Format: YYYY[-MM]",
"in": "query",
"name": "period",
"type": "string"
},
{
"default": "cvelistv5",
"description": "The source of the vulnerability advisories.",
"enum": [
"cvelistv5",
"certfr_avis",
"certfr_alerte",
"euvd"
],
"in": "query",
"name": "source",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success"
}
},
"tags": [
"stats"
]
}
},
"/stats/credits/ranking": {
"get": {
"description": "Returns the credits ranking.",
"operationId": "get_credits_ranking",
"parameters": [
{
"default": 10,
"description": "The top elements to take into account in the query.",
"in": "query",
"name": "limit",
"type": "integer"
},
{
"default": "json",
"description": "The format of the output.",
"enum": [
"json",
"markdown"
],
"in": "query",
"name": "output",
"type": "string"
},
{
"default": "",
"description": "The period of the stats. Format: YYYY[-MM]",
"in": "query",
"name": "period",
"type": "string"
},
{
"description": "Optional feeder name. If omitted, the combined ranking across all credit-indexing sources (the CVE list and the CSAF feeders) is returned.",
"in": "query",
"name": "source",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success"
}
},
"tags": [
"stats"
]
}
},
"/stats/cvss/scores": {
"get": {
"description": "Returns the severity band distribution of a source.",
"operationId": "get_cvss_scores",
"parameters": [
{
"default": "cvelistv5",
"description": "The source to report on, e.g. cvelistv5 or euvd.",
"in": "query",
"name": "source",
"type": "string"
},
{
"default": "",
"description": "Restrict the distribution to one publication year (YYYY). Omit for the whole source.",
"in": "query",
"name": "period",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/StatsDistribution"
}
},
"400": {
"description": "The request could not be satisfied.",
"schema": {
"$ref": "#/definitions/StatsError"
}
}
},
"tags": [
"stats"
]
}
},
"/stats/cvss/versions": {
"get": {
"description": "Returns the CVSS version distribution of a source.",
"operationId": "get_cvss_versions",
"parameters": [
{
"default": "cvelistv5",
"description": "The source to report on, e.g. cvelistv5 or euvd.",
"in": "query",
"name": "source",
"type": "string"
},
{
"default": "",
"description": "Restrict the distribution to one publication year (YYYY). Omit for the whole source.",
"in": "query",
"name": "period",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/StatsDistribution"
}
},
"400": {
"description": "The request could not be satisfied.",
"schema": {
"$ref": "#/definitions/StatsError"
}
}
},
"tags": [
"stats"
]
}
},
"/stats/cwe/most_used": {
"get": {
"description": "Returns the most used CWEs based on sightings",
"operationId": "get_cwe_most_used",
"parameters": [
{
"default": 10,
"description": "The top elements to take into account in the query.",
"in": "query",
"name": "limit",
"type": "integer"
},
{
"default": "json",
"description": "The format of the output.",
"enum": [
"json",
"markdown"
],
"in": "query",
"name": "output",
"type": "string"
},
{
"default": "",
"description": "The period of the stats. Format: YYYY[-MM]",
"in": "query",
"name": "period",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success"
}
},
"tags": [
"stats"
]
}
},
"/stats/kev": {
"get": {
"description": "Returns known-exploited inclusion for a source.",
"operationId": "get_kev_inclusion",
"parameters": [
{
"default": "cvelistv5",
"description": "The source to report on, e.g. cvelistv5 or euvd.",
"in": "query",
"name": "source",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/StatsKEV"
}
},
"400": {
"description": "The request could not be satisfied.",
"schema": {
"$ref": "#/definitions/StatsError"
}
}
},
"tags": [
"stats"
]
}
},
"/stats/scorecard/assigner": {
"get": {
"description": "Returns one assigner's scorecard.",
"operationId": "get_scorecard_assigner",
"parameters": [
{
"default": "cvelistv5",
"description": "The source to report on, e.g. cvelistv5 or euvd.",
"in": "query",
"name": "source",
"type": "string"
},
{
"description": "The assigner short name (a CNA), or the GNA source name (gna-) for a GNA source.",
"in": "query",
"name": "assigner",
"required": true,
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/ScorecardAssigner"
}
},
"400": {
"description": "The request could not be satisfied.",
"schema": {
"$ref": "#/definitions/StatsError"
}
}
},
"tags": [
"stats"
]
}
},
"/stats/scorecard/gnas": {
"get": {
"description": "Returns the cross-GNA scorecard ranking.",
"operationId": "get_scorecard_gn_as",
"parameters": [
{
"default": "cvelistv5",
"description": "The source to report on, e.g. cvelistv5 or euvd.",
"in": "query",
"name": "source",
"type": "string"
},
{
"default": "window",
"description": "'window' (the rolling window the ranking is built on, the default), 'all', or a publication year (YYYY).",
"in": "query",
"name": "period",
"type": "string"
},
{
"default": 100,
"description": "The most entries to return, at most 500.",
"in": "query",
"name": "limit",
"type": "integer"
},
{
"default": "json",
"description": "The format of the output.",
"enum": [
"json",
"markdown"
],
"in": "query",
"name": "output",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/ScorecardGNARanking"
}
},
"400": {
"description": "The request could not be satisfied.",
"schema": {
"$ref": "#/definitions/StatsError"
}
}
},
"tags": [
"stats"
]
}
},
"/stats/scorecard/ranking": {
"get": {
"description": "Returns the assigner scorecard ranking of a source.",
"operationId": "get_scorecard_ranking",
"parameters": [
{
"default": "cvelistv5",
"description": "The source to report on, e.g. cvelistv5 or euvd.",
"in": "query",
"name": "source",
"type": "string"
},
{
"default": "window",
"description": "'window' (the rolling window the ranking is built on, the default), 'all', or a publication year (YYYY).",
"in": "query",
"name": "period",
"type": "string"
},
{
"default": 100,
"description": "The most entries to return, at most 500.",
"in": "query",
"name": "limit",
"type": "integer"
},
{
"default": "json",
"description": "The format of the output.",
"enum": [
"json",
"markdown"
],
"in": "query",
"name": "output",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/ScorecardRanking"
}
},
"400": {
"description": "The request could not be satisfied.",
"schema": {
"$ref": "#/definitions/StatsError"
}
