{"openapi":"3.1.0","info":{"title":"cve.now API","version":"1.0.0","description":"The REST twin of every cve.now MCP tool: the same inputs and the same JSON. No key needed; a cve.now API key (Authorization: Bearer cvn_...) gives a per-key rate limit instead of the shared per-IP one. A CVE is critical when it is on CISA's Known Exploited Vulnerabilities (KEV) list; its CVSS score is 9.0 or higher and it affects a technology cve.now tracks; or its EPSS exploitation probability has reached 10% and its CVSS score is 7.0 or higher. An early warning is critical when its assessed severity is critical.","contact":{"url":"https://cve.now/agents"}},"servers":[{"url":"https://cve.now"}],"paths":{"/api/v1/entries/{id}":{"get":{"operationId":"get_vulnerability","summary":"Get vulnerability by CVE, GHSA or OSV id","description":"Get one entry by CVE, GHSA or OSV id, or one early warning by its SZB id, as JSON. Includes CISA SSVC decision points (exploitation, automatable, technicalImpact) when CISA published them, and, when cve.now has read the vendor advisory, context (a plain sentence, sourced conditions, vendor severity, fix with fixed versions or the patch ids the vendor names, FAQ) with exposure: Actively exploited, Default setups, Specific setups only or Unclear. fixedIn lists the fixed versions cve.now leads with: the vendor's own, without distro package builds or another product's versions. fixedInByProduct lists each affected product's fixed versions (product, versions), the entry's own product first, then products that ship the bug, such as Node.js on a Brotli CVE. fixStatus, when cve.now has registry data for an affected npm, PyPI, Go, Maven, crates.io or NuGet package, gives per package: status (fixed or none, meaning no fix is released), the fixed versions with their release dates and days from disclosure (negative when the fix shipped before the advisory), and the latest release with whether it is still affected. downloadExposure, for affected npm, PyPI and crates.io packages, gives per package the share of its downloads that were affected versions: ecosystem, package, window (last-week on npm and PyPI, 90d on crates.io), affectedShare (0 to 1), affectedDownloads, totalDownloads and asOf (when the counts were read). Counts are registry downloads, not users or installs: CI runs and mirrors inflate them. An early warning (SZB id) returns kind (breach, vulnerability, malicious-package, ransomware or outage), confidence (confirmed, corroborated or unverified), severity, actions, the reports behind it, and coveredBy: the CVE that later covered it and how many hours earlier cve.now reported the incident (null when none yet). Every entry returns kind (vulnerability for a catalog entry; the early warning's kind otherwise) and critical: { value, reasons }, where reasons names each test it passes (kev, cvss-in-technology, epss, publisher, warning-severity). A CVE is critical when it is on CISA's Known Exploited Vulnerabilities (KEV) list; its CVSS score is 9.0 or higher and it affects a technology cve.now tracks; or its EPSS exploitation probability has reached 10% and its CVSS score is 7.0 or higher. An early warning is critical when its assessed severity is critical. Each of references carries a role saying what that source establishes: vendor (affected and fixed versions), record (the identifier and description), kev (exploitation in the wild, for this CVE only), exploit (public exploit code exists), write-up (technical detail and context) or other. A vulnerability also names what its affected products are: vendors ({ slug, name }), products ({ slug, vendor, name }), packages ({ ecosystem, name }) and tech ({ slug, rule }, the slug as in list_feed's tech filter). agentPrompt is a read-only prompt for checking your own systems for this entry (null when the entry lists no affected products or fix). attention says whether it needs attention now (status attention, with the reason naming the triggers) or is a reference record, with lastChecked, the last time cve.now re-read it.","responses":{"200":{"description":"OK: the same JSON as the MCP tool's result","content":{"application/json":{"schema":{"type":"object","description":"One entry: a vulnerability, or an early warning (a breach, ransomware attack, malicious package, vulnerability reported before or without a CVE, or security outage)","properties":{"type":{"type":"string","description":"The entity type: cve for a catalog entry, early-warning for an early warning, breach for a breach or ransomware attack","enum":["cve","early-warning","breach"]},"id":{"type":"string","description":"The entry id: a CVE, GHSA or OSV id for a vulnerability, SZB- and 10 hex characters for an early warning","examples":["CVE-2021-44228","GHSA-jfh8-c2jp-5v3q","SZB-0a1b2c3d4e"]},"kind":{"type":"string","description":"What the entry is: vulnerability (every catalog entry, and an early warning about a vulnerability reported before or without a CVE), breach, ransomware, malicious-package or outage. A copy written before kind existed omits it: read that as vulnerability","enum":["breach","vulnerability","malicious-package","ransomware","outage"],"default":"vulnerability"},"confidence":{"type":"string","description":"An early warning's confidence: confirmed, corroborated or unverified. Absent on a vulnerability","enum":["confirmed","corroborated","unverified"]},"title":{"type":"string","description":"The one title every surface shows: a vulnerability's product and what is wrong with it (\"Kyverno privilege escalation via apiCall namespace clamp bypass\"), or the CNA's own title as one plain line when no copy is written. Never cut mid-word"},"sourceTitle":{"type":"string","description":"A vulnerability's title as the CVE record or advisory gives it. Absent on an early warning"},"titleTags":{"type":"array","description":"What tells apart entries that share a title, each { kind: weakness or subsystem, value }. Absent on an early warning","items":{"type":"object","description":"A tag","additionalProperties":true}},"titleRule":{"type":"string","description":"The headline rule version and steps the title was derived by (v<version>:<steps>). Absent on an early warning"},"summary":{"type":["object","string","null"],"description":"A vulnerability's plain-language summary as { text, model, promptVersion, generatedAt? }, or null when none is written; an early warning's summary is a string","properties":{"text":{"type":"string","description":"The summary text"},"model":{"type":"string","description":"The model that wrote it"},"promptVersion":{"type":"string","description":"The prompt version it was written with"},"generatedAt":{"type":"string","description":"When it was written (ISO 8601)"}},"additionalProperties":true},"originalDescription":{"type":"string","description":"A vulnerability's description as the CVE record or advisory words it"},"feedId":{"type":"string","description":"The first id ever assigned to the entry, which its feed items use as their guid"},"aliases":{"type":"array","description":"Other ids for the same vulnerability (CVE, GHSA, OSV)","items":{"type":"string","description":"A string"}},"status":{"type":"string","description":"A vulnerability's state in the catalog","enum":["provisional","published","superseded","rejected"]},"supersededBy":{"type":"array","description":"Ids of the entries that replace this one when its status is superseded","items":{"type":"string","description":"A string"}},"critical":{"type":"object","description":"Whether the entry is critical under the critical rule, and why","properties":{"value":{"type":"boolean","description":"true when the entry is critical"},"reasons":{"type":"array","description":"Each test it passes, e.g. kev, cvss-in-technology, epss","items":{"type":"string","description":"A string"}}},"additionalProperties":true},"severity":{"type":["object","string","null"],"description":"A vulnerability's score as { cvss, vector, source } (null when unscored); an early warning's severity as critical, high, medium or low","properties":{"cvss":{"type":"number","description":"The CVSS base score, 0 to 10"},"vector":{"type":"string","description":"The CVSS vector string"},"source":{"type":"string","description":"Who scored it: cna, cisa-adp, adp, nvd, ghsa or euvd"}},"additionalProperties":true},"scores":{"type":"array","description":"Every provider's CVSS score read for the entry, as { cvss, vector, source }; the headline `severity` is one of them. NVD's own score is listed here when NVD rates the CVE in another band than the headline does. Absent when only the headline is known","items":{"type":"object","description":"One provider's score","properties":{"cvss":{"type":"number","description":"The CVSS base score, 0 to 10"},"vector":{"type":"string","description":"The CVSS vector string"},"source":{"type":"string","description":"Who scored it: cna, cisa-adp, adp, nvd, ghsa or euvd"}},"additionalProperties":true}},"statedSeverity":{"type":["object","null"],"description":"The severity the advisory states in words, { value (low, medium, high or critical), source }","additionalProperties":true},"exploitation":{"type":"object","description":"Exploitation evidence: KEV listing, EPSS threshold, public exploit code","properties":{"kev":{"type":["object","null"],"description":"CISA KEV listing as { dateAdded, dueDate, requiredAction? } (requiredAction: CISA's instruction, when stored); null when not listed","additionalProperties":true},"epssReached":{"type":["object","null"],"description":"When EPSS reached 10% as { date, observed? }; null when it has not","additionalProperties":true},"exploitDb":{"type":["object","null"],"description":"Exploit-DB exploits as { ids, publishedAt }","additionalProperties":true},"metasploit":{"type":["object","null"],"description":"Metasploit modules as { modules }","additionalProperties":true},"nuclei":{"type":["object","null"],"description":"Nuclei detection templates as { templates }","additionalProperties":true},"githubPoc":{"type":["object","null"],"description":"GitHub proof-of-concept repositories as { repos, exploits? }","additionalProperties":true}},"additionalProperties":true},"ssvc":{"type":["object","null"],"description":"CISA SSVC decision points: exploitation (none, poc or active), automatable (yes or no), technicalImpact (partial or total), timestamp, version; null when CISA published none","properties":{"exploitation":{"type":["string","null"],"description":"none, poc or active"},"automatable":{"type":["string","null"],"description":"yes or no"},"technicalImpact":{"type":["string","null"],"description":"partial or total"},"timestamp":{"type":["string","null"],"description":"When CISA assessed it (ISO 8601)"},"version":{"type":["string","null"],"description":"The SSVC version"},"source":{"type":"string","description":"Always CISA-ADP"}},"additionalProperties":true},"context":{"type":["object","null"],"description":"Plain-English context read from the vendor advisory: a sentence, attacker conditions, vendor severity, fix (fixed versions, and patches: the patch, hotfix or update ids the advisory names), FAQ; null or absent when not read","additionalProperties":true},"cwe":{"type":"array","description":"CWE ids, e.g. CWE-79","items":{"type":"string","description":"A string"}},"affected":{"type":"array","description":"The