Nuclei Vulnerability API

openapi: 3.1.0
info:
  title: PDCP agents Vulnerability API
  version: '1.0'
  summary: ProjectDiscovery Cloud Platform
  description: For more details, checkout https://docs.projectdiscovery.io/api-reference/editor/scan
servers:
- url: https://api.projectdiscovery.io
  description: Production
- url: https://api.dev.projectdiscovery.io
  description: Development
- url: http://localhost:8085
  description: Localhost
security:
- X-API-Key: []
tags:
- name: Vulnerability
paths:
  /v2/vulnerability/search:
    parameters: []
    get:
      summary: Full Text Search
      tags:
      - Vulnerability
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                  facets:
                    type: object
                    additionalProperties:
                      $ref: '#/components/schemas/Facets'
                  results:
                    type: array
                    items:
                      $ref: '#/components/schemas/Vulnerability'
                  total:
                    type: integer
        '400':
          $ref: '#/components/responses/ErrorResponse'
        '401':
          $ref: '#/components/responses/ErrorResponse'
        '403':
          $ref: '#/components/responses/ErrorResponse'
        '404':
          $ref: '#/components/responses/ErrorResponse'
        '500':
          $ref: '#/components/responses/ErrorResponse'
        default:
          $ref: '#/components/responses/ErrorResponse'
      operationId: get-v2-vulnerability-search
      description: Full text search on vulnerabilities
      parameters:
      - schema:
          type: integer
        in: query
        name: limit
        description: The numbers of items to return
      - schema:
          type: integer
        in: query
        name: offset
        description: The numbers of items to skip
      - schema:
          type: string
        in: query
        name: sort_asc
        description: Sort results in ascending order (CSV field names)
      - schema:
          type: string
        in: query
        name: sort_desc
        description: Sort results in descending order (CSV field names)
      - schema:
          items:
            type: string
          type: array
        in: query
        name: fields
        description: List of fields to return(comma separated)
      - schema:
          items:
            type: string
          type: array
        in: query
        name: term_facets
        description: List of fields to return(comma separated)
      - schema:
          items:
            type: string
          type: array
        in: query
        name: range_facets
        description: List of fields to return(comma separated)
      - schema:
          type: string
        in: query
        name: q
        description: query
      - schema:
          type: boolean
        in: query
        name: highlight
        description: Whether to highlight the search results
      - schema:
          type: integer
        in: query
        name: facet_size
        description: Number of facets to return
  /v2/vulnerability/{id}:
    parameters:
    - schema:
        type: string
      name: id
      in: path
      required: true
    get:
      summary: Get Vulnerability by ID
      tags:
      - Vulnerability
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Vulnerability'
        '400':
          $ref: '#/components/responses/ErrorResponse'
        '404':
          $ref: '#/components/responses/ErrorResponse'
        '500':
          $ref: '#/components/responses/ErrorResponse'
        default:
          $ref: '#/components/responses/ErrorResponse'
      operationId: get-vulnerability-by-id
      description: Get Vulnerability by ID
      parameters:
      - schema:
          type: string
        in: query
        name: fields
        description: 'template data fields '
  /v2/vulnerability/filters:
    parameters: []
    get:
      summary: Get All Filters for Vulnerabilities
      tags:
      - Vulnerability
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  properties:
                    can_sort:
                      description: Indicates if sorting is possible by this field.
                      type: boolean
                    data_type:
                      description: The data type of the filter field (e.g., string, number, datetime).
                      type: string
                    description:
                      description: A human-readable description of the filter field.
                      type: string
                    enum_values:
                      description: The possible values for this field.
                      items:
                        type: string
                      type: array
                    examples:
                      description: Example usage of the filter.
                      items:
                        type: string
                      type: array
                    facet_possible:
                      description: Indicates if faceting is possible for this field.
                      type: boolean
                    field:
                      description: The name of the filter field.
                      type: string
                    search_analyzer:
                      description: The search analyzer used for this field.