}
},
"tags": [
"stats"
]
}
},
"/stats/scorecard/signals": {
"get": {
"description": "Returns the scorecard signals of a source.",
"operationId": "get_scorecard_signals",
"parameters": [
{
"default": "cvelistv5",
"description": "The source to report on, e.g. cvelistv5 or euvd.",
"in": "query",
"name": "source",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/ScorecardSignals"
}
},
"400": {
"description": "The request could not be satisfied.",
"schema": {
"$ref": "#/definitions/StatsError"
}
}
},
"tags": [
"stats"
]
}
},
"/stats/sighting/exploitation_ratio": {
"get": {
"description": "Per publication year, the share of CVEs that have at least one exploitation sighting (type 'exploited' or 'published-proof-of-concept') over the total number of CVEs published that year. Both sides of the ratio are bucketed by the CVE Program publication date, not by the year in the CVE id, so a CVE-2023-* record published in 2025 counts in 2025. Sighted ids that the CVE Program never published are left out; their number is reported in the metadata. Useful to track whether the proportion of exploited vulnerabilities evolves over time, independently of the raw discovery volume. With 'year', the same ratio is returned per publication month of that year instead. Note: recent years are undercounted, as sightings accumulate over time.",
"operationId": "get_exploitation_ratio",
"parameters": [
{
"default": 1999,
"description": "Inclusive lower bound of the CVE year range. Format: YYYY.",
"in": "query",
"name": "year_from",
"type": "integer"
},
{
"description": "Inclusive upper bound of the CVE year range. Defaults to the current year.",
"in": "query",
"name": "year_to",
"type": "integer"
},
{
"description": "Break one publication year down per month (YYYY). The months after the current one are omitted for the current year. Overrides year_from and year_to.",
"in": "query",
"name": "year",
"type": "integer"
},
{
"default": "json",
"description": "The format of the output.",
"enum": [
"json",
"markdown"
],
"in": "query",
"name": "output",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success"
}
},
"tags": [
"stats"
]
}
},
"/stats/sighting/exploitation_ratio_cumulative": {
"get": {
"description": "Cumulative share of published CVEs that have received at least one exploitation sighting ('exploited' or 'published-proof-of-concept'), bucketed by the date of the sighting rather than the CVE year. Each bucket reports the running totals up to that point, so the series is monotonic in its inputs and reflects how the overall exploited fraction evolves over time. Returns the trailing 'window' buckets (default 30).",
"operationId": "get_exploitation_ratio_cumulative",
"parameters": [
{
"default": "month",
"description": "Bucket size of the cumulative series.",
"enum": [
"month",
"year"
],
"in": "query",
"name": "granularity",
"type": "string"
},
{
"default": 30,
"description": "Number of trailing buckets to return. Use 0 for the full history.",
"in": "query",
"name": "window",
"type": "integer"
},
{
"default": "json",
"description": "The format of the output.",
"enum": [
"json",
"markdown"
],
"in": "query",
"name": "output",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success"
}
},
"tags": [
"stats"
]
}
},
"/stats/time_to_exploit": {
"get": {
"description": "Returns the publication-to-exploitation summary of a source.",
"operationId": "get_time_to_exploit",
"parameters": [
{
"default": "cvelistv5",
"description": "The source to report on, e.g. cvelistv5 or euvd.",
"in": "query",
"name": "source",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/StatsTimeToExploit"
}
},
"400": {
"description": "The request could not be satisfied.",
"schema": {
"$ref": "#/definitions/StatsError"
}
}
},
"tags": [
"stats"
]
}
},
"/stats/vendors/ranking": {
"get": {
"description": "Returns the vendors ranking.",
"operationId": "get_vendors_ranking",
"parameters": [
{
"default": 10,
"description": "The top elements to take into account in the query.",
"in": "query",
"name": "limit",
"type": "integer"
},
{
"default": "json",
"description": "The format of the output.",
"enum": [
"json",
"markdown"
],
"in": "query",
"name": "output",
"type": "string"
},
{
"default": "",
"description": "The period of the stats. Format: YYYY[-MM]",
"in": "query",
"name": "period",
"type": "string"
},
{
"default": "cvelistv5",
"description": "The source of the vulnerability advisories.",
"enum": [
"cvelistv5",
"certfr_avis",
"certfr_alerte",
"euvd"
],
"in": "query",
"name": "source",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success"
}
},
"tags": [
"stats"
]
}
},
"/stats/vulnerability/count": {
"get": {
"description": "Returns the number of published/reserved vulnerabilities for a specific period.",
"operationId": "get_vulnerability_count",
"parameters": [
{
"default": "published",
"description": "The state of the advisory.",
"enum": [
"published",
"reserved"
],
"in": "query",
"name": "state",
"type": "string"
},
{
"default": "",
"description": "The period of the stats. Format: YYYY[-MM]",
"in": "query",
"name": "period",
"required": true,
"type": "string"
},
{
"default": "cvelistv5",
"description": "The source of the vulnerability advisories.",
"enum": [
"cvelistv5",
"github",
"pysec",
"tailscale",
"ossf_malicious_packages",
"variot",
"euvd"
],
"in": "query",
"name": "source",
"required": true,
"type": "string"
}
],
"responses": {
"200": {
"description": "Success"
}
},
"tags": [
"stats"
]
}
},
"/stats/vulnerability/counts": {
"get": {
"description": "Returns the record count per publication period.",
"operationId": "get_vulnerability_counts",
"parameters": [
{
"default": "cvelistv5",
"description": "The source to report on, e.g. cvelistv5 or euvd.",
"in": "query",
"name": "source",
"type": "string"
},
{
"default": "year",
"description": "Period granularity of the counts.",
"enum": [
"year",
"month"
],
"in": "query",
"name": "granularity",
"type": "string"
},
{
"default": "",
"description": "With granularity=month, the year whose months are returned (YYYY). Defaults to the current year. Refused with granularity=year, where the answer already carries every year.",
"in": "query",
"name": "period",
"type": "string"
},
{
"default": "published",
"description": "Count records by publication date (default) or by reservation date.",