affected products and packages with their version ranges","items":{"type":"object","description":"One affected product or package","properties":{"ecosystem":{"type":"string","description":"The package ecosystem in OSV's spelling, e.g. npm, PyPI, Go, Maven, crates.io"},"package":{"type":"string","description":"The package name"},"vendor":{"type":"string","description":"The vendor the record names"},"product":{"type":"string","description":"The product the record names"},"ranges":{"type":"array","description":"Affected version ranges","items":{"type":"object","description":"One affected range of versions","properties":{"introduced":{"type":"string","description":"The first affected version"},"fixed":{"type":"string","description":"The first version that is not affected"},"lastAffected":{"type":"string","description":"The last affected version"},"limit":{"type":"string","description":"An exclusive upper bound"}},"additionalProperties":true}},"versions":{"type":"array","description":"Affected versions the source lists one by one","items":{"type":"string","description":"A string"}}},"additionalProperties":true}},"related":{"type":"array","description":"Ids of related entries","items":{"type":"string","description":"A string"}},"bundles":{"type":"array","description":"Ids of the bundles the entry belongs to","items":{"type":"string","description":"A string"}},"copy":{"type":["object","null"],"description":"The wording cve.now wrote for the entry; null when a write gave nothing usable","additionalProperties":true},"earlyWarning":{"type":"array","description":"Early warnings cve.now published about this vulnerability","items":{"type":"object","description":"An early warning about this vulnerability","properties":{"id":{"type":"string","description":"The early warning's SZB id"},"firstSeenAt":{"type":"string","description":"When cve.now first saw it (ISO 8601)"}},"additionalProperties":true}},"references":{"type":"array","description":"Links to advisories, fixes, reports and exploits","items":{"type":"object","description":"One reference","properties":{"url":{"type":"string","description":"The reference URL"},"type":{"type":"string","description":"advisory, fix, report, exploit or other"},"role":{"type":"string","description":"What the source establishes, when cve.now has classified it"}},"additionalProperties":true}},"sources":{"type":"array","description":"Where the entry's data comes from","items":{"type":"object","description":"One source cve.now read the entry from","properties":{"name":{"type":"string","description":"The source's name"},"url":{"type":"string","description":"Its URL"},"firstSeenAt":{"type":"string","description":"When cve.now first read it (ISO 8601)"},"license":{"type":"string","description":"The source's license"}},"additionalProperties":true}},"firstSeenAt":{"type":"string","description":"When cve.now first saw the entry (ISO 8601)"},"publishedAt":{"type":["string","null"],"description":"When the vulnerability was published (ISO 8601); null when unknown"},"modifiedAt":{"type":"string","description":"When the entry last changed (ISO 8601)"},"checkedAt":{"type":"string","description":"When cve.now last re-read the entry (ISO 8601)"},"attention":{"type":"object","description":"Whether the entry needs attention now, and why","properties":{"status":{"type":"string","description":"attention or reference","enum":["attention","reference"]},"label":{"type":"string","description":"Needs attention or Reference"},"reason":{"type":"string","description":"Why it needs attention, or why it is a reference record"},"until":{"type":["string","null"],"description":"When it goes back to Reference if nothing new happens; null for a reference record"},"lastChecked":{"type":["string","null"],"description":"The last time cve.now re-read the entry (ISO 8601)"},"rules":{"type":"integer","description":"The version of the attention rules"}},"additionalProperties":true},"vendors":{"type":"array","description":"The vendors the affected products name","items":{"type":"object","description":"A vendor","properties":{"slug":{"type":"string","description":"The vendor's slug; its page is /vendors/<slug> when it has one (25 or more entries, or 3 or more on CISA's Known Exploited Vulnerabilities list)"},"name":{"type":"string","description":"The vendor's name"}},"additionalProperties":true}},"products":{"type":"array","description":"The affected products","items":{"type":"object","description":"A product","properties":{"slug":{"type":"string","description":"The product's slug"},"vendor":{"type":"string","description":"The vendor's slug (empty when the record names none)"},"name":{"type":"string","description":"The product's name"}},"additionalProperties":true}},"packages":{"type":"array","description":"The registry packages the entry affects","items":{"type":"object","description":"A registry package","properties":{"ecosystem":{"type":"string","description":"The package's ecosystem"},"name":{"type":"string","description":"The package's name"}},"additionalProperties":true}},"tech":{"type":"array","description":"The curated technologies the entry belongs to","items":{"type":"object","description":"A curated technology","properties":{"slug":{"type":"string","description":"The technology's slug, as in /feed?tech=<slug>"},"rule":{"type":"string","description":"What the affected product matched on: package, product, vendor-product or vendor"}},"additionalProperties":true}},"exposure":{"type":["string","null"],"description":"How exposed default setups are: Actively exploited, Default setups, Specific setups only or Unclear; null when cve.now has not read the vendor advisory","enum":["Actively exploited","Default setups","Specific setups only","Unclear",null]},"fixedIn":{"type":"array","description":"The fixed versions cve.now leads with: the vendor's own, without distro package builds","items":{"type":"string","description":"A string"}},"fixedInByProduct":{"type":"array","description":"Fixed versions per affected product, the entry's own product first","items":{"type":"object","description":"Fixed versions of one product","properties":{"product":{"type":"string","description":"The product"},"versions":{"type":"array","description":"Its fixed versions","items":{"type":"string","description":"A string"}}},"additionalProperties":true}},"agentPrompt":{"type":["string","null"],"description":"A prompt an agent can follow to check and fix its own systems for this vulnerability; null when there is nothing to act on"},"fixStatus":{"type":"object","description":"Whether a fix is released for each registry package; absent without registry data","properties":{"packages":{"type":"array","description":"One per registry package, the advisory's own first","items":{"type":"object","description":"Whether a fix is released for one registry package","properties":{"ecosystem":{"type":"string","description":"The package's ecosystem"},"package":{"type":"string","description":"The package name"},"status":{"type":"string","description":"fixed: a fixed version or a newer unaffected release exists; none: no fix is released","enum":["fixed","none"]},"source":{"type":["string","null"],"description":"Where fixed came from: the advisory's ranges, or the first release after them","enum":["ranges","release",null]},"fixed":{"type":"array","description":"Fixed versions, lowest first; empty when status is none","items":{"type":"object","description":"One release that fixes the advisory","properties":{"version":{"type":"string","description":"The fixed version"},"publishedAt":{"type":["string","null"],"description":"When the registry published it (ISO 8601); null when it lists no date"},"daysFromDisclosure":{"type":["integer","null"],"description":"Whole days from disclosure to this release; negative when the fix shipped first"},"named":{"type":"string","description":"The fixed version the advisory names, when that release was never published and this is the first stable one after it"}},"additionalProperties":true}},"unreleased":{"type":"array","description":"Fixed versions the advisory names that the registry has not published","items":{"type":"string","description":"A string"}},"latest":{"type":["object","null"],"description":"The latest release and whether it is inside an affected range; null when the registry marks none","properties":{"version":{"type":"string","description":"The latest release"},"publishedAt":{"type":["string","null"],"description":"When it was published (ISO 8601)"},"affected":{"type":"boolean","description":"true when it is inside an affected range"}},"additionalProperties":true},"asOf":{"type":"string","description":"When the registry data was read (ISO 8601)"}},"additionalProperties":true}},"noFix":{"type":"boolean","description":"true when some package has no fix released"}},"additionalProperties":true},"downloadExposure":{"type":"array","description":"Per npm, PyPI or crates.io package: the share of downloads that were affected versions; absent without download data","items":{"type":"object","description":"The share of one package's downloads that were affected versions","properties":{"ecosystem":{"type":"string","description":"The package's ecosystem (npm, PyPI or crates.io)"},"package":{"type":"string","description":"The package name"},"window":{"type":"string","description":"The download window: last-week on npm, 90d on crates.io"},"affectedShare":{"type":"number","description":"Affected downloads divided by total downloads, 0 to 1"},"affectedDownloads":{"type":"number","description":"Downloads of affected versions in the window"},"totalDownloads":{"type":"number","description":"All downloads in the window"},"asOf":{"type":"string","description":"When the counts were read (ISO 8601)"}},"additionalProperties":true}},"vendor":{"type":"string","description":"An early warning's vendor or organization"},"product":{"type":["object","string","null"],"description":"A vulnerability's product record (names for its product), or an early warning's product name; null when none","additionalProperties":true},"actions":{"type":"array","description":"An early warning's recommended actions","items":{"type":"string","description":"A string"}},"cveIds":{"type":"array","description":"CVE ids an early warning concerns","items":{"type":"string","description":"A string"}},"coveredBy":{"type":["object","null"],"description":"An early warning's first published CVE: { id, publishedAt, leadTimeHours }, leadTimeHours being whole hours from cve.now's first sighting to the CVE's publication (null when the CVE came first); null when none yet","additionalProperties":true},"reports":{"type":"array","description":"The reports behind an early warning","items":{"type":"object","description":"One report behind an early warning","properties":{"url":{"type":"string","description":"The report's URL"},"source":{"type":"string","description":"The publisher"},"tier":{"type":"string","description":"How much the source is trusted"},"title":{"type":"string","description":"The report's title"},"publishedAt":{"type":"string","description":"When it was published (ISO 8601)"}},"additionalProperties":true}},"confirmedAt":{"type":["string","null"],"description":"When an early warning was confirmed (ISO 8601); null until