Carnegie Mellon University Vendors API

openapi: 3.2.0
info:
  title: CERT/CC Vulnerability Notes Vendors API
  version: '1.0'
  description: 'Public, unauthenticated read API for the CERT Coordination Center''s Vulnerability Notes database, operated by the CERT Division of the Software Engineering Institute at Carnegie Mellon University. Each Vulnerability Note (VU#nnnnnn) is the published result of a coordinated vulnerability disclosure case: overview, impact, resolution, affected systems, CVSS metrics, the CVE identifiers rolled into the case, and the per-vendor status statements CERT/CC collected during coordination. This is one of the very few genuinely institution-engineered public APIs in the higher-education cohort — it is not a repository platform, not a library discovery layer, and not a vendor tenancy. CMU publishes no OpenAPI for it; this document was derived from live probes.'
  termsOfService: https://www.sei.cmu.edu/legal/
  contact:
    name: CERT Coordination Center — Software Engineering Institute, Carnegie Mellon University
    email: cert@cert.org
    url: https://www.sei.cmu.edu/divisions/cert/
  x-operator: institution
  x-operator-evidence: 'kb.cert.org is not a cmu.edu host, so the cohort audit could not see it — but cert.org is Carnegie Mellon University''s. https://www.cert.org/ 301-redirects to https://www.sei.cmu.edu/divisions/cert/, and the API''s sibling Atom feed at https://kb.cert.org/vuls/atomfeed/ declares <author><name>CERT</name> <email>cert@cert.org</email><uri>https://www.sei.cmu.edu</uri></author>. The CERT Division is a division of the Software Engineering Institute, a federally funded research and development center operated BY Carnegie Mellon University. The documentation hub certcc.github.io links only to sei.cmu.edu legal and privacy notices. Probed 2026-08-19: /vuls/api/421644/ 200 application/json (real Vulnerability Note payload, 8,263 bytes); /vuls/api/421644/vuls/ 200 (10 CVE records); /vuls/api/421644/vendors/ 200 (123 vendor statement records); /vuls/atomfeed/ 200 application/atom+xml.'
  x-provenance:
    generated: '2026-08-19'
    method: derived
    source: Live probes of https://kb.cert.org/vuls/api/ on 2026-08-19 against three real Vulnerability Notes (VU#421644, VU#257161, VU#730793), with payloads captured into examples/.
    authorship: 'Written by API Evangelist, not published by Carnegie Mellon University. No OpenAPI, Swagger or schema document is served for this API: /vuls/api/, /vuls/api/docs/ and /vuls/api/summary/ all return the API''s generic JSON error object, and www.kb.cert.org/vuls/api returns 404.'
    coverage: Three path templates and one feed are modelled — every path confirmed to return a real payload. Paths that returned only the catch-all error object ({"error":"Content requested either does not exist or you do not have permissions to view it!"}) are deliberately excluded rather than guessed at, and are recorded in errors/.
servers:
- url: https://kb.cert.org
  description: Production — CERT/CC Vulnerability Notes, operated by CMU SEI
tags:
- name: vendors
  description: Per-vendor coordination status.
paths:
  /vuls/api/{idnumber}/vendors/:
    get:
      tags:
      - vendors
      operationId: listNoteVendors
      summary: List vendor coordination statements for a Vulnerability Note
      description: Returns every vendor CERT/CC contacted during coordination of the case, when they were contacted, their published statement (if any) and when it was last updated. This is the machine-readable form of the coordinated-disclosure record and is the part of the API with no equivalent anywhere else.
      parameters:
      - name: idnumber
        in: path
        required: true
        schema:
          type: string
          pattern: ^[0-9]{6}$
        example: '421644'
      responses:
        '200':
          description: Array of vendor records (123 for VU#421644 when probed 2026-08-19).
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/VendorStatement'
              example:
              - note: '421644'
                contact_date: '2024-02-19T15:21:17.589549Z'
                vendor: Yahoo Inc.
                references: null
                statement: null
                dateupdated: '2024-04-03T17:15:19.803945Z'
                statement_date: null
                addendum: null
components:
  schemas:
    VendorStatement:
      type: object
      properties:
        note:
          type: string
        contact_date:
          type:
          - string
          - 'null'
          format: date-time
        vendor:
          type: string
        references:
          type:
          - string
          - 'null'
        statement:
          type:
          - string
          - 'null'
        dateupdated:
          type:
          - string
          - 'null'
          format: date-time
        statement_date:
          type:
          - string
          - 'null'
          format: date-time
        addendum:
          type:
          - string
          - 'null'