                      type: string
                  required:
                  - field
                  - data_type
                  - description
                  - facet_possible
                  - can_sort
                  - examples
                  - search_analyzer
                  - enum_values
                  type: object
                type: array
          description: OK
        '400':
          $ref: '#/components/responses/ErrorResponse'
        '404':
          $ref: '#/components/responses/ErrorResponse'
        '500':
          $ref: '#/components/responses/ErrorResponse'
        default:
          $ref: '#/components/responses/ErrorResponse'
      operationId: get-v2-vulnerability-filters
      description: Get all filters for vulnerabilities
  /v2/vulnerability/product/search:
    parameters: []
    get:
      summary: Search Products
      tags:
      - Vulnerability
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                  facets:
                    type: object
                    additionalProperties:
                      $ref: '#/components/schemas/Facets'
                  results:
                    type: array
                    items:
                      $ref: '#/components/schemas/Product'
                  total:
                    type: integer
        '400':
          $ref: '#/components/responses/ErrorResponse'
        '401':
          $ref: '#/components/responses/ErrorResponse'
        '403':
          $ref: '#/components/responses/ErrorResponse'
        '404':
          $ref: '#/components/responses/ErrorResponse'
        '500':
          $ref: '#/components/responses/ErrorResponse'
        default:
          $ref: '#/components/responses/ErrorResponse'
      operationId: get-v2-product-search
      description: Search products with filtering and faceting capabilities
      parameters:
      - schema:
          type: integer
        in: query
        name: limit
        description: The numbers of items to return
      - schema:
          type: integer
        in: query
        name: offset
        description: The numbers of items to skip
      - schema:
          type: string
        in: query
        name: sort_asc
        description: Sort results in ascending order (CSV field names)
      - schema:
          type: string
        in: query
        name: sort_desc
        description: Sort results in descending order (CSV field names)
      - schema:
          items:
            type: string
          type: array
        in: query
        name: fields
        description: List of fields to return(comma separated)
      - schema:
          items:
            type: string
          type: array
        in: query
        name: term_facets
        description: List of fields to return(comma separated)
      - schema:
          items:
            type: string
          type: array
        in: query
        name: range_facets
        description: List of fields to return(comma separated)
      - schema:
          type: string
        in: query
        name: q
        description: query
      - schema:
          type: boolean
        in: query
        name: highlight
        description: Whether to highlight the search results
      - schema:
          type: integer
        in: query
        name: facet_size
        description: Number of facets to return
  /v2/vulnerability/product/{id}:
    parameters:
    - schema:
        type: string
      name: id
      in: path
      required: true
    get:
      summary: Get Product by ID
      tags:
      - Vulnerability
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Product'
        '400':
          $ref: '#/components/responses/ErrorResponse'
        '404':
          $ref: '#/components/responses/ErrorResponse'
        '500':
          $ref: '#/components/responses/ErrorResponse'
        default:
          $ref: '#/components/responses/ErrorResponse'
      operationId: get-product-by-id
      description: Get Product by ID
      parameters:
      - schema:
          type: string
        in: query
        name: fields
        description: 'product data fields '
  /v2/vulnerability/product/{id}/vulns:
    parameters:
    - schema:
        type: string
      name: id
      in: path
      required: true
    get:
      summary: Get Vulnerabilities for Product
      tags:
      - Vulnerability
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                  facets:
                    type: object
                    additionalProperties:
                      $ref: '#/components/schemas/Facets'
                  results:
                    type: array
                    items:
                      $ref: '#/components/schemas/Vulnerability'
                  total:
                    type: integer
        '400':
          $ref: '#/components/responses/ErrorResponse'
        '404':
          $ref: '#/components/responses/ErrorResponse'
        '500':
          $ref: '#/components/responses/ErrorResponse'
        default:
          $ref: '#/components/responses/ErrorResponse'
      operationId: get-product-vulns
      description: Get vulnerabilities for a specific product
      parameters:
      - schema:
          type: integer
        in: query
        name: limit
        description: The numbers of items to return
      - schema:
          type: integer
        in: query
        name: offset
        description: The numbers of items to skip
      - schema:
          type: string
        in: query
        name: sort_asc
        description: Sort results in ascending order (CSV field names)
      - schema:
          type: string
        in: query
        name: sort_desc
        description: Sort results in descending order (CSV field names)
      - schema:
          items:
            type: string
          type: array
        in: query
        name: fields
        description: List of fields to return(comma separated)
      - schema:
          items:
            type: string
          type: array
        in: query
        name: term_facets
        description: List of fields to return(comma separated)