then"},"updatedAt":{"type":"string","description":"When an early warning last changed (ISO 8601)"},"url":{"type":"string","description":"The entry's page on cve.now"}},"required":["id"],"additionalProperties":true}}}},"400":{"description":"Bad input: { error }"},"404":{"description":"Not found: { error }"},"429":{"description":"Rate limited: { error }, with Retry-After"},"503":{"description":"Temporarily unavailable: { error }, with Retry-After"}},"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}]}},"/api/v1/entries":{"get":{"operationId":"list_feed","summary":"Read vulnerability feed","description":"List the newest items of a cve.now vulnerability feed, newest first: what is new, critical or exploited right now (to find entries by words or fields, use search). Pass name for one stored feed (critical, all, kev, tech/<slug>, ecosystem/<eco>; critical when nothing is passed), or, instead of name, any of filter, tech and ecosystem to build one. Each of those takes one value or a list: an item must match any listed value of a field, and every field passed. Up to 16 combinations of values. vendor (a slug from cve.now/vendors.md, e.g. microsoft) lists that vendor's newest entries and takes no other field; filter may also be epss (entries whose EPSS score has reached the threshold). vendor and epss are refused while cve.now's vendor pages are off. The critical feed follows the critical rule: A CVE is critical when it is on CISA's Known Exploited Vulnerabilities (KEV) list; its CVSS score is 9.0 or higher and it affects a technology cve.now tracks; or its EPSS exploitation probability has reached 10% and its CVSS score is 7.0 or higher. An early warning is critical when its assessed severity is critical. fix: [\"none\"] lists only entries cve.now ranks whose affected package has no fix released (refused while cve.now's registry data is off).\n\nSend at least one of name, tech, ecosystem, vendor or fix (name=critical is the default feed): without them, or with only filter and limit, GET /api/v1/entries lists the whole catalog instead, as { entries, next_cursor }.","responses":{"200":{"description":"OK: list_feed's JSON when a selector is sent, else the catalog page","content":{"application/json":{"schema":{"anyOf":[{"type":"object","description":"The newest items of a feed","properties":{"name":{"type":"string","description":"The feed's name, e.g. critical, kev, tech/<slug>, ecosystem/<eco>"},"title":{"type":"string","description":"The feed's title"},"updatedAt":{"type":"string","description":"When the feed last changed (ISO 8601)"},"items":{"type":"array","description":"Feed items, newest first, at most limit","items":{"type":"object","description":"One item of a feed","properties":{"id":{"type":"string","description":"The entry id the item links to"},"feedId":{"type":"string","description":"The item's stable guid"},"title":{"type":"string","description":"The entry's title"},"summary":{"type":"string","description":"A plain-language description of the entry"},"updatedAt":{"type":"string","description":"When the item last changed materially (ISO 8601)"},"kind":{"type":"string","description":"new: the entry is new in the feed; update: it changed","enum":["new","update"]},"updateNote":{"type":"string","description":"What changed, e.g. Update: added to CISA KEV; only on updates"},"url":{"type":"string","description":"Where the item links when it is not the entry's cve.now page"}},"additionalProperties":true}}},"additionalProperties":true},{"type":"object","description":"One page of every published entry, newest first (no name, tech, ecosystem, vendor or fix sent; limit, 1 to 200, default 30, sets the page size)","properties":{"entries":{"description":"Entries, newest first"},"next_cursor":{"description":"Pass back as cursor for the next page"}},"additionalProperties":true}]}}}},"400":{"description":"Bad input: { error }"},"404":{"description":"Not found: { error }"},"429":{"description":"Rate limited: { error }, with Retry-After"},"503":{"description":"Temporarily unavailable: { error }, with Retry-After"}},"parameters":[{"name":"name","in":"query","required":false,"schema":{"type":"string","description":"One stored feed to read: critical (the default), all, kev, tech/<slug> or ecosystem/<ecosystem>. Not combinable with filter, tech, ecosystem, vendor or fix","examples":["critical","kev","tech/nextjs","ecosystem/npm"]}},{"name":"filter","in":"query","required":false,"schema":{"type":"array","items":{"type":"string","enum":["critical","kev","epss"]},"description":"Narrow to critical entries, entries on CISA's Known Exploited Vulnerabilities list (kev) and/or entries whose EPSS score has reached the threshold (epss; refused while cve.now's vendor pages are off). An item matches any listed value","examples":[["critical"],["kev","critical"]]}},{"name":"tech","in":"query","required":false,"schema":{"type":"array","items":{"type":"string"},"description":"Technology slugs, as in cve.now/feed?tech=<slug>; an item matches any listed one","examples":[["nextjs","react"]]}},{"name":"ecosystem","in":"query","required":false,"schema":{"type":"array","items":{"type":"string"},"description":"Package ecosystems; an item matches any listed one","examples":[["npm"],["npm","pypi"]]}},{"name":"vendor","in":"query","required":false,"schema":{"type":"string","description":"One vendor's slug, e.g. microsoft (see /vendors.md); not combinable with filter, tech, ecosystem or fix"}},{"name":"fix","in":"query","required":false,"schema":{"type":"array","items":{"type":"string","enum":["none"]},"description":"none: only entries whose affected package has no fix released"}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":200,"default":20,"description":"How many items to return, newest first"}}]}},"/api/v1/check":{"post":{"operationId":"check_stack","summary":"Check dependencies","description":"Check exact package versions against cve.now's synced vulnerability catalog. Pass a lockfile, a package list, or the stack_id of a lockfile uploaded to cve.now. For a large lockfile, upload it instead of passing its contents: curl --data-binary @<file> -H 'X-Lockfile-Name: <file name>' https://cve.now/api/v1/stacks returns its id. A flake.lock is checked by the git commit each input pins, through OSV, and its nixpkgs package CVEs are not checked. No matches means none found, not a guarantee of safety.","responses":{"200":{"description":"OK: the same JSON as the MCP tool's result","content":{"application/json":{"schema":{"type":"object","description":"Known vulnerabilities in the packages checked","properties":{"coverage":{"type":"string","description":"What the check covers"},"checked":{"type":"integer","description":"Number of packages checked"},"notes":{"type":"array","description":"Gaps in the check, when there are any","items":{"type":"string","description":"A string"}},"affected":{"type":"array","description":"Every affected package version, with the entry and its fixes; empty when none were found","items":{"type":"object","description":"One affected package version and the entry that hits it","properties":{"id":{"type":"string","description":"The entry id"},"title":{"type":"string","description":"The entry's title"},"severity":{"type":["object","null"],"description":"The entry's score as { cvss, vector, source }; null when unscored","additionalProperties":true},"url":{"type":"string","description":"The advisory's URL, else the entry's page on cve.now"},"package":{"type":"object","description":"The installed package that is affected","properties":{"ecosystem":{"type":"string","description":"The package ecosystem, normalized (npm, pypi, go, crates.io...)"},"name":{"type":"string","description":"The package name"},"version":{"type":"string","description":"The installed version"}},"additionalProperties":true},"rating":{"type":"string","description":"The entry's severity as critical, high, medium, low or unrated"},"kev":{"type":"boolean","description":"true when it is on CISA's Known Exploited Vulnerabilities list"},"activelyExploited":{"type":"boolean","description":"true when it is in KEV or CISA's SSVC says exploitation is active"},"publicExploit":{"type":"boolean","description":"true when public exploit code exists (Metasploit, Exploit-DB or a GitHub proof of concept)"},"epssReached":{"type":"boolean","description":"true when its EPSS score has reached 10%"},"exposure":{"type":["string","null"],"description":"Actively exploited, Default setups, Specific setups only or Unclear; null when cve.now has not read the vendor advisory"},"fixed":{"type":"array","description":"Versions that fix it, as upgrades from the installed version: the installed line's fix first, then later ones; empty when none is known","items":{"type":"string","description":"A string"}}},"additionalProperties":true}}},"additionalProperties":true}}}},"400":{"description":"Bad input: { error }"},"404":{"description":"Not found: { error }"},"429":{"description":"Rate limited: { error }, with Retry-After"},"503":{"description":"Temporarily unavailable: { error }, with Retry-After"}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"lockfile_name":{"type":"string","description":"Optional, with lockfile_content. The file type is detected from the content; the name only breaks ties (e.g. poetry.lock vs Cargo.lock). Supported: package-lock.json, npm-shrinkwrap.json, bun.lock, pnpm-lock.yaml, yarn.lock, poetry.lock, uv.lock, requirements.txt, Cargo.lock, go.sum, Gemfile.lock, mix.lock, flake.lock, composer.lock, Pipfile.lock, packages.lock.json (NuGet), gradle.lockfile."},"lockfile_content":{"type":"string","description":"The lockfile's full text, parsed in memory and not stored. Give this, packages or stack_id, not several. For a large lockfile upload it and pass stack_id instead"},"stack_id":{"type":"string","description":"The id returned by POST https://cve.now/api/v1/stacks for an uploaded lockfile; checks that saved package list. Give this, lockfile_content or packages, not several"},"packages":{"type":"array","description":"Packages to check, each with its exact installed version, up to 10,000. Give this, lockfile_content or stack_id, not several","items":{"type":"object","properties":{"ecosystem":{"type":"string","description":"The package's ecosystem, e.g. npm, pypi, go, maven, crates.io, packagist, rubygems, hex, nuget"},"name":{"type":"string","description":"The package name as its registry spells it, e.g. lodash, django, github.com/gin-gonic/gin"},"version":{"type":"string","description":"The exact installed version, e.g. 4.17.20"}},"required":["ecosystem","name","version"],"additionalProperties":false},"examples":[[{"ecosystem":"npm","name":"lodash","version":"4.17.20"},{"ecosystem":"pypi","name":"django","version":"4.2.0"}]]}},"additionalProperties":false}}}}}},"/api/v1/feedback":{"post":{"operationId":"send_feedback","summary":"Send private feedback to the cve.now team","description":"Send a private note to the cve.now team: a wrong summary, severity or affected version, a missing vulnerability or technology, a broken feed, or a feature request. Stored for a person to read, never shown publicly, and rate limited per caller. Include the entry id or page in page when the note is about one. contact is optional and only used to reply.","responses":{"200":{"description":"OK: the