"enum": [
"published",
"reserved"
],
"in": "query",
"name": "state",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/StatsCounts"
}
},
"400": {
"description": "The request could not be satisfied.",
"schema": {
"$ref": "#/definitions/StatsError"
}
}
},
"tags": [
"stats"
]
}
},
"/stats/vulnerability/most_commented": {
"get": {
"description": "Returns the most commented vulnerabilities.",
"operationId": "get_vulnerability_most_commented",
"parameters": [
{
"description": "The date of the sightings must be bigger or equal than this value. Format: YYYY-MM-DD",
"format": "date",
"in": "query",
"name": "date_from",
"type": "string"
},
{
"description": "The date of the sightings must be smaller or equal than this value. Format: YYYY-MM-DD",
"format": "date",
"in": "query",
"name": "date_to",
"type": "string"
},
{
"default": 10,
"description": "The top elements to take into account in the query.",
"in": "query",
"name": "limit",
"type": "integer"
},
{
"default": "json",
"description": "The format of the output.",
"enum": [
"json",
"markdown"
],
"in": "query",
"name": "output",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success"
}
},
"tags": [
"stats"
]
}
},
"/stats/vulnerability/most_sighted": {
"get": {
"description": "Returns the most sighted vulnerabilities.",
"operationId": "get_vulnerability_most_sighted",
"parameters": [
{
"description": "The date of the sightings must be bigger or equal than this value. Format: YYYY-MM-DD",
"format": "date",
"in": "query",
"name": "date_from",
"type": "string"
},
{
"description": "The date of the sightings must be smaller or equal than this value. Format: YYYY-MM-DD",
"format": "date",
"in": "query",
"name": "date_to",
"type": "string"
},
{
"default": "",
"description": "The type of the sighting.",
"enum": [
"seen",
"exploited",
"published-proof-of-concept",
"not-exploited",
"confirmed",
"not-confirmed",
"patched",
"not-patched"
],
"in": "query",
"name": "sighting_type",
"type": "string"
},
{
"default": 10,
"description": "The top elements to take into account in the query.",
"in": "query",
"name": "limit",
"type": "integer"
},
{
"default": "json",
"description": "The format of the output.",
"enum": [
"json",
"markdown"
],
"in": "query",
"name": "output",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success"
}
},
"tags": [
"stats"
]
}
},
"/stats/vulnerability/status": {
"get": {
"description": "Returns the lifecycle split of a source.",
"operationId": "get_vulnerability_status",
"parameters": [
{
"default": "cvelistv5",
"description": "The source to report on, e.g. cvelistv5 or euvd.",
"in": "query",
"name": "source",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/StatsStatus"
}
},
"400": {
"description": "The request could not be satisfied.",
"schema": {
"$ref": "#/definitions/StatsError"
}
}
},
"tags": [
"stats"
]
}
},
"/system/checkProcess": {
"get": {
"description": "Checks the heartbeats of the various processes.",
"operationId": "get_check_process",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Checks the heartbeats of the various processes",
"tags": [
"system"
]
}
},
"/system/checkSMTP": {
"get": {
"description": "Checks the SMTP connection.",
"operationId": "get_check_smtp",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Checks the SMTP connection",
"tags": [
"system"
]
}
},
"/system/configInfo": {
"get": {
"description": "Returns non-sensitive information about the configuration of the system.",
"operationId": "get_config_info",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Returns non-sensitive information about the configuration of the system",
"tags": [
"system"
]
}
},
"/system/dbInfo": {
"get": {
"description": "Returns information about the current sources in the Kvrocks database in use and when it was updated.",
"operationId": "get_info",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Returns information about the current sources in the Kvrocks database in use and when it was updated",
"tags": [
"system"
]
}
},
"/system/pgInfo": {
"get": {
"description": "Returns information about the PostgreSQL database.",
"operationId": "get_pg_info",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Returns information about the PostgreSQL database",
"tags": [
"system"
]
}
},
"/system/redis_up": {
"get": {
"deprecated": true,
"description": "Alias for /api/system/redis_up",
"operationId": "get_redis_up_/system/redis_up",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Check if Valkey/Redis is up and running",
"tags": [
"system"
]
}
},
"/system/valkey_up": {
"get": {
"description": "Check if Valkey/Redis is up and running.",
"operationId": "get_redis_up",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Check if Valkey/Redis is up and running",
"tags": [
"system"
]
}
},
"/user/": {
"get": {
"description": "Only available to administrators.",
"operationId": "list_users",
"parameters": [
{
"default": 1,
"description": "Number of the page.",
"in": "query",
"name": "page",
"type": "integer"
},
{
"default": 10,
"description": "Maximum number of elements to return.",
"in": "query",
"name": "per_page",
"type": "integer"
},
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"items": {
"$ref": "#/definitions/UsersList"
},
"type": "array"
}
},
"403": {
"description": "Admin permission required."
}
},
"summary": "List all users",
"tags": [
"user"
]
},
"post": {
"description": "Create a non-admin user.",
"operationId": "post_users_list",
"parameters": [
{
"default": 1,
"description": "Number of the page.",
"in": "query",
"name": "page",
"type": "integer"
},
{
"default": 10,
"description": "Maximum number of elements to return.",
"in": "query",
"name": "per_page",
"type": "integer"
},
{
"in": "body",
"name": "payload",
"required": true,
"schema": {
"properties": {
"email": {
"description": "Email.",
"type": "string"
},
"login": {
"description": "Login.",
"type": "string"
},
"name": {
"description": "Display name (firstname, lastname).",
"type": "string"
},
"organisation": {
"description": "Organisation.",
"type": "string"
}
},
"required": [
"login",
"name",
"email"
],
"type": "object"
}
},
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success",
"schema": {
"$ref": "#/definitions/UserFull"
}
},
"201": {
"description": "Success."
