CVE Security Chains.json API

openapi: 3.2.0
info:
  title: Cve Security Com Chains.json API
  version: 1.9.1
  contact:
    url: https://cve-security.com/api
  license:
    name: 'Scoreboard data: CC BY 4.0. Underlying sources retain their own licenses (see /sources).'
    identifier: CC-BY-4.0
  description: 'Operations tagged Chains.json across 2 of this provider''s published API definitions: cve-security-com-openapi.json, cve-security-com-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://cve-security.com
tags:
- name: Chains.json
paths:
  /api/chains.json:
    get:
      operationId: getChains
      summary: 'Known chained pairs: CVEs a cited source reports were used together'
      description: 'Pairs of CVEs that a cited source reports were used together in one exploit chain (VulnCheck KEV entry text, Metasploit modules, SigmaHQ rules, press or research sentences, exploit code read by a model, community text judged by a local model), newest first. Every row carries both CVEs with their CISA KEV status, the claim kind (observed or potential), the quoted evidence with its source, URL and date, and community discussion counts. Keyed; private-cacheable for 900s. Data attribution: VulnCheck KEV (community); Metasploit Framework; SigmaHQ.'
      security:
      - bearerAuth: []
      - apiKey: []
      parameters:
      - in: query
        name: source
        schema:
          type: string
          enum:
          - vulncheck_kev
          - metasploit
          - sigma
          - press
          - research
          - academic
          - community
          - github_poc
          - exploitdb
          - exploit_code
        description: Evidence lane
      - in: query
        name: since
        schema:
          type: string
          format: date
        description: Pairs first seen on or after this day
      - in: query
        name: claim
        schema:
          type: string
          enum:
          - observed
          - potential
        description: 'observed: the source reports attacks that chained them; potential: the source reports they can be chained'
      - in: query
        name: limit
        schema:
          type: integer
          minimum: 1
          maximum: 500
          default: 100
      responses:
        '200':
          description: '{ generated, source, since, claim, count, attribution[], note, rates, rows: [{cve_a, cve_a_url, cve_a_kev, cve_b, cve_b_url, cve_b_kev, claim_kind, claim_label, lanes[], first_seen, first_date, evidence: [{source, source_label, source_url, source_title, date, quote, claim_kind, observed_basis, support, code_summary}], discussed}] }. The evidence of an observed pair lists the sources that report the attack first; observed_basis says where a row states the attack (quote, context or source) and support holds the sentence when the quote alone does not state it. On a row of exploit code, code_summary {text, url, label} says in our words which CVEs the exploit uses and links to the file.'
        '401':
          description: Missing or invalid key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '503':
          description: Known chains have not been built yet
      tags:
      - Chains.json
    servers:
    - url: https://cve-security.com
components:
  schemas:
    Error:
      type: object
      properties:
        error:
          type: string
        detail:
          type: string
      required:
      - error
  securitySchemes:
    bearer:
      type: http
      scheme: bearer
      description: 'Authorization: Bearer cvs_live_…'
    apiKey:
      type: apiKey
      in: header
      name: X-API-Key
      description: Alternative to the Authorization header. Keys are never accepted in query strings.
x-refined-from:
- cve-security-com-openapi.json
- cve-security-com-openapi.yml