The Vulnerabilities API from Tidelift — 2 operation(s) for vulnerabilities.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/tidelift:tidelift-vulnerabilities-api"curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
version: 1.2.1
title: Tidelift External Vulnerabilities API
x-logo:
url: /docs/assets/tidelift_logo.png
altText: Tidelift
license:
name: Proprietary
servers:
- url: https://api.tidelift.com/external-api
security:
- BearerAuth:
- user
- project
- organization
tags:
- name: Vulnerabilities
paths:
/v1/vulnerabilities/{vulnerability_id}:
get:
x-tidelift-api-meta:
product-area: intelligence-api
access-level: small
visibility: public
tags:
- Vulnerabilities
security:
- BearerAuth:
- user
- organization
operationId: getVulnerability
x-rails-controller: vulnerabilities#show
summary: Get a vulnerability
description: Get a vulnerability, along with any recommendation
parameters:
- $ref: '#/components/parameters/vulnerabilityIdParam'
responses:
'200':
description: The vulnerability with recommendations.
content:
application/json:
schema:
$ref: '#/components/schemas/Vulnerability'
'404':
$ref: '#/components/responses/404Error'
/v1/vulnerabilities/{vulnerability_id}/affected_releases:
get:
x-tidelift-api-meta:
product-area: intelligence-api
access-level: small
visibility: public
tags:
- Vulnerabilities
security:
- BearerAuth:
- user
- organization
operationId: getVulnerabilityAffectedReleases
x-rails-controller: vulnerabilities#affected_releases
summary: Get affected releases for a vulnerability
parameters:
- $ref: '#/components/parameters/vulnerabilityIdParam'
responses:
'200':
description: The vulnerability's affected releases.
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/PaginationEnvelope'
- type: object
additionalProperties: false
required:
- results
properties:
results:
type: array
items:
type: object
additionalProperties: false
required:
- platform
- name
- version
- purl
properties:
platform:
type: string
name:
type: string
purl:
type: string
version:
type:
- string
- 'null'
'404':
$ref: '#/components/responses/404Error'
components:
parameters:
vulnerabilityIdParam:
in: path
name: vulnerability_id
required: true
schema:
type: string
example:
- CVE-2021-44228
description: The id of the vulnerability.
schemas:
Vulnerability:
type: object
additionalProperties: false
required:
- vuln_id
- url
- nist_url
- description
- severity
- affected_packages
properties:
updated_at:
type: string
vuln_id:
type:
- string
- 'null'
url:
type:
- string
- 'null'
nist_url:
type:
- string
- 'null'
description:
type:
- string
- 'null'
cvss_score:
type:
- string
- 'null'
severity:
type:
- string
- 'null'
epss_percentile:
type:
- string
- 'null'
epss_probability:
type:
- string
- 'null'
epss_score:
type:
- string
- 'null'
known_exploited:
type: boolean
cwe_ids:
type: array
items:
type: string
affected_packages:
type: array
items:
type: object
additionalProperties: false
required:
- package
- platform
- name
- purl
- recommendation
- recommendation_details
- unaffected_versions
properties:
package:
type: string
platform:
type: string
name:
type: string
purl:
type: string
recommendation:
type: string
enum:
- ignore
- upgrade
- upgrade_or_workaround
recommendation_details:
type:
- object
- 'null'
required:
- id
- impact_score
- impact_description
- real_issue
- false_positive_reason
- includes_dev
- specific_methods_affected
- specific_methods_description
- other_conditions
- other_conditions_description
- workaround_available
- workaround_description
- created_at
- updated_at
properties:
id:
type: string
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
impact_score:
type:
- integer
- 'null'
description: When using this package as intended, how likely are users to be affected? A general score out of 10.
impact_description:
type:
- string
- 'null'
description: Detailed explanation of the impact score.
includes_dev:
type:
- boolean
- 'null'
description: Does this vulnerability apply when the package is only used within a Development or CI environment?
other_conditions:
type:
- boolean
- 'null'
description: Are there any other conditions that users should check for to determine if they're vulnerable?
other_conditions_description:
type:
- string
- 'null'
description: Detailed explanation of the other conditions result.
workaround_available:
type:
- boolean
- 'null'
description: For users who are unable to upgrade to a supported release, is there a workaround available?
workaround_description:
type:
- string
- 'null'
description: Detailed explanation of the workaround.
specific_methods_affected:
type:
- boolean
- 'null'
description: Does this vulnerability apply only if certain methods, classes, or functionality are in use?
specific_methods_description:
type:
- string
- 'null'
description: Detailed explanation of the specific methods result.
real_issue:
type: boolean
description: Is this a real vulnerability or a false positive?
false_positive_reason:
type:
- string
- 'null'
description: Detailed explanation of the false positive result.
affected_versions:
type: array
items:
type: string
unaffected_versions:
type:
- string
- 'null'
PaginationEnvelope:
type: object
required:
- current_page
- next_page
- prev_page
- total_pages
- total_count
- per_page
properties:
current_page:
type: integer
next_page:
type:
- integer
- 'null'
prev_page:
type:
- integer
- 'null'
total_pages:
type: integer
total_count:
type: integer
per_page:
type: integer
StandardError:
description: The standard error format
type: object
required:
- error
- message
properties:
error:
type: string
description: An error code representing the error
example: an_error_code
message:
type: string
description: A human-readable error message representing the error
example: An error message.
details:
type: object
description: An optional object with extra helpful details about the error.
example:
errors:
name: is not a valid email.
responses:
404Error:
description: Record Not Found
content:
application/json:
schema:
$ref: '#/components/schemas/StandardError'
securitySchemes:
BearerAuth:
type: http
scheme: bearer
x-provenance:
method: harvested
publisher: Tidelift
source: https://tidelift.com/api/depci/subscriber-api.json
note: split by refine-openapis from the provider's own published document, verified by fetch (openapi/_original/*.fetch.json);
stamped by stamp-openapi-provenance.py (roadmap#793)