CVE Security Export API

openapi: 3.2.0
info:
  title: Cve Security Com Export API
  version: 1.9.1
  contact:
    url: https://cve-security.com/api
  license:
    name: 'Scoreboard data: CC BY 4.0. Underlying sources retain their own licenses (see /sources).'
    identifier: CC-BY-4.0
  description: 'Operations tagged Export across 2 of this provider''s published API definitions: cve-security-com-openapi.json, cve-security-com-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://cve-security.com
tags:
- name: Export
paths:
  /api/export/{file}:
    get:
      operationId: getBulkExport
      summary: Bulk catalog export (keyed, CC BY 4.0)
      description: 'The full served catalog as one gzipped JSONL, one object per non-withdrawn CVE with identity, scores (CVSS/EPSS), exploitation (KEV/ransomware), the four detection-content flags with Nuclei/Metasploit references, has_fix, exploit-code flags, tier and description snippet. Rebuilt nightly from the same computations /metrics publishes, so the export cannot disagree with the site. Fetch manifest.json (tiny) first and compare sha256 before pulling the blob (~30 MB). Counts as one request against the key''s daily limit. The key is attribution, not a paywall, the data is CC BY 4.0. `?as_of=YYYY-MM-DD` (historical snapshots) is reserved for non-free tiers. New in 1.4.0: packages.jsonl.gz, the OSS package↔CVE mapping (one object per cve/ecosystem/package) with OSV version ranges verbatim (ranges[].fixed = upgrade targets; ranges[].affected_through = last vulnerable version, so upgrade past it), plus KEV/EPSS/severity per row; described by the same manifest.json under its `packages` key. New in 1.5.2: kcv-watch.jsonl.gz, the KCV Watch chain candidates of every tier (the site lists A and B; tier C is here and over /api/kcv-watch.json), one pair per line with the tier, bridge, grade, entry step, caption, both CVEs'' KEV, EPSS and publication facts and the extraction provenance; rebuilt nightly, described by its own data_exports pointer. New in 1.7.0: cvss_score, cvss_version and severity are the one score the catalog lists for the CVE, and cvss_source names who gave it (nvd, cna or the ADP''s short name); manifest fields_version moves to 5. New in 1.8.0: that score follows the tiered policy of the CVE record''s scores.best (the CNA when the CVE Program lists it as a vendor or open-source organization, then NVD, then CISA ADP, then any other CNA, then other ADPs).'
      security:
      - bearer: []
      - apiKey: []
      parameters:
      - name: file
        in: path
        required: true
        schema:
          type: string
          enum:
          - cves.jsonl.gz
          - manifest.json
      - name: as_of
        in: query
        schema:
          type: string
          pattern: ^\d{4}-\d{2}-\d{2}$
        description: Dated snapshot (non-free tiers); omit for latest
      responses:
        '200':
          description: The gzipped JSONL (application/gzip, X-Content-Sha256 header) or the manifest ({kind, as_of, generated, count, bytes, sha256, fields[], license, attribution, notes})
        '401':
          description: Missing or invalid key
        '403':
          description: Dated snapshot requested on the free tier
        '404':
          description: Unknown file or dated snapshot not held
        '429':
          description: Daily limit exhausted (resets 00:00 UTC)
        '503':
          description: Not published yet, or temporary datastore error
      tags:
      - Export
    servers:
    - url: https://cve-security.com
components:
  securitySchemes:
    bearer:
      type: http
      scheme: bearer
      description: 'Authorization: Bearer cvs_live_…'
    apiKey:
      type: apiKey
      in: header
      name: X-API-Key
      description: Alternative to the Authorization header. Keys are never accepted in query strings.
x-refined-from:
- cve-security-com-openapi.json
- cve-security-com-openapi.yml