WritersLogic Verifiable AI Agent Hub Cra Exploit Clock API
The Cra Exploit Clock API from WritersLogic Verifiable AI Agent Hub — 1 operation(s) for cra exploit clock.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/writerslogic-com:writerslogic-com-cra-exploit-clock-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: WritersLogic Verifiable AI Agent Hub Cra Exploit Clock API
version: 2.0.0
description: Pay-per-call agents settled in USDC on Base via x402. Every response carries a signed provenance envelope.
contact:
name: WritersLogic
url: https://writerslogic.com/agents
email: agents@writerslogic.com
servers:
- url: https://agents.writerslogic.com
tags:
- name: Cra Exploit Clock
paths:
/api/v1/cra-exploit-clock:
post:
operationId: cra_exploit_clock
summary: CRA Exploited-Vulnerability Evidence and Art. 14 Deadline Clock
description: 'Takes a CycloneDX or SPDX JSON SBOM (or a purl list), asks OSV.dev for the advisories that affect each exact component version (OSV evaluates the version ranges per ecosystem), then checks each CVE against the CISA Known Exploited Vulnerabilities catalog and the ENISA EUVD exploited-vulnerability index, and adds FIRST EPSS scores. Returns a per-component verdict, the evidence with source URLs and SHA-256 digests, and the Regulation (EU) 2024/2847 Article 14(2) dates computed in UTC from the awareness time and fix time you supply: early warning within 24 h, notification within 72 h, final report 14 days after a corrective or mitigating measure is available. Also drafts Art. 14(2) content from quoted feed text. Reports evidence and arithmetic, not a legal conclusion. Not legal advice: whether a vulnerability is actively exploited, when you became aware, and what to notify are your determination. A separate standalone awareness record is added only when issue_record is true; every response is in any case a hub-signed credential over its output and input digests. Fan-out is capped (1000 components, 120 advisory records); EUVD is checked per CVE up to 20 CVEs and above that by one read of its whole exploited list; partial results name what is missing. Deterministic, no model call.
Price: 2.00 USDC on Base (x402).'
x-x402-price-usdc: '2.00'
x-x402-amount: '2000000'
x-payment-info:
protocols:
- x402
price:
mode: fixed
currency: USD
amount: '2.00'
x-audience: developer
x-sample-url: https://agents.writerslogic.com/api/v1/samples/cra-exploit-clock
security:
- x402: []
- apiKey: []
requestBody:
required: true
content:
application/json:
schema:
type: object
additionalProperties: false
properties:
sbom:
description: 'CycloneDX 1.4-1.6 or SPDX 2.2/2.3 JSON SBOM, as an object or a JSON string, up to 5 MB. Components need a purl with a version (SPDX: a purl externalRef). Exactly one of sbom or purls.'
anyOf:
- type: object
- type: string
maxLength: 5000000
purls:
type: array
maxItems: 1000
items:
type: string
minLength: 8
maxLength: 400
description: 'Alternative to sbom: versioned package URLs, e.g. pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1. Ecosystems: npm, pypi, maven, golang, cargo, nuget, gem, composer, hex, pub, swift.'
product:
type: object
additionalProperties: false
required:
- name
description: Your product with digital elements; used only to fill the draft fields (defaults to the SBOM's own product name).
properties:
name:
type: string
minLength: 1
maxLength: 200
version:
type: string
maxLength: 100
awareness_time:
type: string
maxLength: 40
description: When the manufacturer became aware, ISO 8601 with UTC offset (e.g. 2026-11-04T09:30:00Z). Defaults to now. Taken as given; this agent cannot verify it.
fix_available_at:
type: string
maxLength: 40
description: When a corrective or mitigating measure became available, ISO 8601 with UTC offset; sets the Art. 14(2)(c) final-report date.
issue_record:
type: boolean
description: Default false. When true, adds a standalone awareness_record (evidence snapshot, SBOM digest, evaluation time; signed with the hub attestation key when configured) for you to retain. It does not switch off the hub's standard signed response credential, which every response carries and which already binds the output and input digests to a timestamp.
example:
sbom:
bomFormat: CycloneDX
specVersion: '1.5'
version: 1
metadata:
component:
type: application
name: acme-gateway
version: 3.2.0
components:
- type: library
bom-ref: log4j-core
group: org.apache.logging.log4j
name: log4j-core
version: 2.14.1
purl: pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1
- type: library
bom-ref: lodash
name: lodash
version: 4.17.15
purl: pkg:npm/lodash@4.17.15
- type: library
bom-ref: left-pad
name: left-pad
version: 1.3.0
purl: pkg:npm/left-pad@1.3.0
product:
name: acme-gateway
version: 3.2.0
responses:
'200':
description: Paid result with provenance
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
verdict:
type: string
enum:
- EXPLOITED_CANDIDATES_FOUND
- NO_EXPLOITED_EVIDENCE
- INSUFFICIENT_EVIDENCE
description: NO_EXPLOITED_EVIDENCE only when every SBOM entry was fully checked.