same JSON as the MCP tool's result","content":{"application/json":{"schema":{"type":"object","description":"Whether the private note was stored","properties":{"ok":{"type":"boolean","description":"true when the note was stored for the cve.now team"},"message":{"type":"string","description":"A line to show the user"}},"required":["ok"],"additionalProperties":true}}}},"400":{"description":"Bad input: { error }"},"404":{"description":"Not found: { error }"},"429":{"description":"Rate limited: { error }, with Retry-After"},"503":{"description":"Temporarily unavailable: { error }, with Retry-After"}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","maxLength":4000,"description":"The note: what is wrong or missing, in plain words (up to 4,000 characters). Stored privately for the cve.now team; it is not shown publicly"},"page":{"type":"string","description":"Optional. The entry id or cve.now URL the note is about, e.g. CVE-2021-44228 or https://cve.now/CVE-2021-44228 (up to 300 characters)"},"contact":{"type":"string","description":"Optional. An email address for a reply; stored with the note and used only to reply (up to 200 characters)","examples":["you@example.com"]}},"required":["message"],"additionalProperties":false}}}}}},"/api/v1/leaderboard":{"get":{"operationId":"get_leaderboard","summary":"Get worst-CVE leaderboard (the cve.now Index)","description":"Get the cve.now Index: the worst CVEs published or escalated this week, month or year, or of all time (window all: every CVE ever in KEV or with a Metasploit module, plus the past year), ranked by a 0-100 score (exploitation 40, exposure 25, reach 20, severity 10, no patch 5; methodology at https://cve.now/rankings/methodology; the page is https://cve.now/rankings/index). Narrow with tech, ecosystem and filter (critical, kev); a row matches any listed value of a field and every field passed. Pass week (YYYY-Www) instead, without tech, ecosystem or filter, for an archived week's top 25. Week rows carry movement since the previous week. view picks the board: exploited (default, the Index), worst-case (ranked by a 0-100 worst case score from severity, reach, exposure and exploit maturity, with no CISA confirmation needed; rows add worstCase) or trending (window week or month only; ranked by new PoC repos, new references and EPSS rise, with the Index unchanged; rows add trend).","responses":{"200":{"description":"OK: the same JSON as the MCP tool's result","content":{"application/json":{"schema":{"type":"object","description":"The cve.now Index","properties":{"methodology":{"type":"string","description":"Where the score is explained"},"version":{"type":"integer","description":"The score version the ranks were computed with"},"view":{"type":"string","description":"The board: worst-case or trending; absent on the default exploited board","enum":["exploited","worst-case","trending"]},"window":{"type":"string","description":"The window the board covers; absent on an archived week","enum":["week","month","year","all"]},"week":{"type":"string","description":"The archived ISO week, e.g. 2026-W44, when one was asked for"},"start":{"type":"string","description":"An archived week's start, Monday 00:00 UTC (ISO 8601)"},"end":{"type":"string","description":"An archived week's end (ISO 8601)"},"generatedAt":{"type":"string","description":"When the board was built (ISO 8601); not on an archived week"},"url":{"type":"string","description":"The board's page on cve.now"},"rows":{"type":"array","description":"Ranked entries, best first, at most limit","items":{"type":"object","description":"One ranked entry","properties":{"rank":{"type":"integer","description":"Place on the board, 1 is first"},"movement":{"type":["integer","string","null"],"description":"Places moved since the previous week (positive is up); \"new\" when it was not on the previous board; null without a previous board to compare"},"id":{"type":"string","description":"The entry id"},"url":{"type":"string","description":"The entry's page on cve.now"},"title":{"type":"string","description":"The entry's title"},"product":{"type":["string","null"],"description":"The affected product's name; null when the record names none"},"headline":{"type":["string","null"],"description":"A one-sentence summary; null when none is written"},"score":{"type":"number","description":"The 0-100 score the board ranks by"},"provisional":{"type":"boolean","description":"true while the score may still change"},"parts":{"type":"object","description":"Points per score part: exploitation, exposure, reach, severity, patch","additionalProperties":{"type":"number","description":"Points for this part"}},"cvss":{"type":["number","null"],"description":"The CVSS base score, 0 to 10; null when unscored"},"signals":{"type":"array","description":"Signals behind the rank, e.g. kev, exploit, epss","items":{"type":"string","description":"A string"}},"reason":{"type":"object","description":"The newest event that put the entry on the board","properties":{"kind":{"type":"string","description":"published, kev, exploit, epss or attention"},"date":{"type":"string","description":"When it happened (ISO 8601)"}},"additionalProperties":true},"fix":{"type":["array","null"],"description":"Fixed versions; null when no patch is listed","items":{"type":"string","description":"A fixed version"}},"publishedAt":{"type":["string","null"],"description":"When the vulnerability was published (ISO 8601)"},"worstCase":{"type":"object","description":"Worst case view only: the worst case score and its inputs","properties":{"score":{"type":"number","description":"The 0-100 worst case score"},"maturity":{"type":"string","description":"Exploit maturity, e.g. none"},"exposure":{"type":"number","description":"Exposure points"}},"additionalProperties":true},"trend":{"type":"object","description":"Trending view only: new attention in the window","properties":{"repos":{"type":"integer","description":"New GitHub proof-of-concept repos"},"references":{"type":"integer","description":"New references on the record"},"epss":{"type":"number","description":"EPSS rise in percentage points"},"date":{"type":"string","description":"The newest dated addition (ISO 8601)"}},"additionalProperties":true}},"additionalProperties":true}}},"additionalProperties":true}}}},"400":{"description":"Bad input: { error }"},"404":{"description":"Not found: { error }"},"429":{"description":"Rate limited: { error }, with Retry-After"},"503":{"description":"Temporarily unavailable: { error }, with Retry-After"}},"parameters":[{"name":"view","in":"query","required":false,"schema":{"type":"string","enum":["exploited","worst-case","trending"],"default":"exploited","description":"Which board: exploited (the default, the cve.now Index), worst-case (ranked by a 0-100 worst case score from severity, reach, exposure and exploit maturity; rows add worstCase) or trending (ranked by new PoC repos, new references and EPSS rise; window week or month only; rows add trend)"}},{"name":"window","in":"query","required":false,"schema":{"type":"string","enum":["week","month","year","all"],"default":"week","description":"The period the board covers: the last week, month or year, or all time. Ignored when week is passed"}},{"name":"week","in":"query","required":false,"schema":{"type":"string","description":"An archived ISO week in YYYY-Www form, e.g. 2026-W44, for that week's board. Not combinable with tech, ecosystem, filter or a view other than exploited","pattern":"^[0-9]{4}-W[0-9]{2}$","examples":["2026-W44"]}},{"name":"tech","in":"query","required":false,"schema":{"type":"array","items":{"type":"string"},"description":"Technology slugs to narrow the board to, as in cve.now/feed?tech=<slug>; a row matches any listed one","examples":[["nextjs","react"]]}},{"name":"ecosystem","in":"query","required":false,"schema":{"type":"array","items":{"type":"string"},"description":"Package ecosystems to narrow the board to; a row matches any listed one","examples":[["npm"],["pypi","go"]]}},{"name":"filter","in":"query","required":false,"schema":{"type":"array","items":{"type":"string","enum":["critical","kev"]},"description":"Narrow to critical entries and/or entries on CISA's Known Exploited Vulnerabilities list (kev)","examples":[["kev"]]}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":100,"default":25,"description":"How many ranked rows to return, best first"}}]}},"/api/v1/search":{"get":{"operationId":"search","summary":"Search vulnerabilities","description":"Search cve.now's whole catalog of vulnerabilities and early warnings: the one tool for finding entries, by words or by fields. Pass q (free text, \"quoted phrases\" and ids, plus advisory.dev's query keys such as vendor:, package:, affects:lodash@4.17.20, severity:, cvss:>=9, kev:true, exploit:, epss:, date:<30d (published: works too), kind:vulnerability|breach|ransomware|malicious-package|outage, type:cve|early-warning|breach|vendor|package|tech (early_warning means early warnings and breaches, all everything), filter:critical|kev|epss, tech:, confidence: and sort:relevance|published|modified|cvss; terms are ANDed, commas OR values, a leading - excludes), the structured parameters, or both: each parameter is ANDed with q as its key term. With no words, results are newest first, so severity: [\"critical\"] lists the newest entries rated critical and kev: true the newest KEV entries. cve.now's stored feeds (critical, kev, tech/<slug>, ecosystem/<eco>) pick entries by their own rules, so read those with list_feed. The answer is items: the entries that match, and, when the query names a vendor, technology or package exactly, a row for it first (type:vendor lists vendors, type:package a named package); entries holds the entries alone. Each entry's match says why it matched: the fields each word hit (title, description, identifiers) and the key terms it meets. query echoes what ran. With no matches, suggestions lists broader queries that do match; an empty answer is not evidence that no vulnerability exists. Unverified early warnings appear only with confidence:unverified. status: \"attention\" (or status:attention in q) lists CVEs that need attention now: added to CISA KEV in the last 30 days or with a KEV due date ahead, EPSS crossing 10% or a first public exploit in the last 14 days, or an Index score of 80+ published in the last 30 days; each CVE's status and attention (reason, last_checked) say which. Pass next_cursor back as cursor for the next page.","responses":{"200":{"description":"OK: the same JSON as the MCP tool's result","content":{"application/json":{"schema":{"type":"object","description":"One page of search results","properties":{"items":{"type":"array","description":"The matching entries and the entities the query names (vendors, technologies, packages), each tagged with its type; an exact name match first","items":{"type":"object","description":"One entry or entity","properties":{"type":{"type":"string","description":"The entity type: cve, early-warning, breach, vendor, package or tech"},"kind":{"type":["string","null"],"description":"The subtype; null for an entity with none"},"id":{"type":"string","description":"The id: an entry id, a vendor or technology slug, or <ecosystem>/<name>"},"url":{"type":"string","description":"The page on