{ "openapi": "3.1.0", "info": { "title": "OffSeq Threat Radar API", "version": "1.0.0", "description": "Threat intelligence, package matching and SBOM scanning. Every endpoint needs an API key from Console → Settings, sent as X-API-Key (or Authorization: Bearer). Limits per plan: https://radar.offseq.com/pricing. Guide: https://radar.offseq.com/api-docs. MCP server (JSON-RPC over Streamable HTTP, same key and quota): https://radar.offseq.com/mcp, documented at https://radar.offseq.com/api-docs?tab=mcp", "contact": { "name": "OffSeq Radar", "email": "radar@offseq.com", "url": "https://radar.offseq.com/api-docs" } }, "servers": [ { "url": "https://radar.offseq.com/api/v1" } ], "security": [ { "ApiKey": [] }, { "Bearer": [] } ], "tags": [ { "name": "Threats", "description": "Search and read the threat corpus." }, { "name": "Match", "description": "Version-aware package matching by purl, CPE or name + ecosystem." }, { "name": "Prioritize", "description": "Patch order for a set of CVEs, with the reason for each position." }, { "name": "Scan", "description": "SBOM and lockfile scanning for CI." }, { "name": "Inventory", "description": "Host inventories under continuous monitoring." }, { "name": "Decisions", "description": "Decision ledger: verdicts on CVEs with re-checked assumptions, calibration and VEX export." } ], "paths": { "/threats": { "get": { "tags": [ "Threats" ], "operationId": "listThreats", "summary": "List threats with filters and pagination", "description": "Unknown parameters are listed in the X-Unknown-Params header; soft problems in X-Warnings.", "parameters": [ { "$ref": "#/components/parameters/filter_search" }, { "$ref": "#/components/parameters/filter_q" }, { "$ref": "#/components/parameters/filter_type" }, { "$ref": "#/components/parameters/filter_types" }, { "$ref": "#/components/parameters/filter_severity" }, { "$ref": "#/components/parameters/filter_severities" }, { "$ref": "#/components/parameters/filter_cve" }, { "$ref": "#/components/parameters/filter_cveId" }, { "$ref": "#/components/parameters/filter_cwe" }, { "$ref": "#/components/parameters/filter_cwes" }, { "$ref": "#/components/parameters/filter_product" }, { "$ref": "#/components/parameters/filter_products" }, { "$ref": "#/components/parameters/filter_vendor" }, { "$ref": "#/components/parameters/filter_vendorProject" }, { "$ref": "#/components/parameters/filter_vendors" }, { "$ref": "#/components/parameters/filter_affectedVersions" }, { "$ref": "#/components/parameters/filter_affectedVersion" }, { "$ref": "#/components/parameters/filter_version" }, { "$ref": "#/components/parameters/filter_versions" }, { "$ref": "#/components/parameters/filter_purl" }, { "$ref": "#/components/parameters/filter_cpe" }, { "$ref": "#/components/parameters/filter_ecosystem" }, { "$ref": "#/components/parameters/filter_packageName" }, { "$ref": "#/components/parameters/filter_country" }, { "$ref": "#/components/parameters/filter_countries" }, { "$ref": "#/components/parameters/filter_source" }, { "$ref": "#/components/parameters/filter_sources" }, { "$ref": "#/components/parameters/filter_tag" }, { "$ref": "#/components/parameters/filter_tags" }, { "$ref": "#/components/parameters/filter_hasExploits" }, { "$ref": "#/components/parameters/filter_exploited" }, { "$ref": "#/components/parameters/filter_hasPatch" }, { "$ref": "#/components/parameters/filter_patched" }, { "$ref": "#/components/parameters/filter_kev" }, { "$ref": "#/components/parameters/filter_cisaKev" }, { "$ref": "#/components/parameters/filter_mirageExploited" }, { "$ref": "#/components/parameters/filter_observedInWild" }, { "$ref": "#/components/parameters/filter_ransomware" }, { "$ref": "#/components/parameters/filter_publicExploit" }, { "$ref": "#/components/parameters/filter_exploitMaturity" }, { "$ref": "#/components/parameters/filter_euvdExploited" }, { "$ref": "#/components/parameters/filter_exploitedNotInKev" }, { "$ref": "#/components/parameters/filter_epssRising" }, { "$ref": "#/components/parameters/filter_minPriority" }, { "$ref": "#/components/parameters/filter_includeArchived" }, { "$ref": "#/components/parameters/filter_minEpss" }, { "$ref": "#/components/parameters/filter_maxEpss" }, { "$ref": "#/components/parameters/filter_epssRange" }, { "$ref": "#/components/parameters/filter_minPercentile" }, { "$ref": "#/components/parameters/filter_maxPercentile" }, { "$ref": "#/components/parameters/filter_publishedAfter" }, { "$ref": "#/components/parameters/filter_startDate" }, { "$ref": "#/components/parameters/filter_from" }, { "$ref": "#/components/parameters/filter_publishedBefore" }, { "$ref": "#/components/parameters/filter_endDate" }, { "$ref": "#/components/parameters/filter_to" }, { "$ref": "#/components/parameters/filter_days" }, { "$ref": "#/components/parameters/filter_minCvss" }, { "$ref": "#/components/parameters/filter_maxCvss" }, { "$ref": "#/components/parameters/filter_fuzzy" }, { "$ref": "#/components/parameters/filter_sort" }, { "$ref": "#/components/parameters/filter_order" }, { "$ref": "#/components/parameters/page" }, { "$ref": "#/components/parameters/limit" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "type": "object", "properties": { "threats": { "type": "array", "items": { "$ref": "#/components/schemas/Threat" } }, "pagination": { "$ref": "#/components/schemas/Pagination" } } }, "meta": { "$ref": "#/components/schemas/Meta" } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/threats/search": { "get": { "tags": [ "Threats" ], "operationId": "searchThreats", "summary": "Search threats (q required)", "description": "Same filters as GET /threats; q (or search) is required. Flat response without pagination.", "parameters": [ { "$ref": "#/components/parameters/filter_search" }, { "$ref": "#/components/parameters/filter_q" }, { "$ref": "#/components/parameters/filter_type" }, { "$ref": "#/components/parameters/filter_types" }, { "$ref": "#/components/parameters/filter_severity" }, { "$ref": "#/components/parameters/filter_severities" }, { "$ref": "#/components/parameters/filter_cve" }, { "$ref": "#/components/parameters/filter_cveId" }, { "$ref": "#/components/parameters/filter_cwe" }, { "$ref": "#/components/parameters/filter_cwes" }, { "$ref": "#/components/parameters/filter_product" }, { "$ref": "#/components/parameters/filter_products" }, { "$ref": "#/components/parameters/filter_vendor" }, { "$ref": "#/components/parameters/filter_vendorProject" }, { "$ref": "#/components/parameters/filter_vendors" }, { "$ref": "#/components/parameters/filter_affectedVersions" }, { "$ref": "#/components/parameters/filter_affectedVersion" }, { "$ref": "#/components/parameters/filter_version" }, { "$ref": "#/components/parameters/filter_versions" }, { "$ref": "#/components/parameters/filter_purl" }, { "$ref": "#/components/parameters/filter_cpe" }, { "$ref": "#/components/parameters/filter_ecosystem" }, { "$ref": "#/components/parameters/filter_packageName" }, { "$ref": "#/components/parameters/filter_country" }, { "$ref": "#/components/parameters/filter_countries" }, { "$ref": "#/components/parameters/filter_source" }, { "$ref": "#/components/parameters/filter_sources" }, { "$ref": "#/components/parameters/filter_tag" }, { "$ref": "#/components/parameters/filter_tags" }, { "$ref": "#/components/parameters/filter_hasExploits" }, { "$ref": "#/components/parameters/filter_exploited" }, { "$ref": "#/components/parameters/filter_hasPatch" }, { "$ref": "#/components/parameters/filter_patched" }, { "$ref": "#/components/parameters/filter_kev" }, { "$ref": "#/components/parameters/filter_cisaKev" }, { "$ref": "#/components/parameters/filter_mirageExploited" }, { "$ref": "#/components/parameters/filter_observedInWild" }, { "$ref": "#/components/parameters/filter_ransomware" }, { "$ref": "#/components/parameters/filter_includeArchived" }, { "$ref": "#/components/parameters/filter_minEpss" }, { "$ref": "#/components/parameters/filter_maxEpss" }, { "$ref": "#/components/parameters/filter_epssRange" }, { "$ref": "#/components/parameters/filter_minPercentile" }, { "$ref": "#/components/parameters/filter_maxPercentile" }, { "$ref": "#/components/parameters/filter_publishedAfter" }, { "$ref": "#/components