API documentation

A JSON API over the ResilientX Security - CVE Navigator data: CVE records with CVSS, EPSS exploit prediction, CISA KEV status, CPE matching, vendor/product browsing, bulk prioritization, identifier resolution, and EU (EUVD) cross-references. Almost every endpoint is an HTTPS GET returning JSON (Prioritize is a POST). Base URL: https://community.resilientx.com.

Authentication & rate limits

The public API is free and needs no key. Every data endpoint — /api/v1/*, /enrich, and the legacy /cve/details and /api/cvefor — shares one budget of 30 requests per minute per IP; only /health and /status are exempt. For higher limits we issue an API key, sent as Authorization: Bearer YOUR_KEY or X-API-Key: YOUR_KEY, which bypasses the limit. Request one at [email protected].

Endpoints

• GET /api/v1/cves?q=&severity=&kev=&eu_exploited=&epss_min=&page=&page_size= — search and filter CVEs
• GET /api/v1/cves/{id} — full CVE detail (CVSS, CWE, references, affected CPEs, EPSS, KEV, EUVD)
• GET /api/v1/cpe?cpe={cpe2.3} — CVEs affecting a CPE, with full version-range matching
• GET /api/v1/vendors?q=&page=&page_size= — vendor directory with product and CVE counts
• GET /api/v1/vendors/{vendor} — products known for a vendor
• GET /api/v1/vendors/{vendor}/{product} — CVEs affecting a vendor/product pair
• POST /api/v1/prioritize — rank a posted list of CVE ids by EPSS, KEV and EU-exploited
• GET /api/v1/exploited?source=all|kev|eu&page=&page_size= — browse actively-exploited CVEs (CISA KEV + EU)
• GET /api/v1/resolve/{id} — resolve a CVE / EUVD / GHSA / GSD id to the canonical CVE(s) and aliases
• GET /api/v1/euvd/{euvdId} — resolve an ENISA EUVD id to its cross-referenced CVE(s)
• GET /api/v1/packages/{ecosystem}/{name}?version={v} — CVEs affecting an OSV/GHSA package, with an optional version-in-range filter
• GET /api/v1/osv/{id} — resolve a GHSA/PYSEC/GO advisory id to its CVE(s)
• GET /api/v1/suggest?q=&limit= — search autocomplete
• GET /api/v1/stats — corpus counts, recent activity, and data freshness
• GET /api/v1/openapi.json — machine-readable OpenAPI 3.1 specification
• GET /api/v1/docs — interactive API reference (Scalar)
• GET /enrich/{id} — additive EPSS + CISA KEV + EU (EUVD) signal
• GET /status — service health and data freshness

Compatibility endpoints (legacy)

• GET /cve/details/{id}/json — legacy MITRE 4.0 record ({} on miss)
• GET /api/cvefor/{cpe} — cve-search document array ([] on miss)

Frequently asked questions

Is the API free, and do I need a key?

The public API is free and needs no key. Every data endpoint shares one budget of 30 requests per minute per IP; an API key bypasses that limit. Request one at [email protected].

What format does the API return?

JSON over HTTPS. Almost every endpoint is a GET (bulk Prioritize is a POST). A machine-readable OpenAPI 3.1 specification is available at /api/v1/openapi.json.

How do I look up a single CVE?

GET /api/v1/cves/{id} returns the full record — CVSS, CWE, references, affected CPEs, EPSS, CISA KEV, and EUVD cross-references.

How do I find CVEs affecting a product?

Use GET /api/v1/cpe?cpe={cpe2.3} for a CPE match, or GET /api/v1/vendors/{vendor}/{product} to browse a vendor/product pair.

Higher limits and commercial use: [email protected].