# ThreatPulse — Full API Documentation

> CVE exploit intelligence: CVSS, FIRST EPSS, CISA KEV, Metasploit / ExploitDB / GitHub exploits, patches and a 0-100 urgency score; dependency and SBOM scanning
> Price: $0.01/query | Auth: AWS Marketplace key, x402 (Solana + Base) or prepaid card key

## Endpoints (base https://threatpulse.waltsoft.net/v1)

### GET /cve/{cve_id}
One CVE, e.g. /cve/CVE-2021-44228 (case-insensitive). 404 if the CVE is not in NVD.

### GET /feed/critical?hours=24&min_severity=CRITICAL
CVEs updated in the last 1-168 hours at or above LOW, MEDIUM, HIGH or CRITICAL, most urgent first, up to 100. Returns {count, vulnerabilities}.

### POST /scan
Body {"packages": ["openssl@3.0.1", "apache:log4j", "lodash"]} or {"sbom": {...}, "format": "package-lock" | "cyclonedx" | "spdx"}. Up to 1,000 entries; the first 200 unique packages are checked. Returns {scanned, total_deps, vulnerabilities} sorted by urgency (up to 200 CVEs).

### POST /prioritize
Body {"cves": [...up to 100 IDs], "stack": ["apache", "linux"]}. CVEs whose affected products match a stack term get +10 urgency. Returns {prioritized}; unknown CVE IDs are left out.

### Free routes
/health, /llms.txt, /openapi.json, /.well-known/agent-card.json, /sitemap.xml, /badge/{cve_id} (SVG)

## Fields (every CVE object)
cve_id, severity, cvss, cvss_version, epss_score, epss_date, exploit_status (none|poc|weaponized), exploit_sources, in_cisa_kev, first_exploited_date, ransomware_campaign, urgency_score, patch_available, patch_urls, vendor_patches, affected_products (first CPEs), affected_products_total, remediation, first_seen, last_updated. Missing data is null or [].

## Data sources and refresh
NVD hourly; CISA KEV and GitHub proof-of-concept repositories every 6 hours; FIRST EPSS, ExploitDB, Metasploit and vendor advisories daily.

## Authentication

### AWS Marketplace key
Subscribe on AWS Marketplace; your key (mp_...) is stored in your AWS Secrets Manager. Send it as X-API-Key (or Authorization: Bearer). A wrong or inactive key answers 401. Only 2xx answers are billed.

### MCP and A2A
- MCP endpoint: https://waltsoft-marketplace-gateway-xncyjgs1uh.gateway.bedrock-agentcore.us-east-1.amazonaws.com/mcp (tool threatpulse___threatpulseQuery: api_key plus cve_id, or packages)
- A2A agent card: https://threatpulse.waltsoft.net/.well-known/agent-card.json (JSON-RPC message/send, api_key in params)

### x402 (no account)
1. Make request without payment
2. Parse 402 response PAYMENT-REQUIRED header (base64 JSON)
3. Sign payment authorization (EIP-3009 on Base, SPL transfer on Solana)
4. Retry with PAYMENT-SIGNATURE header

### Prepaid card key
POST https://threatpulse.waltsoft.net/checkout {"tier":"starter|pro|enterprise"}; use Authorization: Bearer tp_live_YOUR_KEY

## Payment Details
- Asset: USDC (6 decimals)
- Amount: 10000 atomic = $0.01
- Solana payTo: GsKr5q9TmiJQcEgUpBp2X6SmvSg3dnXuw2uxYJxgPTk8
- Base payTo: 0x318A4B4764eb37c3FCBcE434713128143815FD57
- Solana feePayer: resolved dynamically from CDP /platform/v2/x402/supported (rotates; do not hardcode)

## Provider
Waltsoft · https://waltsoft.net · 16 APIs for AI agents, all on AWS Marketplace