/parameters/filter_startDate" }, { "$ref": "#/components/parameters/filter_from" }, { "$ref": "#/components/parameters/filter_publishedBefore" }, { "$ref": "#/components/parameters/filter_endDate" }, { "$ref": "#/components/parameters/filter_to" }, { "$ref": "#/components/parameters/filter_days" }, { "$ref": "#/components/parameters/filter_minCvss" }, { "$ref": "#/components/parameters/filter_maxCvss" }, { "$ref": "#/components/parameters/filter_fuzzy" }, { "$ref": "#/components/parameters/filter_sort" }, { "$ref": "#/components/parameters/filter_order" }, { "$ref": "#/components/parameters/searchLimit" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "type": "object", "properties": { "query": { "type": "string" }, "threats": { "type": "array", "items": { "$ref": "#/components/schemas/Threat" } }, "count": { "type": "integer" } } }, "meta": { "$ref": "#/components/schemas/Meta" } } } } } }, "400": { "description": "q missing", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/threats/slug/{slug}": { "get": { "tags": [ "Threats" ], "operationId": "getThreatBySlug", "summary": "Get one threat by its public URL slug", "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "$ref": "#/components/schemas/Threat" }, "meta": { "$ref": "#/components/schemas/Meta" } } } } } }, "400": { "description": "Slug missing", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/threats/filters": { "get": { "tags": [ "Threats" ], "operationId": "listThreatFilters", "summary": "Machine-readable catalog of filter parameters", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "type": "object", "properties": { "filters": { "type": "array", "items": { "type": "object" } }, "pagination": { "type": "object" }, "sort": { "type": "object" }, "diagnostics": { "type": "object" } } }, "meta": { "$ref": "#/components/schemas/Meta" } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/threats/check-iocs": { "post": { "tags": [ "Threats" ], "operationId": "checkIocs", "summary": "Check indicators of compromise against known threats", "description": "Up to min(100, max(10, 2 × your plan's maxResultsPerRequest)) indicators; at most 5 threats per indicator.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "indicators" ], "properties": { "indicators": { "type": "array", "maxItems": 100, "description": "Up to twice your plan's maxResultsPerRequest (10 to 100); each indicator returns at most 5 threats.", "items": { "type": "object", "required": [ "type", "value" ], "properties": { "type": { "type": "string", "example": "ip" }, "value": { "type": "string", "example": "192.0.2.10" } } } } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "type": "object", "properties": { "checked": { "type": "integer" }, "matches": { "type": "integer" }, "results": { "type": "array", "items": { "type": "object", "properties": { "indicator": { "type": "object" }, "matches": { "type": "array", "items": { "type": "object" } } } } } } }, "meta": { "$ref": "#/components/schemas/Meta" } } } } } }, "400": { "description": "Invalid input or too many indicators", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/threats/stats/overview": { "get": { "tags": [ "Threats" ], "operationId": "threatStats", "summary": "Corpus totals, recent additions, severity split, top countries and types", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "type": "object", "properties": { "overview": { "type": "object" }, "severity": { "type": "object" }, "topCountries": { "type": "array", "items": { "type": "object" } }, "topTypes": { "type": "array", "items": { "type": "object" } } } }, "meta": { "$ref": "#/components/schemas/Meta" } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/threats/monitor": { "post": { "tags": [ "Threats" ], "operationId": "monitorProducts", "summary": "Recent threats mentioning any of up to 100 products or versions", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "products" ], "properties": { "products": { "type": "array", "maxItems": 100, "items": { "type": "string" }, "example": [ "WordPress", "nginx" ] }, "severities": { "type": "array", "items": { "type": "string", "enum": [ "low", "medium", "high", "critical" ] }, "default": [ "high", "critical" ] }, "limit": { "type": "integer", "default": 20, "description": "Capped at your plan's maxResultsPerRequest." } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "type": "object", "properties": { "products": { "type": "array", "items": { "type": "string" } }, "severities": { "type": "array", "items": { "type": "string" } }, "threats": { "type": "array", "items": { "type": "object" } }, "count": { "type": "integer" } } }, "meta": { "$ref": "#/components/schemas/Meta" } } } } } }, "400": { "description": "Invalid input", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/threats/feeds": { "get": { "tags": [ "Threats" ], "operationId": "listFeeds", "summary": "Per-source counts, last update and severity breakdown", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "type": "object", "properties": { "feeds": { "type": "array", "items": { "type": "object" } }, "totalFeeds": { "type": "integer" } } }, "meta": { "$ref": "#/components/schemas/Meta" } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/threats/{id}": { "get": { "tags": [ "Threats" ], "operationId": "getThreat", "summary": "Get one threat by id", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "pattern": "^[a-fA-F0-9]{24}$" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "$ref": "#/components/schemas/Threat" }, "meta": { "$ref": "#/components/schemas/Meta" } } } } } }, "400": { "description": "Not an ObjectId", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/match": { "post": { "tags": [ "Match" ], "operationId": "matchOne", "summary": "Match one package coordinate", "parameters": [ { "$ref": "#/components/parameters/strict" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "description": "One of: { purl } | { cpe } | { package: { name, ecosystem }, version } | { name, ecosystem, version }. Put the version in the purl or in version, not both.", "properties": { "purl": { "type": "string", "example": "pkg:npm/lodash@4.17.20" }, "cpe": { "type": "string", "example": "cpe:2.3:a:apache:http_server:2.4.48:*:*:*:*:*:*:*" }, "package": { "type": "object", "properties": { "name": { "type": "string" }, "ecosystem": { "type": "string" }, "version": { "type": "string" }, "purl": { "type": "string" } } }, "name": { "type": "string" }, "ecosystem": { "type": "string" }, "version": { "type": "string" } } }, { "type": "object", "properties": { "query": { "type": "object", "description": "One of: { purl } | { cpe } | { package: { name, ecosystem }, version } | { name, ecosystem, version }. Put the version in the purl or in version, not both.", "properties": { "purl": { "type": "string", "example": "pkg:npm/lodash@4.17.20" }, "cpe": { "type": "string", "example": "cpe:2.3:a:apache:http_server:2.4.48:*:*:*:*:*:*:*" }, "package": { "type": "object", "properties": { "name": { "type": "string" }, "ecosystem": { "type": "string" }, "version": { "type": "string" }, "purl": { "type": "string" } } }, "name": { "type": "string" }, "ecosystem": { "type": "string" }, "version": { "type": "string" } } }, "strict": { "type": "boolean" } } } ] }, "example": { "purl": "pkg:npm/lodash@4.17.20" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "$ref": "#/components/schemas/MatchResult" }, "meta": { "$ref": "#/components/schemas/Meta" } } } } } }, "400": { "description": "No coordinate given", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/match/batch": { "post": { "tags": [ "Match" ], "operationId": "matchBatch", "summary": "Match many coordinates; results align to queries", "description": "Counts as one request. Queries per batch are capped by plan (maxBatchQueries).", "parameters": [ { "$ref": "#/components/parameters/strict" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "queries" ], "properties": { "queries": { "type": "array", "items": { "type": "object", "description": "One of: { purl } | { cpe } | { package: { name, ecosystem }, version } | { name, ecosystem, version }. Put the version in the purl or in version, not