      - schema:
          items:
            type: string
          type: array
        in: query
        name: range_facets
        description: List of fields to return(comma separated)
      - schema:
          type: string
        in: query
        name: q
        description: query
      - schema:
          type: boolean
        in: query
        name: highlight
        description: Whether to highlight the search results
      - schema:
          type: integer
        in: query
        name: facet_size
        description: Number of facets to return
  /v2/vulnerability/product/{id}/timeline:
    parameters:
    - schema:
        type: string
      name: id
      in: path
      required: true
    get:
      summary: Get Vulnerability Timeline for Product
      tags:
      - Vulnerability
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                  facets:
                    type: object
                    additionalProperties:
                      $ref: '#/components/schemas/Facets'
                  results:
                    type: array
                    items:
                      $ref: '#/components/schemas/Vulnerability'
                  total:
                    type: integer
        '400':
          $ref: '#/components/responses/ErrorResponse'
        '404':
          $ref: '#/components/responses/ErrorResponse'
        '500':
          $ref: '#/components/responses/ErrorResponse'
        default:
          $ref: '#/components/responses/ErrorResponse'
      operationId: get-product-timeline
      description: Get vulnerability timeline for a specific product (sorted by cve_created_at descending)
      parameters:
      - schema:
          type: integer
        in: query
        name: limit
        description: The numbers of items to return
      - schema:
          type: integer
        in: query
        name: offset
        description: The numbers of items to skip
      - schema:
          type: string
        in: query
        name: sort_asc
        description: Sort results in ascending order (CSV field names)
      - schema:
          type: string
        in: query
        name: sort_desc
        description: Sort results in descending order (CSV field names)
      - schema:
          items:
            type: string
          type: array
        in: query
        name: fields
        description: List of fields to return(comma separated)
      - schema:
          items:
            type: string
          type: array
        in: query
        name: term_facets
        description: List of fields to return(comma separated)
      - schema:
          items:
            type: string
          type: array
        in: query
        name: range_facets
        description: List of fields to return(comma separated)
      - schema:
          type: string
        in: query
        name: q
        description: query
      - schema:
          type: boolean
        in: query
        name: highlight
        description: Whether to highlight the search results
      - schema:
          type: integer
        in: query
        name: facet_size
        description: Number of facets to return
  /v2/vulnerability/product/filters:
    parameters: []
    get:
      summary: Get All Filters for Products
      tags:
      - Vulnerability
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  properties:
                    can_sort:
                      description: Indicates if sorting is possible by this field.
                      type: boolean
                    data_type:
                      description: The data type of the filter field (e.g., string, number, datetime).
                      type: string
                    description:
                      description: A human-readable description of the filter field.
                      type: string
                    enum_values:
                      description: The possible values for this field.
                      items:
                        type: string
                      type: array
                    examples:
                      description: Example usage of the filter.
                      items:
                        type: string
                      type: array
                    facet_possible:
                      description: Indicates if faceting is possible for this field.
                      type: boolean
                    field:
                      description: The name of the filter field.
                      type: string
                    search_analyzer:
                      description: The search analyzer used for this field.
                      type: string
                  required:
                  - field
                  - data_type
                  - description
                  - facet_possible
                  - can_sort
                  - examples
                  - search_analyzer
                  - enum_values
                  type: object
                type: array
          description: OK
        '400':
          $ref: '#/components/responses/ErrorResponse'
        '404':
          $ref: '#/components/responses/ErrorResponse'
        '500':
          $ref: '#/components/responses/ErrorResponse'
        default:
          $ref: '#/components/responses/ErrorResponse'
      operationId: get-v2-product-filters
      description: Get all filters for products
  /v2/vulnerability/{id}/timeline:
    parameters:
    - schema:
        type: string
      name: id
      in: path
      required: true
    get:
      summary: Get Vulnerability Timeline
      tags:
      - Vulnerability
      parameters:
      - schema:
          type: array
          items:
            type: string
            enum:
            - detected
            - status_change
            - resolved
            - reopened
            - severity_change
            - template_released
            - template_updated
        name: event_type
        in: query
        required: false
        description: Filter by event types (comma-separated). If not provided, returns all events.