},
"403": {
"description": "Self-registration is disabled."
},
"422": {
"description": "Email address not accepted (disposable email detected, blocked domain, or invalid domain)."
},
"429": {
"description": "Too many requests (maximum 3 registrations/hour per IP)"
}
},
"tags": [
"user"
]
}
},
"/user/api_key": {
"post": {
"description": "Regenerating the API key of the authenticated user with the current API key.",
"operationId": "post_user_new_api_key",
"parameters": [
{
"in": "body",
"name": "payload",
"required": true,
"schema": {
"$ref": "#/definitions/API%20Key"
}
},
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/UserFull"
}
},
"403": {
"description": "Wrong API key submitted."
},
"404": {
"description": "User not found."
}
},
"summary": "Regenerating the API key of the authenticated user with the current API key",
"tags": [
"user"
]
}
},
"/user/me": {
"get": {
"description": "Get information about the currently authenticated user.",
"operationId": "get_user_self",
"parameters": [
{
"description": "An optional fields mask",
"format": "mask",
"in": "header",
"name": "X-Fields",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success.",
"schema": {
"$ref": "#/definitions/UserFull"
}
},
"404": {
"description": "User not found."
}
},
"summary": "Get information about the currently authenticated user",
"tags": [
"user"
]
}
},
"/user/{user_id}": {
"delete": {
"description": "Delete a user.",
"operationId": "delete_user_item",
"responses": {
"204": {
"description": "Success."
},
"403": {
"description": "Administrator permission required or not the current user."
},
"404": {
"description": "User not found."
},
"500": {
"description": "Internal server error."
}
},
"summary": "Endpoint for deleting a user",
"tags": [
"user"
]
},
"parameters": [
{
"in": "path",
"name": "user_id",
"required": true,
"type": "integer"
}
]
},
"/vex/": {
"get": {
"description": "Browse the VEX records available in vulnerability-lookup, newest first.",
"operationId": "get_vex_browse",
"parameters": [
{
"description": "Filter by VEX metadata source.",
"in": "query",
"name": "source",
"type": "string"
},
{
"description": "Case-insensitive substring filter on the vulnerability id, document title, or source name.",
"in": "query",
"name": "q",
"type": "string"
},
{
"default": 1,
"description": "Number of the page.",
"in": "query",
"name": "page",
"type": "integer"
},
{
"default": 100,
"description": "Maximum number of VEX records to return (capped at 1000).",
"in": "query",
"name": "per_page",
"type": "integer"
}
],
"responses": {
"200": {
"description": "Success."
}
},
"summary": "Browse VEX records and pivot to the related vulnerability",
"tags": [
"vex"
]
}
},
"/vex/{vulnerability_id}": {
"get": {
"description": "Get the VEX statements attached to a vulnerability.",
"operationId": "get_vex_list",
"responses": {
"200": {
"description": "Success."
}
},
"summary": "Get the VEX statements attached to a vulnerability",
"tags": [
"vex"
]
},
"parameters": [
{
"in": "path",
"name": "vulnerability_id",
"required": true,
"type": "string"
}
]
},
"/vex/{vulnerability_id}/{meta_source}/csaf": {
"get": {
"description": "Get the full CSAF VEX document stored for a vulnerability.",
"operationId": "get_vex_document",
"responses": {
"200": {
"description": "Success."
},
"404": {
"description": "No stored VEX document for this vulnerability and source."
}
},
"summary": "Get the full CSAF VEX document stored for a vulnerability",
"tags": [
"vex"
]
},
"parameters": [
{
"in": "path",
"name": "vulnerability_id",
"required": true,
"type": "string"
},
{
"in": "path",
"name": "meta_source",
"required": true,
"type": "string"
}
]
},
"/vlai/attack-techniques": {
"post": {
"description": "Suggest MITRE ATT&CK techniques based on vulnerability descriptions.",
"operationId": "post_vlai_attack_techniques",
"parameters": [
{
"in": "body",
"name": "payload",
"required": true,
"schema": {
"properties": {
"description": {
"default": "",
"description": "Description of the vulnerability.",
"type": "string"
},
"top_k": {
"default": 5,
"description": "Maximum number of ATT&CK techniques to return.",
"type": "integer"
}
},
"type": "object"
}
}
],
"responses": {
"200": {
"description": "Success."
},
"401": {
"description": "Authentication required (VLAI_CLASSIFICATION_REQUIRE_AUTH is on and no session, X-API-KEY or X-VLAI-Token was presented)."
},
"500": {
"description": "Unexpected error."
},
"502": {
"description": "Bad content: Invalid response from ML-Gateway."
},
"503": {
"description": "Connection Error: Unable to reach ML-Gateway."
}
},
"tags": [
"vlai"
]
}
},
"/vlai/attack-techniques/catalog": {
"get": {
"description": "Every MITRE ATT&CK technique the bi-encoder similarity search can rank vulnerabilities for, sorted by id: the techniques the model was trained on (`in_vocabulary` true) and the other enterprise techniques, scored from their official ATT&CK text. Backs the technique index page.",
"operationId": "get_vlai_attack_technique_catalog",
"responses": {
"200": {
"description": "Success."
},
"500": {
"description": "Unexpected error."
},
"502": {
"description": "Bad content: Invalid response from ML-Gateway."
},
"503": {
"description": "Connection Error: Unable to reach ML-Gateway."