both.", "properties": { "purl": { "type": "string", "example": "pkg:npm/lodash@4.17.20" }, "cpe": { "type": "string", "example": "cpe:2.3:a:apache:http_server:2.4.48:*:*:*:*:*:*:*" }, "package": { "type": "object", "properties": { "name": { "type": "string" }, "ecosystem": { "type": "string" }, "version": { "type": "string" }, "purl": { "type": "string" } } }, "name": { "type": "string" }, "ecosystem": { "type": "string" }, "version": { "type": "string" } } } }, "strict": { "type": "boolean" } } }, "example": { "queries": [ { "purl": "pkg:npm/lodash@4.17.20" }, { "package": { "name": "django", "ecosystem": "PyPI" }, "version": "4.2.0" } ] } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "type": "object", "properties": { "results": { "type": "array", "items": { "$ref": "#/components/schemas/MatchResult" } } } }, "meta": { "$ref": "#/components/schemas/Meta" } } } } } }, "400": { "description": "queries missing", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "413": { "$ref": "#/components/responses/TooLarge" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/match/help": { "get": { "tags": [ "Match" ], "operationId": "matchHelp", "summary": "Self-describing contract for the match endpoints", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "type": "object" }, "meta": { "$ref": "#/components/schemas/Meta" } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/scan": { "post": { "tags": [ "Scan" ], "operationId": "scan", "summary": "Scan an SBOM or lockfile", "description": "Accepts CycloneDX JSON/XML, SPDX JSON/tag-value, purl-per-line lists, package-lock.json, npm-shrinkwrap.json, yarn.lock (v1 and berry), pnpm-lock.yaml, poetry.lock, uv.lock, Cargo.lock, go.mod, go.sum, composer.lock, Gemfile.lock and pinned requirements*.txt. The format is taken from `format`, then the filename, then the content. Packages per scan are capped by plan (maxBatchQueries); the body is capped at 10 MB; lines over 4,096 characters are rejected with 400 (JSON documents are exempt). Counts as one request.", "parameters": [ { "name": "format", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "json", "sarif", "markdown", "all" ], "default": "json" }, "description": "Response format: JSON, SARIF 2.1.0 (application/sarif+json), GitHub step-summary markdown (text/markdown), or all: the JSON response with the SARIF log and markdown added as top-level sarif and markdown." }, { "name": "failOn", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "critical", "high", "medium", "low", "kev", "exploited" ] }, "description": "Adds gate { failOn, tripped } (and the X-Radar-Gate header) from version-confirmed findings. The status stays 200." }, { "name": "filename", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Filename hint for raw (non-JSON-wrapped) bodies.", "example": "yarn.lock" }, { "$ref": "#/components/parameters/strict" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "oneOf": [ { "type": "object", "required": [ "content" ], "properties": { "content": { "type": "string", "description": "The file text." }, "filename": { "type": "string", "example": "package-lock.json" }, "format": { "type": "string", "enum": [ "cyclonedx-json", "spdx-json", "package-lock", "composer-lock", "cyclonedx-xml", "spdx-tag-value", "yarn-lock", "pnpm-lock", "cargo-lock", "uv-lock", "poetry-lock", "gemfile-lock", "go-mod", "go-sum", "purl-list", "requirements" ] } } }, { "type": "object", "description": "A JSON SBOM or lockfile posted as-is." } ] } }, "text/plain": { "schema": { "type": "string" } }, "application/xml": { "schema": { "type": "string" } } } }, "responses": { "200": { "description": "Scan report", "headers": { "X-Radar-Gate": { "schema": { "type": "string", "enum": [ "tripped", "passed" ] }, "description": "Present when failOn is set." } }, "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "$ref": "#/components/schemas/ScanReport" }, "sarif": { "type": "object", "description": "SARIF 2.1.0 log; only with format=all." }, "markdown": { "type": "string", "description": "Step-summary markdown; only with