cve.now"},"title":{"type":"string","description":"The name or title"}},"additionalProperties":true}},"entries":{"type":"array","description":"The matching entries alone, each with why it matched","items":{"type":"object","description":"One matching entry","properties":{"id":{"type":"string","description":"The entry id"},"kind":{"type":"string","description":"vulnerability, or the early warning's kind","enum":["breach","vulnerability","malicious-package","ransomware","outage"]},"type":{"type":"string","description":"Deprecated, use kind: cve or early_warning","enum":["cve","early_warning"]},"title":{"type":"string","description":"The entry's title"},"summary":{"type":"string","description":"A plain-language description"},"url":{"type":"string","description":"The entry's page on cve.now"},"cvss":{"type":["number","null"],"description":"The CVSS base score; null when unscored"},"severity":{"type":["string","null"],"description":"critical, high, medium or low as the entry page shows it; null when unrated"},"kev":{"type":"boolean","description":"true when it is on CISA's Known Exploited Vulnerabilities list"},"exploit":{"type":"boolean","description":"true when public exploit code is known (Exploit-DB, Metasploit or a GitHub proof of concept)"},"status":{"type":["string","null"],"description":"A CVE's status now: attention or reference; null for an early warning","enum":["attention","reference",null]},"attention":{"type":["object","null"],"description":"Why the entry needs attention, { reason, last_checked }; null unless status is attention","properties":{"reason":{"type":"string","description":"Why it needs attention"},"last_checked":{"type":["string","null"],"description":"When cve.now last re-read it (ISO 8601)"}},"additionalProperties":true},"confidence":{"type":["string","null"],"description":"An early warning's confidence; null for a vulnerability"},"category":{"type":["string","null"],"description":"Deprecated, use kind"},"published":{"type":["string","null"],"description":"When it was published (ISO 8601)"},"modified":{"type":["string","null"],"description":"When it last changed (ISO 8601)"},"match":{"type":"object","description":"Why the entry matched","properties":{"text":{"type":"array","description":"What each free-text word matched","items":{"type":"object","description":"One word or phrase of the query","properties":{"term":{"type":"string","description":"The word or quoted phrase as searched"},"alsoAs":{"type":"array","description":"Indexed words it was also searched as, when it looked misspelled","items":{"type":"string","description":"A string"}},"fields":{"type":"array","description":"The fields it matched","items":{"type":"string","description":"title, description or identifiers"}}},"additionalProperties":true}},"filters":{"type":"array","description":"The key terms of the query the entry meets","items":{"type":"string","description":"A string"}}},"additionalProperties":true}},"additionalProperties":true}},"query":{"type":"string","description":"The query that ran: q plus the structured parameters as terms"},"total":{"type":"integer","description":"Number of matches over all pages"},"next_cursor":{"type":["string","null"],"description":"Pass back as cursor for the next page; null on the last page"},"suggestions":{"type":"array","description":"Broader queries that match, when nothing did","items":{"type":"object","description":"A broader query that matches","properties":{"q":{"type":"string","description":"The query"},"total":{"type":"integer","description":"Its number of matches"}},"additionalProperties":true}},"note":{"type":"string","description":"What an empty answer means, when nothing matched"},"resolved":{"type":"object","description":"What the query was read as","properties":{"text":{"type":"array","description":"The free-text words and phrases","items":{"type":"string","description":"A string"}},"keys":{"type":"object","description":"Each key's values; a leading - marks an excluded key","additionalProperties":true}},"additionalProperties":true},"problems":{"type":"array","description":"Problems with the query; empty when it ran","items":{"type":"string","description":"A string"}},"facets":{"type":["object","null"],"description":"Counts of every match by type, confidence, kind (the advisory database), severity, ecosystem and KEV; on the REST twin when asked for, not in the MCP result","additionalProperties":true}},"additionalProperties":true}}}},"400":{"description":"Bad input: { error }"},"404":{"description":"Not found: { error }"},"429":{"description":"Rate limited: { error }, with Retry-After"},"503":{"description":"Temporarily unavailable: { error }, with Retry-After"}},"parameters":[{"name":"q","in":"query","required":false,"schema":{"type":"string","description":"Free text and query keys. Optional when a structured parameter is passed."}},{"name":"severity","in":"query","required":false,"schema":{"type":"array","items":{"type":"string","enum":["critical","high","medium","low"]},"description":"Any of these severities (CVSS band, else the stated one)"}},{"name":"kev","in":"query","required":false,"schema":{"type":"boolean","description":"true: on CISA's Known Exploited Vulnerabilities list (exploited in the wild); false: not on it"}},{"name":"exploited","in":"query","required":false,"schema":{"type":"boolean","description":"true: public exploit code exists (Exploit-DB, Metasploit or a GitHub proof of concept), the same as exploit:true; false: none known"}},{"name":"tech","in":"query","required":false,"schema":{"type":"array","items":{"type":"string"},"description":"Technology slugs, e.g. nextjs, postgresql (any of them)"}},{"name":"ecosystem","in":"query","required":false,"schema":{"type":"array","items":{"type":"string"},"description":"Package ecosystems, e.g. npm, pypi (any of them)"}},{"name":"vendor","in":"query","required":false,"schema":{"type":"array","items":{"type":"string"},"description":"Vendors, e.g. microsoft, fortinet (any of them)"}},{"name":"package","in":"query","required":false,"schema":{"type":"array","items":{"type":"string"},"description":"Package names, e.g. lodash (any of them); narrowed to the ecosystems passed"}},{"name":"published","in":"query","required":false,"schema":{"type":"array","items":{"type":"string"},"description":"Publication bounds, all applied: an age (<30d) or a date (>=2026-10-01); two bounds make a window, e.g. [\">=2026-10-01\", \"<2026-10-08\"]"}},{"name":"date","in":"query","required":false,"schema":{"type":"array","items":{"type":"string"},"description":"The same as published: the name both cve.now and down.guide use for the date of an entry"}},{"name":"confidence","in":"query","required":false,"schema":{"type":"array","items":{"type":"string","enum":["confirmed","corroborated","unverified"]},"description":"Early warning confidence (any of them)"}},{"name":"filter","in":"query","required":false,"schema":{"type":"array","items":{"type":"string","enum":["critical","kev","epss"]},"description":"The priority slice (any of them): critical (the /critical rule), kev (known exploited) or epss (EPSS has reached 10%)"}},{"name":"kind","in":"query","required":false,"schema":{"type":"array","items":{"type":"string","enum":["breach","vulnerability","malicious-package","ransomware","outage"]},"description":"Entry kinds (any of them): vulnerability, or the kind of early warning"}},{"name":"fix","in":"query","required":false,"schema":{"type":"array","items":{"type":"string","enum":["available","none"]},"description":"available: the entry has a fix, as its \"Fix available\" badge says (a fixed version, a fix reference or a vendor patch; fix:true); none: it has none (fix:false). With type: [\"package\"], none lists the packages with an advisory that has no released fix"}},{"name":"type","in":"query","required":false,"schema":{"type":"array","items":{"type":"string","enum":["cve","early-warning","breach","vendor","package","tech","early_warning","all"]},"description":"Entity types (any of them): the entries, or the vendors, packages and technologies themselves. All of them when omitted. early_warning is early warnings and breaches together; all is every type"}},{"name":"status","in":"query","required":false,"schema":{"type":"string","enum":["attention","reference"],"description":"attention: CVEs that need attention now (status:attention); reference: the rest"}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":100,"default":20}},{"name":"cursor","in":"query","required":false,"schema":{"type":"string","description":"next_cursor of the last page"}}]}},"/api/v1/packages/{ecosystem}/{name}":{"get":{"operationId":"get_package","summary":"Get a package's vulnerability history","description":"Get one package's vulnerability history on cve.now: every advisory naming it (newest first, each with severity, CVSS, KEV, its affected ranges, fix status from the registry's releases and, on npm, PyPI and crates.io, the share of downloads that were affected versions), rollup (the share of the package's downloads in the window that were on a version at least one advisory affects, the union over its advisories, with a sentence in rollup.text, or why it isn't known), whether the latest release is affected, the newest stable release no advisory affects (the version to upgrade to; it doesn't count unplaced advisories and is null when truncated), affected version spans per advisory, and unplaced: advisories whose ranges can't be compared with versions (when only those could affect a release, its affected is null, meaning unknown), and truncated: more than 500 advisories name it, so only the newest are listed and no release is called clean, and weekly downloads and dependents. Pass version to ask whether that version is affected and by which advisories. The page is https://cve.now/packages/<ecosystem>/<name>. For many packages or a lockfile at once, use check_stack.","responses":{"200":{"description":"OK: the same JSON as the MCP tool's result","content":{"application/json":{"schema":{"type":"object","description":"One package's advisories and versions","properties":{"type":{"type":"string","description":"The entity type: package","enum":["package"]},"kind":{"type":["string","null"],"description":"A package has no subtype: always null"},"id":{"type":"string","description":"The package's id, <ecosystem>/<name>","examples":["npm/lodash"]},"title":{"type":"string","description":"The package name"},"ecosystem":{"type":"string","description":"The package's ecosystem"},"ecosystemLabel":{"type":"string","description":"The ecosystem as it is displayed, e.g. npm, PyPI"},"name":{"type":"string","description":"The package name as the advisories spell it"},"url":{"type":"string","description":"The package's page on cve.now"},"registryUrl":{"type":["object","null"],"description":"The package's page at its registry as { label, url }; null when it has none","additionalProperties":true},"advisories":{"type":"array","description":"Every advisory naming the package, newest first","items":{"type":"object","description":"One advisory naming the package","properties":{"id":{"type":"string","description":"The advisory's entry id"},"title":{"type":"string","description":"The advisory's title"},"url":{"type":"string","description":"The entry's page on