}
},
"tags": [
"vlai"
]
}
},
"/vlai/attack-techniques/{technique_id}/vulnerabilities": {
"get": {
"description": "Vulnerabilities whose description is nearest to one MITRE ATT&CK technique in the CIRCL bi-encoder space, best first. A similarity search over the indexed descriptions, not a classification: only the vulnerability -> technique direction has measured accuracy. `in_vocabulary` is false for techniques the model was not trained on, which rank noticeably worse. `score` is the training-time probability sigmoid(logit_scale * cosine + logit_bias).",
"operationId": "get_vlai_attack_technique_vulnerabilities",
"parameters": [
{
"default": 10,
"description": "Number of vulnerabilities to return (1-100).",
"in": "query",
"maximum": 100,
"minimum": 1,
"name": "top_k",
"type": "integer"
}
],
"responses": {
"200": {
"description": "Success."
},
"400": {
"description": "Invalid technique id or top_k."
},
"404": {
"description": "Unknown technique."
},
"500": {
"description": "Unexpected error."
},
"502": {
"description": "Bad content: Invalid response from ML-Gateway."
},
"503": {
"description": "Connection Error: Unable to reach ML-Gateway."
}
},
"tags": [
"vlai"
]
},
"parameters": [
{
"description": "MITRE ATT&CK technique id, e.g. T1190 or T1059.004.",
"in": "path",
"name": "technique_id",
"required": true,
"type": "string"
}
]
},
"/vlai/related/{vulnerability_id}": {
"get": {
"description": "Vulnerabilities whose description is nearest to this one in the CIRCL ATT&CK bi-encoder space, by plain cosine, best first. A similarity search with no measured accuracy, not a classification. The search runs on the vulnerability's stored vector when it is indexed (`query.by` is `id`); otherwise its description is embedded on the fly (`query.by` is `text`, `query.indexed` is false). `query.id` is the identifier the record is indexed under.",
"operationId": "get_vlai_related_vulnerabilities",
"parameters": [
{
"default": 10,
"description": "Number of vulnerabilities to return (1-100).",
"in": "query",
"maximum": 100,
"minimum": 1,
"name": "top_k",
"type": "integer"
}
],
"responses": {
"200": {
"description": "Success."
},
"400": {
"description": "Invalid top_k."
},
"404": {
"description": "Unknown vulnerability."
},
"422": {
"description": "The record has no description to search with."
},
"500": {
"description": "Unexpected error."
},
"502": {
"description": "Bad content: Invalid response from ML-Gateway."
},
"503": {
"description": "Connection Error: Unable to reach ML-Gateway."
}
},
"tags": [
"vlai"
]
},
"parameters": [
{
"description": "Identifier of a stored vulnerability, e.g. CVE-2021-44077.",
"in": "path",
"name": "vulnerability_id",
"required": true,
"type": "string"
}
]
},
"/vlai/severity-classification": {
"post": {
"description": "Classify vulnerabilities by severity based on their descriptions.",
"operationId": "post_vlai_severity_classification",
"parameters": [
{
"in": "body",
"name": "payload",
"required": true,
"schema": {
"properties": {
"description": {
"default": "",
"description": "Description of the vulnerability.",
"type": "string"
},
"model": {
"default": "CIRCL/vulnerability-severity-classification-RoBERTa-base",
"description": "AI model to use.",
"type": "string"
}
},
"type": "object"
}
}
],
"responses": {
"200": {
"description": "Success."
},
"401": {
"description": "Authentication required (VLAI_CLASSIFICATION_REQUIRE_AUTH is on and no session, X-API-KEY or X-VLAI-Token was presented)."
},
"500": {
"description": "Unexpected error."
},
"502": {
"description": "Bad content: Invalid response from ML-Gateway."
},
"503": {
"description": "Connection Error: Unable to reach ML-Gateway."
}
},
"tags": [
"vlai"
]
}
},
"/vulnerability/": {
"get": {
"description": "Retrieve vulnerabilities with optional filtering and pagination.\n\nSupports light mode for minimal data (returns only vulnerability ID and source).\nReturns full vulnerability details by default, or only IDs and sources in light mode.\n\nQuery Parameters\n----------------\nsource : str\n Optional source to filter vulnerabilities (e.g., 'CVE', 'GHSA', 'PySec').\nper_page : int, default=30\n Maximum number of results (capped at 100).\ndate_sort : str\n Field to sort by. Options: '', 'published', 'updated', 'reserved'.\nsort_order : str\n Sort order: 'asc' or 'desc'.\nsince : str\n Retrieve vulnerabilities published/updated after the specified date.\npage : int\n Pagination page number.\ncwe : str\n Filter vulnerabilities by a specific CWE ID.\nproduct : str\n Optional product name to filter vulnerabilities (case-insensitive). If set, the endpoint returns vulnerabilities related to this product across all vendors. Use with `assigner` to further narrow results.\nassigner : str\n Optional CNA/assigner short name to filter results (case-insensitive). Only effective when used with `product` or `vendor` filters.\nlight : str\n If '1', returns only `(vulnerability_id, source)` instead of full details.\nwith_meta : str\n If 'true', includes metadata for each vulnerability. Ignored in light mode.\nwith_linked : str\n If 'true', includes linked vulnerabilities for each result. Ignored in light mode.\nwith_comments : str\n If 'true', includes comments for each result. Ignored in light mode.\nwith_bundles : str\n If 'true', includes bundles for each result. Ignored in light mode.\nwith_sightings : str\n If 'true', includes sightings for each result. Ignored in light mode.\n\nReturns\n-------\nlist[dict[str, Any]] | list[tuple[str, str | None]]\n Full vulnerability details or minimal tuples if light mode is enabled.",
"operationId": "get_vulnerabilities_list",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Retrieve vulnerabilities with optional filters",