        style: form
        explode: false
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VulnTimelineResponse'
        '400':
          $ref: '#/components/responses/ErrorResponse'
        '404':
          $ref: '#/components/responses/ErrorResponse'
        '500':
          $ref: '#/components/responses/ErrorResponse'
        default:
          $ref: '#/components/responses/ErrorResponse'
      operationId: get-vulnerability-timeline
      description: Get timeline of events for a vulnerability including template release date, first detection, status changes, and severity changes
components:
  schemas:
    TemplateContent:
      title: TemplateContent
      type: object
      properties:
        author:
          type: array
          description: Authors of the template
          items:
            type: string
        digest:
          type: string
          description: Digest of the template
        metadata:
          type: object
          description: MetaData of the template
        raw:
          type: string
          description: Raw string of the template
        tags:
          type: array
          description: Tags of the template
          items:
            type: string
        type:
          type: string
          description: Type of the template
    TimelineEvent:
      title: TimelineEvent
      type: object
      required:
      - timestamp
      - event_type
      properties:
        timestamp:
          type: string
          format: date-time
        event_type:
          type: string
          description: Type of event (template_released, detected, status_change, severity_change, reopened)
        old_value:
          type: string
        new_value:
          type: string
        description:
          type: string
    Classification:
      description: Classification of template including additional metadata like cve-id, cwe-id etc
      type: object
      properties:
        cve-id:
          type: array
          items:
            type: string
          description: CVE IDs for the template
        cwe-id:
          type: array
          items:
            type: string
          description: CWE IDs for the template
        cvss-metrics:
          type: string
          description: CVSS Metrics for the template
        cvss-score:
          type: number
          format: float
          description: CVSS Score for the template
        epss-score:
          type: number
          format: float
          description: EPSS Score for the template
        epss-percentile:
          type: number
          format: float
          description: EPSS Percentile for the template
        cpe:
          type: string
          description: CPE for the template
    ProductInfo:
      title: ProductInfo
      type: object
      properties:
        cpe:
          description: CPE of the product
          type: array
          items:
            type: string
        product:
          description: Product of the product
          type: string
        project_repos:
          type: object
        projects:
          description: Projects of the product
          type: array
          items:
            type: string
        vendor:
          description: Vendor of the product
          type: string
        product_category:
          type: string
        product_type:
          type: string
        industry:
          description: Industry of the product
          type: string
        tech_domain:
          description: Tech domain of the product
          type: string
        category:
          description: Product category of the product
          type: string
        deployment_model:
          description: Deployment model of the product
          type: string
        summary:
          description: Summary of the product
          type: string
    Facets:
      title: Facets
      type: object
      properties:
        buckets:
          type: object
          additionalProperties:
            type: integer
        missing:
          type: integer
        others:
          type: integer
        total:
          type: integer
    VulnExposure:
      additionalProperties: false
      title: VulnExposure
      type: object
      properties:
        max_hosts:
          description: Maximum number of hosts for the vulnerability
          type: integer
        min_hosts:
          description: Minimum number of hosts for the vulnerability
          type: integer
        values:
          description: Values of the vulnerability
          type: array
          items:
            $ref: '#/components/schemas/ExposureStats'
    NucleiTemplate:
      additionalProperties: false
      allOf:
      - $ref: '#/components/schemas/TemplateSourceMeta'
      - $ref: '#/components/schemas/TemplateStatus'
      - $ref: '#/components/schemas/TemplateFileMeta'
      - $ref: '#/components/schemas/TemplateContent'
      - $ref: '#/components/schemas/TemplateSharingMetadata'
      - properties:
          ai_meta:
            $ref: '#/components/schemas/AIMeta'
            description: AI Meta of the template
          classification:
            $ref: '#/components/schemas/Classification'
            description: Classification of the template
          id:
            description: ID of the template
            type: string
          user_id:
            description: User ID of the template
            type: integer
        type: object
      type: object
    CVEInfo:
      additionalProperties: false
      properties:
        age_in_days:
          description: Age in days for the cve
          type: integer
        assignee:
          description: Assignee for the cve
          type: string
        cve_created_at:
          description: Created at date for the cve
          format: date-time
          type: string
        cve_id:
          description: CVE ID for the cve
          type: string
        cve_updated_at:
          description: Updated at date for the cve
          format: date-time
          type: string
        cvss_metrics:
          description: CVSS Metrics for the cve
          example: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
          type: string
        cvss_score:
          description: CVSS Score for the cve
          example: 9.8
          format: double
          type: number
        epss_percentile:
          description: EPSS Percentile for the template.
          example: 0.42509
          format: double
          type: number
        epss_score:
          description: EPSS Score for the template.
