{ "openapi": "3.0.3", "info": { "title": "ThreatPulse CVE Exploit Intelligence API", "description": "CVE exploit intelligence for security teams, CI/CD pipelines and AI agents. Each CVE comes back with CVSS, the FIRST EPSS exploit probability, CISA KEV status, exploit status and sources (Metasploit, ExploitDB, GitHub proof-of-concepts), patch links and a 0-100 urgency score (EPSS up to 40, weaponized exploit 30 or proof-of-concept 15, CISA KEV 15, no patch 15). Data: NVD hourly; CISA KEV and GitHub PoCs every 6 hours; EPSS, ExploitDB, Metasploit and vendor advisories daily. Generated from packages/threat-intel/src/handlers/api.ts and verified against the live API on Oct 12 2026.\n", "version": "2.0.0" }, "servers": [ { "url": "https://threatpulse.waltsoft.net/v1", "description": "ThreatPulse production endpoint" } ], "security": [ { "ApiKeyAuth": [] } ], "paths": { "/cve/{cve_id}": { "get": { "operationId": "getCve", "summary": "Exploit intelligence for one CVE", "description": "Returns one CVE enriched with CVSS, EPSS, CISA KEV, exploit status and sources, patches and the urgency score. The ID is case-insensitive. 404 when the CVE is not in NVD.\n", "parameters": [ { "name": "cve_id", "in": "path", "required": true, "description": "CVE identifier, CVE-YYYY-NNNN", "schema": { "type": "string", "pattern": "^[Cc][Vv][Ee]-\\d{4}-\\d{4,7}$", "example": "CVE-2021-44228" } } ], "responses": { "200": { "description": "Enriched CVE", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cve" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/feed/critical": { "get": { "operationId": "getCriticalFeed", "summary": "Recently updated CVEs at or above a severity", "description": "CVEs updated in the last `hours` hours at or above `min_severity`, most urgent first, at most 100.\n", "parameters": [ { "name": "hours", "in": "query", "required": false, "description": "Look-back window in hours, 1-168 (default 24)", "schema": { "type": "integer", "minimum": 1, "maximum": 168, "default": 24, "example": 24 } }, { "name": "min_severity", "in": "query", "required": false, "description": "LOW, MEDIUM, HIGH or CRITICAL, case-insensitive (default CRITICAL)", "schema": { "type": "string", "enum": [ "LOW", "MEDIUM", "HIGH", "CRITICAL", "low", "medium", "high", "critical" ], "default": "CRITICAL", "example": "CRITICAL" } } ], "responses": { "200": { "description": "Feed", "content": { "application/json": { "schema": { "type": "object", "properties": { "count": { "type": "integer" }, "vulnerabilities": { "type": "array", "items": { "$ref": "#/components/schemas/Cve" } } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/scan": { "post": { "operationId": "scanPackages", "summary": "Match packages or an SBOM to known CVEs", "description": "Send `packages` (names such as `openssl@3.0.1`, `vendor:product` such as `apache:log4j`, or `vendor/product`; versions are ignored) or `sbom` with `format` (package-lock, cyclonedx or spdx). Up to 1,000 entries; the first 200 unique packages are checked (`scanned` below `total_deps` means split the list). Returns up to 200 CVEs sorted by urgency.\n", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "packages": { "type": "array", "maxItems": 1000, "items": { "type": "string" } }, "sbom": { "type": "object", "description": "package-lock.json, CycloneDX or SPDX document" }, "format": { "type": "string", "enum": [ "package-lock", "cyclonedx", "spdx" ] } } }, "example": { "packages": [ "openssl@3.0.1", "apache:log4j" ] } } } }, "responses": { "200": { "description": "Scan result", "content": { "application/json": { "schema": { "type": "object", "properties": { "scanned": { "type": "integer", "description": "Unique packages checked (at most 200)" }, "total_deps": { "type": "integer", "description": "Packages received" }, "vulnerabilities": { "type": "array", "items": { "$ref": "#/components/schemas/Cve" } } } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/prioritize": { "post": { "operationId": "prioritizeCves", "summary": "Rank CVEs by urgency for your stack", "description": "Up to 100 CVE IDs (case-insensitive, duplicates merged), sorted by urgency. CVEs whose affected products contain a `stack` term get +10 (capped at 100). Unknown IDs are left out.\n", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "cves" ], "properties": { "cves": { "type": "array", "minItems": 1, "maxItems": 100, "items": { "type": "string" } }, "stack": { "type": "array", "items": { "type": "string" }, "description": "Product names in your stack, e.g. apache, linux" } } }, "example": { "cves": [ "CVE-2021-44228", "CVE-2014-0160" ], "stack": [ "apache" ] } } } }, "responses": { "200": { "description": "Ranked CVEs", "content": { "application/json": { "schema": { "type": "object", "properties": { "prioritized": { "type": "array", "items": { "$ref": "#/components/schemas/Cve" } } } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/ServerError" } } } } }, "components": { "securitySchemes": { "ApiKeyAuth": { "type": "apiKey", "in": "header", "name": "X-API-Key", "description": "Your AWS Marketplace API key (starts with mp_). Authorization Bearer is also accepted." } }, "schemas": { "Cve": { "type": "object", "description": "Every field is always present; null or [] when a source has no data.", "properties": { "cve_id": { "type": "string", "example": "CVE-2021-44228" }, "severity": { "type": "string", "enum": [ "LOW", "MEDIUM", "HIGH", "CRITICAL" ], "nullable": true }, "cvss": { "type": "number", "nullable": true }, "cvss_version": { "type": "string", "nullable": true, "description": "3.1, 4.0, 3.0 or 2.0" }, "epss_score": { "type": "number", "nullable": true, "description": "FIRST EPSS probability 0-1" }, "epss_date": { "type": "string", "nullable": true }, "exploit_status": { "type": "string", "enum": [ "none", "poc", "weaponized" ] }, "exploit_sources": { "type": "array", "items": { "type": "string" } }, "in_cisa_kev": { "type": "boolean" }, "first_exploited_date": { "type": "string", "nullable": true, "description": "Date added to CISA KEV" }, "ransomware_campaign": { "type": "string", "nullable": true, "description": "CISA KEV known ransomware use" }, "urgency_score": { "type": "integer", "minimum": 0, "maximum": 100 }, "patch_available": { "type": "boolean" }, "patch_urls": { "type": "array", "items": { "type": "string" } }, "vendor_patches": { "type": "array", "items": { "type": "object", "description": "vendor, url and optional fixed_version" } }, "affected_products": { "type": "array", "items": { "type": "string" }, "description": "First CPE strings" }, "affected_products_total": { "type": "integer" }, "remediation": { "type": "string", "nullable": true }, "first_seen": { "type": "string", "nullable": true }, "last_updated": { "type": "string", "nullable": true } } }, "Error": { "type": "object", "properties": { "error": { "type": "string" } } } }, "responses": { "BadRequest": { "description": "Invalid CVE ID or request body", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "NotFound": { "description": "CVE not in NVD, or unknown path", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "ServerError": { "description": "Server error (not billed); retry", "content": { "application/json": { "schema": { "type": "object" } } } }, "Unauthorized": { "description": "Missing, invalid or inactive API key", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "object", "properties": { "code": { "type": "integer", "example": 401 }, "message": { "type": "string", "example": "Invalid or inactive API key" } } } } } } } } } } }