"tags": [
"vulnerability"
]
},
"parameters": [
{
"default": "",
"description": "Optional product name to filter vulnerabilities (case-insensitive). When provided, results are returned for the product across all vendors.",
"in": "query",
"name": "product",
"type": "string"
},
{
"default": "false",
"description": "If 'true', include sightings for each result. Ignored in light mode.",
"in": "query",
"name": "with_sightings",
"type": "string"
},
{
"default": "false",
"description": "If 'true', include bundles for each result. Ignored in light mode.",
"in": "query",
"name": "with_bundles",
"type": "string"
},
{
"default": "false",
"description": "If 'true', include comments for each result. Ignored in light mode.",
"in": "query",
"name": "with_comments",
"type": "string"
},
{
"default": "false",
"description": "If 'true', include linked vulnerabilities for each result. Ignored in light mode.",
"in": "query",
"name": "with_linked",
"type": "string"
},
{
"default": "false",
"description": "If 'true', include metadata for each vulnerability. Ignored in light mode.",
"in": "query",
"name": "with_meta",
"type": "string"
},
{
"default": "0",
"description": "If '1', returns only vulnerability ID and source",
"in": "query",
"name": "light",
"type": "string"
},
{
"description": "Filter vulnerabilities by a specific CWE ID",
"in": "query",
"name": "cwe",
"type": "string"
},
{
"default": "",
"description": "Retrieve vulnerabilities reported after the specified date.",
"in": "query",
"name": "since",
"type": "string"
},
{
"default": "desc",
"description": "Sort order: 'asc' or 'desc'",
"in": "query",
"name": "sort_order",
"type": "string"
},
{
"default": "updated",
"description": "Sort field: '', 'published', 'updated', 'reserved'",
"in": "query",
"name": "date_sort",
"type": "string"
},
{
"default": 30,
"description": "Maximum number of results (capped at 100)",
"in": "query",
"name": "per_page",
"type": "string"
},
{
"default": 1,
"description": "Pagination page number",
"in": "query",
"name": "page",
"type": "string"
},
{
"description": "Optional data source to filter vulnerabilities (e.g., 'cvelistv5', 'github', 'nvd')",
"in": "query",
"name": "source",
"type": "string"
}
]
},
"/vulnerability/browse/": {
"get": {
"deprecated": true,
"description": "Deprecated: use GET /api/browse/vendors instead. Get the known vendors.\nDeprecated in favor of /api/browse/vendors.",
"operationId": "get_vendors",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Get the known vendors",
"tags": [
"vulnerability"
]
}
},
"/vulnerability/browse/assigners": {
"get": {
"description": "Get the known CNAs.",
"operationId": "get_assigners",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Get the known CNAs",
"tags": [
"vulnerability"
]
}
},
"/vulnerability/bulk": {
"post": {
"description": "Retrieve up to 100 vulnerabilities by identifier in one request. `data` keeps the input order, one entry per identifier asked, with `vulnerability` null for an identifier that is not present; `metadata` counts the identifiers requested and found. Duplicate identifiers are looked up only once. `with_linked` serves every linked record whole, as GET / does, so it is accepted for at most 10 identifiers.",
"operationId": "post_vulnerabilities_bulk",
"parameters": [
{
"in": "body",
"name": "payload",
"required": true,
"schema": {
"$ref": "#/definitions/VulnerabilityBulkLookup"
}
}
],
"responses": {
"200": {
"description": "Success."
},
"400": {
"description": "Invalid request payload."
}
},
"tags": [
"vulnerability"
]
}
},
"/vulnerability/cpesearch/{cpe}": {
"get": {
"description": "Get vulnerabilities by CPE (based on the extracted CPE vendor and product).",
"operationId": "get_cpe_search",
"responses": {
"200": {
"description": "Success."
},
"404": {
"description": "No match found in the CPE string."
}
},
"summary": "Get vulnerabilities by CPE (based on the extracted CPE vendor and product)",
"tags": [
"vulnerability"
]
},
"parameters": [
{
"default": "desc",
"description": "Sort order: 'asc' or 'desc'",
"in": "query",
"name": "sort_order",
"type": "string"
},
{
"default": "updated",
"description": "Sort field: '', 'published', 'updated', 'reserved'",
"in": "query",
"name": "date_sort",
"type": "string"
},
{
"default": 30,
"description": "Maximum number of results (capped at 100)",
"in": "query",
"name": "per_page",
"type": "string"
},
{
"default": 1,
"description": "Pagination page number",
"in": "query",
"name": "page",
"type": "string"
},
{
"default": "cvelistv5",
"description": "Optional source to filter vulnerabilities (e.g., 'cvelistv5', 'nvd')",
"in": "query",
"name": "source",
"type": "string"
},
{
"in": "path",
"name": "cpe",
"required": true,
"type": "string"
}
]
},
"/vulnerability/fulltext": {
"get": {
"description": "Fulltext search across all indexed vulnerability sources.",
"operationId": "get_fulltext_search",
"parameters": [
{
"description": "Fulltext search query string.",
"in": "query",
"name": "q",
"required": true,
"type": "string"
},
{
"default": 1,
"description": "Number of the page.",
"in": "query",
"name": "page",
"type": "integer"
},
{
"default": 10,
"description": "Maximum number of elements to return (capped at 100).",
"in": "query",
"name": "per_page",
"type": "integer"
},
{
"description": "Comma-separated list of sources to search (e.g., 'cvelistv5', 'variot', 'certfr_alerte', 'certfr_avis', 'jvndb'). Defaults to 'cvelistv5'.",
"in": "query",
"name": "sources",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success."
},
"400": {
"description": "Missing or empty query parameter."
},
"503": {
"description": "Fulltext search is not enabled on this instance."
