CVE Security Updates API

openapi: 3.2.0
info:
  title: Cve Security Com Updates API
  version: 1.9.1
  contact:
    url: https://cve-security.com/api
  license:
    name: 'Scoreboard data: CC BY 4.0. Underlying sources retain their own licenses (see /sources).'
    identifier: CC-BY-4.0
  description: 'Operations tagged Updates across 2 of this provider''s published API definitions: cve-security-com-openapi.json, cve-security-com-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://cve-security.com
tags:
- name: Updates
paths:
  /api/updates:
    get:
      operationId: listUpdates
      summary: Publication change stream (keyed, cursorable)
      description: 'Every event this site published, in the order WE published it: first_published (CVE newly tracked), kev_added, detection_added (first ET/Snort signature), remediation_added (first vendor fix). Walk forward with `cursor` from each response''s next_cursor; `since` is first-call convenience with strictly-after semantics. published_at is this site''s publish time (rows before 2026-07-26 are day-granular; a bare-date `since` therefore excludes that day''s legacy day-bucket rows); source_date is the origin date (NVD/CISA/detection) for context. Events for withdrawn CVE identifiers are omitted. Keyed: this stream is an integration surface, so it uses the same free account key as /api/cve/{id} and counts against the daily limit. The same stream without a key: the MCP get_updates tool (AI agents) and the Atom feeds /feeds/updates.xml + /feeds/updates/{new-cves|kev|detection|remediation}.xml (newest-100 window for feed readers). Per-IP rate limited (30/min).'
      security:
      - bearer: []
      - apiKey: []
      parameters:
      - name: cursor
        in: query
        schema:
          type: string
        description: Opaque position from a previous response's next_cursor. Mutually exclusive with since.
      - name: since
        in: query
        schema:
          type: string
        example: '2026-07-20'
        description: YYYY-MM-DD or YYYY-MM-DDTHH:MM:SSZ (UTC), strictly-after
      - name: type
        in: query
        schema:
          type: string
          enum:
          - first_published
          - kev_added
          - detection_added
          - remediation_added
      - name: limit
        in: query
        schema:
          type: integer
          minimum: 1
          maximum: 200
          default: 100
      responses:
        '200':
          description: '{ as_of, events[], next_cursor, has_more }, each event: id, cve_id, change_type, published_at, source_date, detail, severity, kev_listed, url. as_of is the stream''s newest publish stamp; hold next_cursor and re-poll to tail the stream.'
          content:
            application/json:
              schema:
                type: object
        '400':
          description: Malformed cursor/since/type, or cursor and since together
        '401':
          description: Missing or invalid key
        '429':
          description: IP rate limit or daily key limit (Retry-After / X-RateLimit-* headers)
        '503':
          description: Stream unavailable, an outage, NOT 'no updates'
      tags:
      - Updates
    servers:
    - url: https://cve-security.com
components:
  securitySchemes:
    bearer:
      type: http
      scheme: bearer
      description: 'Authorization: Bearer cvs_live_…'
    apiKey:
      type: apiKey
      in: header
      name: X-API-Key
      description: Alternative to the Authorization header. Keys are never accepted in query strings.
x-refined-from:
- cve-security-com-openapi.json
- cve-security-com-openapi.yml