cve.now"},"severity":{"type":"string","description":"critical, high, medium, low, none or unrated"},"cvss":{"type":["number","null"],"description":"The CVSS base score; null when unscored"},"kev":{"type":"boolean","description":"true when it is on CISA's Known Exploited Vulnerabilities list"},"publishedAt":{"type":["string","null"],"description":"When it was published (ISO 8601)"},"affected":{"type":"array","description":"The affected ranges (or listed versions) for this package, as text","items":{"type":"string","description":"A string"}},"fixStatus":{"type":["object","null"],"description":"Whether a fix is released; null without registry data or orderable ranges","properties":{"ecosystem":{"type":"string","description":"The package's ecosystem"},"package":{"type":"string","description":"The package name"},"status":{"type":"string","description":"fixed: a fixed version or a newer unaffected release exists; none: no fix is released","enum":["fixed","none"]},"source":{"type":["string","null"],"description":"Where fixed came from: the advisory's ranges, or the first release after them","enum":["ranges","release",null]},"fixed":{"type":"array","description":"Fixed versions, lowest first; empty when status is none","items":{"type":"object","description":"One release that fixes the advisory","properties":{"version":{"type":"string","description":"The fixed version"},"publishedAt":{"type":["string","null"],"description":"When the registry published it (ISO 8601); null when it lists no date"},"daysFromDisclosure":{"type":["integer","null"],"description":"Whole days from disclosure to this release; negative when the fix shipped first"},"named":{"type":"string","description":"The fixed version the advisory names, when that release was never published and this is the first stable one after it"}},"additionalProperties":true}},"unreleased":{"type":"array","description":"Fixed versions the advisory names that the registry has not published","items":{"type":"string","description":"A string"}},"latest":{"type":["object","null"],"description":"The latest release and whether it is inside an affected range; null when the registry marks none","properties":{"version":{"type":"string","description":"The latest release"},"publishedAt":{"type":["string","null"],"description":"When it was published (ISO 8601)"},"affected":{"type":"boolean","description":"true when it is inside an affected range"}},"additionalProperties":true},"asOf":{"type":"string","description":"When the registry data was read (ISO 8601)"}},"additionalProperties":true},"downloadExposure":{"type":["object","null"],"description":"The share of the package's downloads that were affected versions (npm, PyPI and crates.io only); null otherwise","properties":{"ecosystem":{"type":"string","description":"The package's ecosystem (npm, PyPI or crates.io)"},"package":{"type":"string","description":"The package name"},"window":{"type":"string","description":"The download window: last-week on npm, 90d on crates.io"},"affectedShare":{"type":"number","description":"Affected downloads divided by total downloads, 0 to 1"},"affectedDownloads":{"type":"number","description":"Downloads of affected versions in the window"},"totalDownloads":{"type":"number","description":"All downloads in the window"},"asOf":{"type":"string","description":"When the counts were read (ISO 8601)"}},"additionalProperties":true},"affectsLatest":{"type":["boolean","null"],"description":"true when the latest release is inside this advisory's ranges; null when that cannot be told"},"affectsVersion":{"type":["boolean","null"],"description":"With version asked for: whether it is inside this advisory's ranges; null when that cannot be told"}},"additionalProperties":true}},"truncated":{"type":"boolean","description":"More advisories name the package than cve.now checks (the newest 500 are listed); then no release is called clean. The downloads rollup still counts the older ones"},"latest":{"type":["object","null"],"description":"The latest release as { version, publishedAt, affected, advisories }; affected is null when only unplaced advisories could affect it; null without registry data","additionalProperties":true},"newestUnaffected":{"type":["object","null"],"description":"The highest stable release no placed advisory affects, as { version, publishedAt }; null when every one is affected or the list is truncated","additionalProperties":true},"unplaced":{"type":"array","description":"Ids of advisories whose ranges cannot be compared with versions; verdicts leave them out","items":{"type":"string","description":"A string"}},"versionCount":{"type":"integer","description":"Versions on the timeline (registry data); 0 without it"},"firstRelease":{"type":["object","null"],"description":"The first release as { version, publishedAt }; null without registry data","additionalProperties":true},"spans":{"type":"object","description":"Affected version spans per advisory id, in version order, each { from, to, next }","additionalProperties":{"type":"array","description":"The advisory's spans","items":{"type":"object","description":"One span","additionalProperties":true}}},"versionsTruncated":{"type":"boolean","description":"The registry object dropped older versions, so the lowest spans may start earlier than shown"},"registryAsOf":{"type":["string","null"],"description":"When the registry data was read (ISO 8601)"},"registryState":{"type":"string","description":"read, queued (not read yet; the next sync reads it), unavailable (read, the registry has nothing) or unsupported (no registry source for the ecosystem)"},"rollup":{"type":"object","description":"The share of last week's downloads (crates.io: the last 90 days) that were on a version at least one advisory affects: the union over the advisories, a version two advisories affect counts once. Counts every advisory the package has up to 2,000, not only the listed newest 500. known is false, with a reason, when it cannot be told","properties":{"known":{"type":"boolean","description":"true when the share is known"},"text":{"type":"string","description":"The rollup as one sentence, as the package page says it"},"reason":{"type":"string","description":"When known is false: no-source, not-read, no-counts, no-ranges or unclear"},"exposure":{"type":"object","description":"When known: { window, affectedDownloads, totalDownloads, affectedShare, asOf } as in an advisory's downloadExposure","properties":{},"additionalProperties":true},"through":{"type":"string","description":"PyPI: the newest day (YYYY-MM-DD, UTC) the counts cover"},"advisories":{"type":"integer","description":"Advisories counted"},"unplaced":{"type":"integer","description":"Advisories left out because their ranges cannot be compared with versions (the share is then a floor)"},"omitted":{"type":"integer","description":"Advisories past the 2,000 read (the share is a floor)"}},"required":["known","text"],"additionalProperties":true},"weeklyDownloads":{"type":["number","null"],"description":"Downloads in the last week; null when cve.now has not read them"},"dependents":{"type":["number","null"],"description":"Packages depending on it per deps.dev; null when cve.now has not read them"},"popularityAsOf":{"type":["string","null"],"description":"When the download and dependent counts were read (ISO 8601)"},"version":{"type":"object","description":"Only when version was passed: whether that version is affected","properties":{"version":{"type":"string","description":"The version asked about"},"published":{"type":["boolean","null"],"description":"true when the registry lists the version; null without registry data"},"affected":{"type":["boolean","null"],"description":"true when an advisory affects it; null when only advisories it cannot be compared with could"},"advisories":{"type":"array","description":"Ids of the advisories that affect it","items":{"type":"string","description":"A string"}},"unknown":{"type":"array","description":"Ids of advisories whose ranges cannot be compared with it","items":{"type":"string","description":"A string"}}},"additionalProperties":true}},"additionalProperties":true}}}},"400":{"description":"Bad input: { error }"},"404":{"description":"Not found: { error }"},"429":{"description":"Rate limited: { error }, with Retry-After"},"503":{"description":"Temporarily unavailable: { error }, with Retry-After"}},"parameters":[{"name":"ecosystem","in":"path","required":true,"schema":{"type":"string"}},{"name":"name","in":"path","required":true,"schema":{"type":"string"}},{"name":"version","in":"query","required":false,"schema":{"type":"string","description":"A version to check, e.g. 1.7.4"}}]}},"/feed":{"get":{"operationId":"get_feed","summary":"Feed","description":"One feed of CVEs, early warnings and breaches: RSS by default, Atom or JSON Feed with format. Without type it lists CVEs and every early warning; a CVE filter without a type lists CVEs only. type=early-warning is the Early warnings list without the breaches (the older early_warning lists them too). A filter lists only the types that take it. Unknown parameters are ignored; an invalid value of a known one answers 400.","parameters":[{"name":"type","in":"query","required":false,"description":"The record types to list. Without it the feed lists what it always did.","schema":{"type":"array","items":{"type":"string","enum":["cve","early-warning","breach","all"]}},"style":"form","explode":false},{"name":"kind","in":"query","required":false,"description":"The subtype inside a type.","schema":{"type":"array","items":{"type":"string","enum":["vulnerability","malicious-package","outage","breach","ransomware"]}},"style":"form","explode":false},{"name":"format","in":"query","required":false,"description":"rss (default), atom or json (JSON Feed 1.1).","schema":{"type":"string","enum":["rss","atom","json"]}},{"name":"filter","in":"query","required":false,"description":"critical (CVEs and early warnings), kev or epss (CVEs).","schema":{"type":"array","items":{"type":"string","enum":["critical","kev","epss"]}},"style":"form","explode":false},{"name":"tech","in":"query","required":false,"description":"A technology slug (CVEs).","schema":{"type":"array","items":{"type":"string"}},"style":"form","explode":false},{"name":"ecosystem","in":"query","required":false,"description":"A package ecosystem (CVEs).","schema":{"type":"array","items":{"type":"string"}},"style":"form","explode":false},{"name":"vendor","in":"query","required":false,"description":"A vendor slug (CVEs); takes no other filter.","schema":{"type":"array","items":{"type":"string"}},"style":"form","explode":false},{"name":"fix","in":"query","required":false,"description":"none: ranked CVEs whose package has no fix released (CVEs).","schema":{"type":"array","items":{"type":"string","enum":["none"]}},"style":"form","explode":false},{"name":"confidence","in":"query","required":false,"description":"confirmed or corroborated (early warnings and breaches); disputed also for breaches.","schema":{"type":"array","items":{"type":"string"}},"style":"form","explode":false},{"name":"data","in":"query","required":false,"description":"What a breach exposed (breaches).","schema":{"type":"array","items":{"type":"string"}},"style":"form","explode":false},{"name":"vector","in":"query","required":false,"description":"How a breach happened (breaches).","schema":{"type":"array","items":{"type":"string"}},"style":"form","explode":false},{"name":"size","in":"query","required":false,"description":"How many records a breach exposed (breaches).","schema":{"type":"array","items":{"type":"string"}},"style":"form","explode":false}],"responses":{"200":{"description":"The feed, in the format asked for","content":{"application/rss+xml":{},"application/atom+xml":{},"application/feed+json":{}}},"400":{"description":"An invalid value of a known parameter: { error, param, value, valid }"}}}},"/api/v1/rankings":{"get":{"operationId":"rankings.list","summary":"List the rankings","description":"Every ranking the site has, with its id, title, the entity type it ranks, its periods (time tokens, default first), the archive it keeps (week or month, for at) and the filters rankings.get takes. url is the ranking's page, null for a ranking only the API serves.","responses":{"200":{"description":"OK: the same JSON as the MCP operation rankings.list","content":{"application/json":{}}},"400":{"description":"Bad input: { error, param, value?, valid? }"},"404":{"description":"No such ranking: { error: \"not_found\", param, value, valid }"},"429":{"description":"Rate limited: { error }, with Retry-After"}}}},"/api/v1/rankings/{id}":{"get":{"operationId":"rankings.get","summary":"Get one ranking","description":"One ranking's rows, ranked. id is a ranking from rankings.list (cves, cves-worst-case, cves-trending, breaches-size, vendors, vendors-kev, packages). period picks a rolling window from the ranking's periods (7d, 30d, 365d, all, 90d; default the first), at an archived ISO week (2026-W45) or month (2026-10) when the ranking keeps that archive; a ranking with no periods shows the current week or month. The filters are the ranking's own (tech, ecosystem, filter, category). Any other argument or value answers 400 with the valid ones. The answer is { id, title, type, period or at, url, rows }.","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","enum":["cves","cves-worst-case","cves-trending","breaches-size","vendors","vendors-kev","packages"]}},{"name":"period","in":"query","required":false,"schema":{"type":"string","description":"A rolling window from the ranking's periods, such as 7d, 30d, 365d, all or 90d. Default: the ranking's first."}},{"name":"at","in":"query","required":false,"schema":{"type":"string","description":"An archived ISO week (2026-W45) or calendar month (2026-10), when the ranking keeps that archive."}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","minimum":1,"description":"Rows to return. Default 25."}},{"name":"tech","in":"query","required":false,"schema":{"description":"Narrows the rankings that take tech. One value, or a list.","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}},{"name":"ecosystem","in":"query","required":false,"schema":{"description":"Narrows the rankings that take ecosystem. One value, or a list.","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}},{"name":"filter","in":"query","required":false,"schema":{"description":"Narrows the rankings that take filter. One value, or a list.","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}],"responses":{"200":{"description":"OK: the same JSON as the MCP operation rankings.get","content":{"application/json":{}}},"400":{"description":"Bad input: { error, param, value?, valid? }"},"404":{"description":"No such ranking: { error: \"not_found\", param, value, valid }"},"429":{"description":"Rate limited: { error }, with Retry-After"}}}},"/api/v1/cves":{"get":{"operationId":"list_cve","summary":"List cves","description":"CVEs, one page: 30 by default. `next_cursor` goes back as `cursor` for the next page and is null on the last. A parameter that is unknown or does not apply to this type is a 400.","parameters":[{"name":"type","in":"query","required":false,"description":"Accepted for symmetry with /feed and search; it must be cve","schema":{"type":"string","enum":["cve"]}},{"name":"kind","in":"query","required":false,"description":"The subtype of a cve","style":"form","explode":false,"schema":{"type":"array","items":{"type":"string","enum":["vulnerability"]}}},{"name":"filter","in":"query","required":false,"description":"Narrows CVEs by filter","style":"form","explode":false,"schema":{"type":"array","items":{"type":"string","enum":["critical","kev","epss"]}}},{"name":"vendor","in":"query","required":false,"description":"Narrows CVEs by vendor","style":"form","explode":false,"schema":{"type":"array","items":{"type":"string"}}},{"name":"tech","in":"query","required":false,"description":"Narrows CVEs by tech","style":"form","explode":false,"schema":{"type":"array","items":{"type":"string"}}},{"name":"ecosystem","in":"query","required":false,"description":"Narrows CVEs by ecosystem","style":"form","explode":false,"schema":{"type":"array","items":{"type":"string"}}},{"name":"fix","in":"query","required":false,"description":"Narrows CVEs by fix","style":"form","explode":false,"schema":{"type":"array","items":{"type":"string","enum":["none","available"]}}},{"name":"severity","in":"query","required":false,"description":"Narrows CVEs by severity","style":"form","explode":false,"schema":{"type":"array","items":{"type":"string","enum":["critical","high","medium","low"]}}},{"name":"limit","in":"query","required":false,"description":"Page size, 1 to 200 (default 30)","schema":{"type":"integer","minimum":1,"maximum":200,"default":30}},{"name":"cursor","in":"query","required":false,"description":"next_cursor of the previous page","schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","required":["items","next_cursor"],"properties":{"items":{"type":"array","items":{"type":"object","description":"One cve: type, kind, id, url and title, then this site's own fields","required":["type","kind","id","url","title"],"properties":{"type":{"type":"string","const":"cve"},"kind":{"type":["string","null"],"enum":["vulnerability",null]},"id":{"type":"string"},"url":{"type":"string","format":"uri"},"title":{"type":"string"}},"additionalProperties":true}},"next_cursor":{"type":["string","null"]},"total":{"type":"integer"}},"additionalProperties":true}}}},"400":{"description":"A parameter is unknown, does not apply to this type or has an invalid value: { error, param, value?, valid?, applies_to?, hint? }"},"404":{"description":"Not found: { error: 'not_found', type, id, hint? }"},"429":{"description":"Rate limited: { error }, with Retry-After"},"503":{"description":"Temporarily unavailable: { error }, with Retry-After"}}}},"/api/v1/cves/{id}":{"get":{"operationId":"get_cve","summary":"Get one cve","description":"One cve by id.","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","description":"One cve: type, kind, id, url and title, then this site's own fields","required":["type","kind","id","url","title"],"properties":{"type":{"type":"string","const":"cve"},"kind":{"type":["string","null"],"enum":["vulnerability",null]},"id":{"type":"string"},"url":{"type":"string","format":"uri"},"title":{"type":"string"}},"additionalProperties":true}}}},"400":{"description":"A parameter is unknown, does not apply to this type or has an invalid value: { error, param, value?, valid?, applies_to?, hint? }"},"404":{"description":"Not found: { error: 'not_found', type, id, hint? }"},"429":{"description":"Rate limited: { error }, with Retry-After"},"503":{"description":"Temporarily unavailable: { error }, with Retry-After"}}}},"/api/v1/early-warnings":{"get":{"operationId":"list_early_warning","summary":"List early warnings","description":"Early warnings, one page: 30 by default. `next_cursor` goes back as `cursor` for the next page and is null on the last. A parameter that is unknown or does not apply to this type is a 400.","parameters":[{"name":"type","in":"query","required":false,"description":"Accepted for symmetry with /feed and search; it must be early-warning","schema":{"type":"string","enum":["early-warning"]}},{"name":"kind","in":"query","required":false,"description":"The subtype of a early warning","style":"form","explode":false,"schema":{"type":"array","items":{"type":"string","enum":["malicious-package","outage","vulnerability"]}}},{"name":"confidence","in":"query","required":false,"description":"Narrows Early warnings by confidence","style":"form","explode":false,"schema":{"type":"array","items":{"type":"string","enum":["confirmed","corroborated","unverified"]}}},{"name":"filter","in":"query","required":false,"description":"Narrows Early warnings by filter","style":"form","explode":false,"schema":{"type":"array","items":{"type":"string","enum":["critical"]}}},{"name":"limit","in":"query","required":false,"description":"Page size, 1 to 200 (default 30)","schema":{"type":"integer","minimum":1,"maximum":200,"default":30}},{"name":"cursor","in":"query","required":false,"description":"next_cursor of the previous page","schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","required":["items","next_cursor"],"properties":{"items":{"type":"array","items":{"type":"object","description":"One early warning: type, kind, id, url and title, then this site's own fields","required":["type","kind","id","url","title"],"properties":{"type":{"type":"string","const":"early-warning"},"kind":{"type":["string","null"],"enum":["malicious-package","outage","vulnerability",null]},"id":{"type":"string"},"url":{"type":"string","format":"uri"},"title":{"type":"string"}},"additionalProperties":true}},"next_cursor":{"type":["string","null"]},"total":{"type":"integer"}},"additionalProperties":true}}}},"400":{"description":"A parameter is unknown, does not apply to this type or has an invalid value: { error, param, value?, valid?, applies_to?, hint? }"},"404":{"description":"Not found: { error: 'not_found', type, id, hint? }"},"429":{"description":"Rate limited: { error }, with Retry-After"},"503":{"description":"Temporarily unavailable: { error }, with Retry-After"}}}},"/api/v1/early-warnings/{id}":{"get":{"operationId":"get_early_warning","summary":"Get one early warning","description":"One early warning by id.","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","description":"One early warning: type, kind, id, url and title, then this site's own fields","required":["type","kind","id","url","title"],"properties":{"type":{"type":"string","const":"early-warning"},"kind":{"type":["string","null"],"enum":["malicious-package","outage","vulnerability",null]},"id":{"type":"string"},"url":{"type":"string","format":"uri"},"title":{"type":"string"}},"additionalProperties":true}}}},"400":{"description":"A parameter is unknown, does not apply to this type or has an invalid value: { error, param, value?, valid?, applies_to?, hint? }"},"404":{"description":"Not found: { error: 'not_found', type, id, hint? }"},"429":{"description":"Rate limited: { error }, with Retry-After"},"503":{"description":"Temporarily unavailable: { error }, with Retry-After"}}}},"/api/v1/breaches":{"get":{"operationId":"list_breach","summary":"List breaches","description":"Breaches, one page: 30 by default. `next_cursor` goes back as `cursor` for the next page and is null on the last. A parameter that is unknown or does not apply to this type is a 400.","parameters":[{"name":"type","in":"query","required":false,"description":"Accepted