}
},
"summary": "Search vulnerabilities using fulltext search",
"tags": [
"vulnerability"
]
}
},
"/vulnerability/last": {
"get": {
"deprecated": true,
"description": "Retrieve the latest vulnerabilities, with optional filters for source and number of results. Supports light mode for minimal data and provides backward-compatible routes.The light mode only returns the vulnerability id and the sources.\nSupports light mode for minimal data and provides backward-compatible routes.\nThe light mode only returns the vulnerability id and the sources.",
"operationId": "get_last",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Retrieve the latest vulnerabilities, with optional filters for source and number of results",
"tags": [
"vulnerability"
]
},
"parameters": [
{
"default": 1,
"description": "Number of the page.",
"in": "query",
"name": "page",
"type": "integer"
},
{
"description": "CWE mentioned in the vulnerability.",
"in": "query",
"name": "cwe",
"type": "string"
}
]
},
"/vulnerability/last/{number}": {
"get": {
"deprecated": true,
"description": "Retrieve the latest vulnerabilities, with optional filters for source and number of results. Supports light mode for minimal data and provides backward-compatible routes.The light mode only returns the vulnerability id and the sources.\nSupports light mode for minimal data and provides backward-compatible routes.\nThe light mode only returns the vulnerability id and the sources.",
"operationId": "get_last",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Retrieve the latest vulnerabilities, with optional filters for source and number of results",
"tags": [
"vulnerability"
]
},
"parameters": [
{
"default": 1,
"description": "Number of the page.",
"in": "query",
"name": "page",
"type": "integer"
},
{
"description": "CWE mentioned in the vulnerability.",
"in": "query",
"name": "cwe",
"type": "string"
},
{
"in": "path",
"name": "number",
"required": true,
"type": "integer"
}
]
},
"/vulnerability/last/{source}": {
"get": {
"deprecated": true,
"description": "Retrieve the latest vulnerabilities, with optional filters for source and number of results. Supports light mode for minimal data and provides backward-compatible routes.The light mode only returns the vulnerability id and the sources.\nSupports light mode for minimal data and provides backward-compatible routes.\nThe light mode only returns the vulnerability id and the sources.",
"operationId": "get_last",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Retrieve the latest vulnerabilities, with optional filters for source and number of results",
"tags": [
"vulnerability"
]
},
"parameters": [
{
"default": 1,
"description": "Number of the page.",
"in": "query",
"name": "page",
"type": "integer"
},
{
"description": "CWE mentioned in the vulnerability.",
"in": "query",
"name": "cwe",
"type": "string"
},
{
"in": "path",
"name": "source",
"required": true,
"type": "string"
}
]
},
"/vulnerability/last/{source}/{number}": {
"get": {
"deprecated": true,
"description": "Retrieve the latest vulnerabilities, with optional filters for source and number of results. Supports light mode for minimal data and provides backward-compatible routes.The light mode only returns the vulnerability id and the sources.\nSupports light mode for minimal data and provides backward-compatible routes.\nThe light mode only returns the vulnerability id and the sources.",
"operationId": "get_last",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Retrieve the latest vulnerabilities, with optional filters for source and number of results",
"tags": [
"vulnerability"
]
},
"parameters": [
{
"default": 1,
"description": "Number of the page.",
"in": "query",
"name": "page",
"type": "integer"
},
{
"description": "CWE mentioned in the vulnerability.",
"in": "query",
"name": "cwe",
"type": "string"
},
{
"in": "path",
"name": "source",
"required": true,
"type": "string"
},
{
"in": "path",
"name": "number",
"required": true,
"type": "integer"
}
]
},
"/vulnerability/recent": {
"get": {
"deprecated": true,
"description": "Retrieve vulnerabilities reported after a specified date, with optional filters for source and number of results. Defaults to the last 24 hours if no date is provided. Supports light mode for minimal data.\nDefaults to the last 24 hours if no date is provided. Supports light mode for minimal data.",
"operationId": "get_recent",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Retrieve vulnerabilities reported after a specified date, with optional filters for source and number of results",
"tags": [
"vulnerability"
]
}
},
"/vulnerability/recent/": {
"get": {
"deprecated": true,
"description": "Retrieve vulnerabilities reported after a specified date, with optional filters for source and number of results. Defaults to the last 24 hours if no date is provided. Supports light mode for minimal data.\nDefaults to the last 24 hours if no date is provided. Supports light mode for minimal data.",
"operationId": "get_recent",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Retrieve vulnerabilities reported after a specified date, with optional filters for source and number of results",
"tags": [
"vulnerability"
]
}
},
"/vulnerability/recent/{date}": {
"get": {
"deprecated": true,
"description": "Retrieve vulnerabilities reported after a specified date, with optional filters for source and number of results. Defaults to the last 24 hours if no date is provided. Supports light mode for minimal data.\nDefaults to the last 24 hours if no date is provided. Supports light mode for minimal data.",
"operationId": "get_recent",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Retrieve vulnerabilities reported after a specified date, with optional filters for source and number of results",
"tags": [
"vulnerability"
]
},
"parameters": [
{
"in": "path",
"name": "date",
"required": true,
"type": "string"
}
]
},
"/vulnerability/recent/{date}/{number}": {
"get": {
"deprecated": true,
"description": "Retrieve vulnerabilities reported after a specified date, with optional filters for source and number of results. Defaults to the last 24 hours if no date is provided. Supports light mode for minimal data.\nDefaults to the last 24 hours if no date is provided. Supports light mode for minimal data.",
"operationId": "get_recent",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Retrieve vulnerabilities reported after a specified date, with optional filters for source and number of results",
"tags": [
"vulnerability"
]
},
"parameters": [
{
"in": "path",
"name": "date",
"required": true,