confidence:
type: object
description: '{score 0-1, label}: 0.95 with a CISA KEV listing, 0.85 EUVD only, 0.9 for absence, else 0.5 times the share of entries with a definitive answer.'
exposure:
type: object
description: 'Art. 64(2) fine ceiling for breaching Art. 13/14: EUR 15 000 000 or 2.5% of worldwide turnover, whichever is higher. A ceiling, not an estimate.'
next_step:
type: object
description: '{code: ASSESS_AND_SUBMIT_EARLY_WARNING | RESOLVE_EVIDENCE_GAPS | MONITOR_FEEDS, by, detail}.'
top_evidence:
type: array
items:
type: object
description: 'Up to 5 exploited CVEs, each with the sources behind it: {cve, component, sources[{source, url, sha256}]}. The sha256 is of the response body fetched from that url.'
summary:
type: string
not_legal_advice:
type: string
description: 'Caveat: evidence and arithmetic only; the ''actively exploited'' and ''aware'' determinations are the manufacturer''s.'
awareness:
type: object
description: '{time, source: caller | evaluation_time, attested, note}. A caller-supplied time is never attested unless issue_record is true, and even then it is recorded as caller-asserted.'
deadlines:
type: object
description: early_warning_due (+24 h), notification_due (+72 h), final_report_due (fix_available_at + 14 days, or null), hours remaining at evaluation, applies (exploitation evidence found and awareness on or after the 2026-09-11 application date of Art. 14, Art. 71(2)), and legal_basis citing Regulation (EU) 2024/2847 Art. 14(2) with the source URL.
sbom:
type: object
description: format, spec_version, sha256, bytes, entries, evaluated, skipped[{ref, name, reason}].
counts:
type: object
description: Entries per component verdict.
exploited_vulnerabilities:
type: array
items:
type: object
description: 'Per CVE: components, kev entry (date_added, ransomware use), euvd record (id, exploited_since, url), epss, earliest_exploitation_evidence_date, osv_advisories with URLs.'
components:
type: array
items:
type: object
description: 'Per entry: purl, verdict (EXPLOITED_REPORTABLE_CANDIDATE | KNOWN_VULN_NOT_EXPLOITED | NO_MATCH | INSUFFICIENT_EVIDENCE), affected_range_match (OSV_AFFECTED | OSV_NOT_AFFECTED | NOT_EVALUATED), advisories[], kev, kev_date_added, epss, euvd_exploited, evidence_gaps. Skipped entries carry reason instead.'
art14_draft_fields:
type: array
items:
type: object
description: Draft Art. 14(2)(a)-(c) content per exploited CVE, quoted from feed text with source URLs; a draft, never a filing.
feed_snapshots:
type: object
description: KEV catalog version and release date, EPSS score date, EUVD and OSV query times.
sources:
type: array
items:
type: object
description: 'Per feed: url, status, requests, sha256 (a single response body, or a digest over every request''s url and hash), fetched_at, errors.'
coverage:
type: object
description: complete, missing[], upstream_calls, elapsed_ms. Partial results name what is missing.
awareness_record:
anyOf:
- type: object
description: 'Null unless issue_record is true (the response credential is signed regardless). When present: evaluated_at, awareness_time and its source, sbom_sha256, exploited CVEs, feed snapshots, source digests, digest_sha256 and an optional signature.'
- type: 'null'
_provenance:
type: object
description: C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance
required:
- data
- _provenance
'400':
description: Invalid request (no payment consumed)
content:
application/json:
schema:
type: object
properties:
error:
type: string
code:
type: string
'401':
description: Invalid X-API-KEY
content:
application/json:
schema:
type: object
properties:
error:
type: string
code:
type: string
'402':
description: Payment required or invalid
content:
application/json:
schema:
type: object
description: x402 v2 PaymentRequired (also base64 in the PAYMENT-REQUIRED header)
properties:
x402Version:
type: integer
error:
type: string
code:
type: string
resource:
type: object
accepts:
type: array
items:
type: object
extensions:
type: object
'502':
description: Upstream failure; the payment is released or not settled
content:
application/json:
schema:
type: object
properties:
error:
type: string
code:
type: string
tags:
- Cra Exploit Clock
components:
securitySchemes:
x402:
type: apiKey
in: header
name: PAYMENT-SIGNATURE
description: x402 v2 payment payload (base64) sent after a 402 challenge
apiKey:
type: apiKey
in: header
name: X-API-KEY