for symmetry with /feed and search; it must be breach","schema":{"type":"string","enum":["breach"]}},{"name":"kind","in":"query","required":false,"description":"The subtype of a breach","style":"form","explode":false,"schema":{"type":"array","items":{"type":"string","enum":["breach","ransomware"]}}},{"name":"confidence","in":"query","required":false,"description":"Narrows Breaches by confidence","style":"form","explode":false,"schema":{"type":"array","items":{"type":"string","enum":["corroborated","confirmed","disputed"]}}},{"name":"data","in":"query","required":false,"description":"Narrows Breaches by data","style":"form","explode":false,"schema":{"type":"array","items":{"type":"string","enum":["passwords","cards","ssn","health","tokens"]}}},{"name":"vector","in":"query","required":false,"description":"Narrows Breaches by vector","style":"form","explode":false,"schema":{"type":"array","items":{"type":"string","enum":["stolen_credentials","phishing_social","third_party","exploited_vuln","misconfiguration","malware_ransomware","insider","unknown"]}}},{"name":"size","in":"query","required":false,"description":"Narrows Breaches by size","style":"form","explode":false,"schema":{"type":"array","items":{"type":"string","enum":["100k","1m"]}}},{"name":"limit","in":"query","required":false,"description":"Page size, 1 to 200 (default 30)","schema":{"type":"integer","minimum":1,"maximum":200,"default":30}},{"name":"cursor","in":"query","required":false,"description":"next_cursor of the previous page","schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","required":["items","next_cursor"],"properties":{"items":{"type":"array","items":{"type":"object","description":"One breach: type, kind, id, url and title, then this site's own fields","required":["type","kind","id","url","title"],"properties":{"type":{"type":"string","const":"breach"},"kind":{"type":["string","null"],"enum":["breach","ransomware",null]},"id":{"type":"string"},"url":{"type":"string","format":"uri"},"title":{"type":"string"}},"additionalProperties":true}},"next_cursor":{"type":["string","null"]},"total":{"type":"integer"}},"additionalProperties":true}}}},"400":{"description":"A parameter is unknown, does not apply to this type or has an invalid value: { error, param, value?, valid?, applies_to?, hint? }"},"404":{"description":"Not found: { error: 'not_found', type, id, hint? }"},"429":{"description":"Rate limited: { error }, with Retry-After"},"503":{"description":"Temporarily unavailable: { error }, with Retry-After"}}}},"/api/v1/breaches/{id}":{"get":{"operationId":"get_breach","summary":"Get one breach","description":"One breach by id.","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","description":"One breach: type, kind, id, url and title, then this site's own fields","required":["type","kind","id","url","title"],"properties":{"type":{"type":"string","const":"breach"},"kind":{"type":["string","null"],"enum":["breach","ransomware",null]},"id":{"type":"string"},"url":{"type":"string","format":"uri"},"title":{"type":"string"}},"additionalProperties":true}}}},"400":{"description":"A parameter is unknown, does not apply to this type or has an invalid value: { error, param, value?, valid?, applies_to?, hint? }"},"404":{"description":"Not found: { error: 'not_found', type, id, hint? }"},"429":{"description":"Rate limited: { error }, with Retry-After"},"503":{"description":"Temporarily unavailable: { error }, with Retry-After"}}}},"/api/v1/vendors":{"get":{"operationId":"list_vendor","summary":"List vendors","description":"Vendors, one page: 30 by default. `next_cursor` goes back as `cursor` for the next page and is null on the last. A parameter that is unknown or does not apply to this type is a 400.","parameters":[{"name":"type","in":"query","required":false,"description":"Accepted for symmetry with /feed and search; it must be vendor","schema":{"type":"string","enum":["vendor"]}},{"name":"filter","in":"query","required":false,"description":"Narrows Vendors by filter","style":"form","explode":false,"schema":{"type":"array","items":{"type":"string","enum":["kev"]}}},{"name":"q","in":"query","required":false,"description":"Keeps the vendors whose name, slug or alias contains the text","schema":{"type":"string"}},{"name":"limit","in":"query","required":false,"description":"Page size, 1 to 200 (default 30)","schema":{"type":"integer","minimum":1,"maximum":200,"default":30}},{"name":"cursor","in":"query","required":false,"description":"next_cursor of the previous page","schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","required":["items","next_cursor"],"properties":{"items":{"type":"array","items":{"type":"object","description":"One vendor: type, kind, id, url and title, then this site's own fields","required":["type","kind","id","url","title"],"properties":{"type":{"type":"string","const":"vendor"},"kind":{"type":["string","null"]},"id":{"type":"string"},"url":{"type":"string","format":"uri"},"title":{"type":"string"}},"additionalProperties":true}},"next_cursor":{"type":["string","null"]},"total":{"type":"integer"}},"additionalProperties":true}}}},"400":{"description":"A parameter is unknown, does not apply to this type or has an invalid value: { error, param, value?, valid?, applies_to?, hint? }"},"404":{"description":"Not found: { error: 'not_found', type, id, hint? }"},"429":{"description":"Rate limited: { error }, with Retry-After"},"503":{"description":"Temporarily unavailable: { error }, with Retry-After"}}}},"/api/v1/vendors/{id}":{"get":{"operationId":"get_vendor","summary":"Get one vendor","description":"One vendor by id.","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","description":"One vendor: type, kind, id, url and title, then this site's own fields","required":["type","kind","id","url","title"],"properties":{"type":{"type":"string","const":"vendor"},"kind":{"type":["string","null"]},"id":{"type":"string"},"url":{"type":"string","format":"uri"},"title":{"type":"string"}},"additionalProperties":true}}}},"400":{"description":"A parameter is unknown, does not apply to this type or has an invalid value: { error, param, value?, valid?, applies_to?, hint? }"},"404":{"description":"Not found: { error: 'not_found', type, id, hint? }"},"429":{"description":"Rate limited: { error }, with Retry-After"},"503":{"description":"Temporarily unavailable: { error }, with Retry-After"}}}},"/api/v1/packages":{"get":{"operationId":"list_package","summary":"List packages","description":"Packages, one page: 30 by default. `next_cursor` goes back as `cursor` for the next page and is null on the last. A parameter that is unknown or does not apply to this type is a 400.","parameters":[{"name":"type","in":"query","required":false,"description":"Accepted for symmetry with /feed and search; it must be package","schema":{"type":"string","enum":["package"]}},{"name":"ecosystem","in":"query","required":false,"description":"Narrows Packages by ecosystem","style":"form","explode":false,"schema":{"type":"array","items":{"type":"string"}}},{"name":"fix","in":"query","required":false,"description":"Narrows Packages by fix","style":"form","explode":false,"schema":{"type":"array","items":{"type":"string","enum":["none"]}}},{"name":"q","in":"query","required":false,"description":"Keeps the packages whose name, slug or alias contains the text","schema":{"type":"string"}},{"name":"limit","in":"query","required":false,"description":"Page size, 1 to 200 (default 30)","schema":{"type":"integer","minimum":1,"maximum":200,"default":30}},{"name":"cursor","in":"query","required":false,"description":"next_cursor of the previous page","schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","required":["items","next_cursor"],"properties":{"items":{"type":"array","items":{"type":"object","description":"One package: type, kind, id, url and title, then this site's own fields","required":["type","kind","id","url","title"],"properties":{"type":{"type":"string","const":"package"},"kind":{"type":["string","null"]},"id":{"type":"string"},"url":{"type":"string","format":"uri"},"title":{"type":"string"}},"additionalProperties":true}},"next_cursor":{"type":["string","null"]},"total":{"type":"integer"}},"additionalProperties":true}}}},"400":{"description":"A parameter is unknown, does not apply to this type or has an invalid value: { error, param, value?, valid?, applies_to?, hint? }"},"404":{"description":"Not found: { error: 'not_found', type, id, hint? }"},"429":{"description":"Rate limited: { error }, with Retry-After"},"503":{"description":"Temporarily unavailable: { error }, with Retry-After"}}}},"/api/v1/tech":{"get":{"operationId":"list_tech","summary":"List tech","description":"Tech, one page: 30 by default. `next_cursor` goes back as `cursor` for the next page and is null on the last. A parameter that is unknown or does not apply to this type is a 400.","parameters":[{"name":"type","in":"query","required":false,"description":"Accepted for symmetry with /feed and search; it must be tech","schema":{"type":"string","enum":["tech"]}},{"name":"q","in":"query","required":false,"description":"Keeps the tech whose name, slug or alias contains the text","schema":{"type":"string"}},{"name":"limit","in":"query","required":false,"description":"Page size, 1 to 200 (default 30)","schema":{"type":"integer","minimum":1,"maximum":200,"default":30}},{"name":"cursor","in":"query","required":false,"description":"next_cursor of the previous page","schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","required":["items","next_cursor"],"properties":{"items":{"type":"array","items":{"type":"object","description":"One tech: type, kind, id, url and title, then this site's own fields","required":["type","kind","id","url","title"],"properties":{"type":{"type":"string","const":"tech"},"kind":{"type":["string","null"]},"id":{"type":"string"},"url":{"type":"string","format":"uri"},"title":{"type":"string"}},"additionalProperties":true}},"next_cursor":{"type":["string","null"]},"total":{"type":"integer"}},"additionalProperties":true}}}},"400":{"description":"A parameter is unknown, does not apply to this type or has an invalid value: { error, param, value?, valid?, applies_to?, hint? }"},"404":{"description":"Not found: { error: 'not_found', type, id, hint? }"},"429":{"description":"Rate limited: { error }, with Retry-After"},"503":{"description":"Temporarily unavailable: { error }, with Retry-After"}}}},"/api/v1/tech/{id}":{"get":{"operationId":"get_tech","summary":"Get one tech","description":"One tech by id.","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","description":"One tech: type, kind, id, url and title, then this site's own fields","required":["type","kind","id","url","title"],"properties":{"type":{"type":"string","const":"tech"},"kind":{"type":["string","null"]},"id":{"type":"string"},"url":{"type":"string","format":"uri"},"title":{"type":"string"}},"additionalProperties":true}}}},"400":{"description":"A parameter is unknown, does not apply to this type or has an invalid value: { error, param, value?, valid?, applies_to?, hint? }"},"404":{"description":"Not found: { error: 'not_found', type, id, hint? }"},"429":{"description":"Rate limited: { error }, with Retry-After"},"503":{"description":"Temporarily unavailable: { error }, with Retry-After"}}}}}}