"type": "string"
},
{
"in": "path",
"name": "number",
"required": true,
"type": "integer"
}
]
},
"/vulnerability/recent/{date}/{source}": {
"get": {
"deprecated": true,
"description": "Retrieve vulnerabilities reported after a specified date, with optional filters for source and number of results. Defaults to the last 24 hours if no date is provided. Supports light mode for minimal data.\nDefaults to the last 24 hours if no date is provided. Supports light mode for minimal data.",
"operationId": "get_recent",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Retrieve vulnerabilities reported after a specified date, with optional filters for source and number of results",
"tags": [
"vulnerability"
]
},
"parameters": [
{
"in": "path",
"name": "date",
"required": true,
"type": "string"
},
{
"in": "path",
"name": "source",
"required": true,
"type": "string"
}
]
},
"/vulnerability/recent/{date}/{source}/{number}": {
"get": {
"deprecated": true,
"description": "Retrieve vulnerabilities reported after a specified date, with optional filters for source and number of results. Defaults to the last 24 hours if no date is provided. Supports light mode for minimal data.\nDefaults to the last 24 hours if no date is provided. Supports light mode for minimal data.",
"operationId": "get_recent",
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Retrieve vulnerabilities reported after a specified date, with optional filters for source and number of results",
"tags": [
"vulnerability"
]
},
"parameters": [
{
"in": "path",
"name": "date",
"required": true,
"type": "string"
},
{
"in": "path",
"name": "source",
"required": true,
"type": "string"
},
{
"in": "path",
"name": "number",
"required": true,
"type": "integer"
}
]
},
"/vulnerability/search/{vendor}/{product}": {
"get": {
"description": "Returns a list of vulnerabilities related to the product.\nOptionally filter vulnerabilities published or updated after the specified date (format: YYYY-MM-DD).",
"operationId": "get_vendor_product_vulnerabilities",
"parameters": [
{
"default": 1,
"description": "Number of the page.",
"in": "query",
"name": "page",
"type": "integer"
},
{
"default": 10,
"description": "Maximum number of elements to return.",
"in": "query",
"name": "per_page",
"type": "integer"
},
{
"description": "Filter vulnerabilities published or updated after the specified date (format: YYYY-MM-DD).",
"in": "query",
"name": "since",
"type": "string"
}
],
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Returns a list of vulnerabilities related to the vendor and product",
"tags": [
"vulnerability"
]
},
"parameters": [
{
"in": "path",
"name": "vendor",
"required": true,
"type": "string"
},
{
"in": "path",
"name": "product",
"required": true,
"type": "string"
}
]
},
"/vulnerability/{vulnerability_id}": {
"get": {
"description": "Get a vulnerability. A GCVE-0 identifier (GCVE-0-YYYY-NNNN) is accepted and served as its CVE (CVE-YYYY-NNNN): the record's cveMetadata.cveId and x_gcve advisory entry then state the CVE identifier, not the one requested.",
"operationId": "get_vulnerability",
"parameters": [
{
"default": false,
"description": "Include metadata.",
"in": "query",
"name": "with_meta",
"type": "boolean"
},
{
"default": false,
"description": "Include the linked vulnerabilities.",
"in": "query",
"name": "with_linked",
"type": "boolean"
},
{
"default": false,
"description": "Include the comments.",
"in": "query",
"name": "with_comments",
"type": "boolean"
},
{
"default": false,
"description": "Include the bundles.",
"in": "query",
"name": "with_bundles",
"type": "boolean"
},
{
"default": false,
"description": "Include the sightings.",
"in": "query",
"name": "with_sightings",
"type": "boolean"
}
],
"responses": {
"200": {
"description": "Success"
}
},
"summary": "Get a vulnerability with its id",
"tags": [
"vulnerability"
]
},
"parameters": [
{
"in": "path",
"name": "vulnerability_id",
"required": true,
"type": "string"
}
]
}
},
"produces": [
"application/json"
],
"responses": {
"MaskError": {
"description": "When any error occurs on mask"
},
"ParseError": {
"description": "When a mask can't be parsed"
}
},
"security": [
{
"apikey": []
}
],
"securityDefinitions": {
"apikey": {
"in": "header",
"name": "X-API-KEY",
"type": "apiKey"
}
},
"swagger": "2.0",
"tags": [
{
"description": "The site notice this instance shows to every visitor.",
"name": "banner"
},
{
"description": "Endpoints for retrieving various information about the system's status.",
"name": "system"
},
{
"description": "Vulnerability related operations.",
"name": "vulnerability"
},
{
"description": "Endpoints for accessing vendor and product information.",
"name": "browse"
},
{
"description": "Endpoint for retrieving various statistics.",
"name": "stats"
},
{
"description": "Comment related operations.",
"name": "comment"
},
{
"description": "User related operations.",
"name": "user"
},
{
"description": "Bundle related operations.",
"name": "bundle"
},
{
"description": "Sighting related operations.",
"name": "sighting"
},
{
"description": "CNA credentials related operations (administrators only).",
"name": "cna_credential"
},
{
"description": "EPSS related operations.",
"name": "epss"
},
{
"description": "VEX related operations.",
"name": "vex"
},
{
"description": "CWE related operations.",
"name": "cwe"
},
{
"description": "CAPEC related operations.",
"name": "capec"
},
{
"description": "Organization related operations.",
"name": "organization"
},
{
"description": "Product related operations.",
"name": "product"
},
{
"description": "EMB3D related operations.",
"name": "emb3d"
},
{
"description": "GCVE related operations.",
"name": "gcve"
},
{
"description": "AI and NLP-driven services provided via the ML-Gateway. When the operator sets VLAI_CLASSIFICATION_REQUIRE_AUTH, the two classification endpoints require a logged-in session, an X-API-KEY header, or the X-VLAI-Token a vulnerability page carries.",
"name": "vlai"
},
{
"description": "Rulezet related operations.",
"name": "rulezet"
},
{
"description": "KEV catalog operations (GCVE-BCP-07).",
"name": "kev"
},
{
"description": "API endpoint which is confrom with CNA API endpoint",
"name": "cna"
},
{
"description": "User-parameterized local exploit hazard calculations.",
"name": "exploit-hazard"
},
{
"description": "EUVD (EU Vulnerability Database) entries.",
"name": "euvd"
},
{
"description": "EUVD catalogue statistics, prepared in advance.",
"name": "euvd-stats"
},
{
"description": "Lookup of vulnerability CPEs against the CPE Editor catalog.",
"name": "cpe_editor"
}
]
}