          example: 0.42509
          format: double
          type: number
        is_kev:
          description: True if the cve is a kev
          type: boolean
        is_vkev:
          description: True if the cve is a vkev
          type: boolean
        is_oss:
          description: True if the cve is an oss cve
          type: boolean
        is_patch_available:
          description: True if the cve has a patch available
          type: boolean
        is_poc:
          description: True if the cve has a poc
          type: boolean
        is_remote:
          description: True if the cve is a remote cve
          type: boolean
        is_template:
          description: True if the cve has a template
          type: boolean
        kev:
          description: KEV info for the cve
          items:
            $ref: '#/components/schemas/KevInfo'
          type: array
        poc_count:
          description: Count of pocs for the vulnerability
          type: integer
        pocs:
          description: Contains all known proof of concepts for the vulnerability
          items:
            $ref: '#/components/schemas/POC'
          type: array
        nuclei_template:
          description: Raw nuclei template content
          type: string
        is_auth:
          description: True if the CVE is an authenticated CVE
          type: boolean
        is_exploit_seen:
          description: True if the CVE has been exploited in the wild
          type: boolean
        poc_first_seen:
          description: First seen date for the poc
          format: date-time
          type: string
        vuln_status:
          description: Status of the cve
          type: string
      type: object
    H1Stats:
      additionalProperties: false
      title: H1Stats
      type: object
      properties:
        delta_rank:
          description: Rank delta from previous day
          type: integer
        delta_reports:
          description: Reports delta from previous day
          type: integer
        rank:
          description: Rank of CVE in Hackerone
          type: integer
        reports:
          description: Number of reports for CVE
          type: integer
    Product:
      type: object
      required:
      - doc_id
      - vuln_count
      - kev_count
      - vulns_with_poc
      - product
      - vendor
      properties:
        category:
          description: Product category
          type: string
        cpe:
          description: List of CPEs for this product
          type: array
          items:
            type: string
        deployment_model:
          description: Product deployment model
          type: string
        doc_id:
          description: Unique document ID in the form vendor:product
          type: string
        exposure:
          $ref: '#/components/schemas/ExposureStats'
        first_cve_created_at:
          description: Date when the earliest CVE was processed for this product
          type: string
          format: date-time
        industry:
          description: Product industry
          type: string
        kev_count:
          description: Number of KEV vulnerabilities for this product
          type: integer
        last_cve_created_at:
          description: Date when the most recent CVE was processed for this product
          type: string
          format: date-time
        product:
          description: Product name
          type: string
        project_repos:
          description: List of repository info for this product
          type: array
          items:
            type: object
            additionalProperties: true
        projects:
          description: List of project URLs for this product
          type: array
          items:
            type: string
        score:
          description: Impact score based on available parameters mainly used for sorting
          type: number
        summary:
          description: Product summary
          type: string
        tech_domain:
          description: Product tech domain
          type: string
        vendor:
          description: Vendor name
          type: string
        vulnerability_count:
          description: Total number of vulnerabilities for this product
          type: integer
        vulnerability_max_cvss:
          description: Maximum CVSS score among vulnerabilities
          type: number
          format: double
        vulnerability_mean_cvss:
          description: Mean CVSS score among vulnerabilities
          type: number
          format: double
        vulnerability_poc_count:
          description: Number of vulnerabilities with PoC for this product
          type: integer
        vulnerability_stat_counts:
          description: Vulnerability statistics by type
          type: object
          additionalProperties:
            type: integer
        severities:
          description: Map of severity -> count for vulnerabilities
          type: object
          additionalProperties:
            type: integer
        vuln_count:
          description: Total number of vulnerabilities for this product
          type: integer
        vuln_impact_breakdown:
          description: Map of vulnerability_impact -> count for vulnerabilities (flattened array)
          type: object
          additionalProperties:
            type: integer
        vuln_statuses:
          description: Map of vuln_status -> count for vulnerabilities
          type: object
          additionalProperties:
            type: integer
        vuln_types:
          description: Map of vulnerability_type -> count for vulnerabilities
          type: object
          additionalProperties:
            type: integer
        vulns_with_poc:
          description: Number of vulnerabilities with PoC for this product
          type: integer
    TemplateSharingMetadata:
      properties:
        organizations:
          description: Organizations of the template
          items:
            type: string
          type: array
        origin_template_id:
          description: Origin template ID of the template
          type: string
        share_type:
          description: Share type of the template
          type: string
        ttl:
          description: TTL of the template
          type: string
        ttl_from:
          description: TTL from of the template
          type: string
        users:
          description: Users of the template
          items:
            type: integer
          type: array
      type: object
    Citation:
      additionalProperties: false
      title: Citation
      type: object
      properties:
        source:
          type: string
          description: Source for the citation
        tags:
          type: array
          description: Tags for the citation
          items:
            type: string
        url:
          type: string
          description: URL for the citation
        added_at:
          description: Added at date for the citation
          format: date-time
          type: string
    VulnerabilityInfo:
      additionalProperties: false
      allOf:
      - $ref: '#/components/schemas/CVEI

# --- truncated at 32 KB (40 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/nuclei/refs/heads/main/openapi/nuclei-vulnerability-api-openapi.yml