format=all." }, "meta": { "$ref": "#/components/schemas/Meta" } } } }, "application/sarif+json": { "schema": { "type": "object", "description": "SARIF 2.1.0 log: one rule per vulnerability, one result per affected package." } }, "text/markdown": { "schema": { "type": "string" } } } }, "400": { "description": "Unknown or unparseable file, a line over 4,096 characters (non-JSON files), or bad option", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "413": { "$ref": "#/components/responses/TooLarge" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/prioritize": { "post": { "tags": [ "Prioritize" ], "operationId": "prioritize", "summary": "Rank CVEs for patching", "description": "Orders 2 to 50 CVEs: CISA KEV first, then priority score; ties fall to known ransomware use, EPSS, exploit maturity, CVSS and the earlier KEV due date, then the order given. Each row says why it sits above the next; patterns lists shared products, vendors and CWEs and signals worth calling out. Each CVE is read from its canonical record (CVE Program, then GCVE/NVD, then CISA KEV). Counts as one request.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "cveIds" ], "properties": { "cveIds": { "type": "array", "minItems": 2, "maxItems": 100, "description": "2 to 50 distinct CVE ids after normalizing and de-duplicating; at most 100 entries.", "items": { "type": "string", "example": "CVE-2024-3400" } } } } } } }, "responses": { "200": { "description": "Patch order", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "type": "object", "properties": { "ranked": { "type": "array", "items": { "$ref": "#/components/schemas/PrioritizedCve" } }, "patterns": { "type": "array", "items": { "$ref": "#/components/schemas/Pattern" } }, "notFound": { "type": "array", "items": { "type": "string" } }, "version": { "type": "string", "example": "2026-10" } } }, "meta": { "$ref": "#/components/schemas/Meta" } } } } } }, "400": { "description": "cveIds missing, not CVE ids, fewer than 2 or more than 50", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/inventory": { "get": { "tags": [ "Inventory" ], "operationId": "listHosts", "summary": "List monitored hosts with cached summaries", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "type": "object", "properties": { "hosts": { "type": "array", "items": { "type": "object" } }, "count": { "type": "integer" }, "maxHosts": { "type": "integer" }, "aggregate": { "type": "object" }, "monitoringAvailable": { "type": "boolean" } } }, "meta": { "$ref": "#/components/schemas/Meta" } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/inventory/register": { "post": { "tags": [ "Inventory" ], "operationId": "registerHost", "summary": "Register or update a host inventory and get its findings", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "hostId", "assets" ], "properties": { "hostId": { "type": "string", "maxLength": 128 }, "hostname": { "type": "string" }, "os": { "type": "object", "properties": { "type": { "type": "string" }, "distro": { "type": "string" }, "version": { "type": "string" } } }, "agentVersion": { "type": "string" }, "monitor": { "type": "boolean" }, "assets": { "type": "array", "description": "Capped by plan (maxAssetsPerHost).", "items": { "type": "object", "properties": { "purl": { "type": "string" }, "exposure": { "type": "string", "enum": [ "public", "private", "loopback", "none" ] }, "exposed": { "type": "boolean" }, "runtime": { "type": "boolean" } } } } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "type": "object", "properties": { "hostId": { "type": "string" }, "monitoring": { "type": "boolean" }, "new": { "type": "boolean" }, "assetCount": { "type": "integer" }, "drift": { "type": "object" }, "summary": { "$ref": "#/components/schemas/HostSummary" }, "top": { "type": "array", "items": { "type": "object" } }, "newSinceLast": { "type": "array", "items": { "type": "object" } }, "newSinceLastCount": { "type": "integer" }, "resolved": { "type": "array", "items": { "$ref": "#/components/schemas/ResolvedFinding" } }, "resolvedCount": { "type": "integer" } } }, "meta": { "$ref": "#/components/schemas/Meta" } } } } } }, "400": { "description": "Invalid input", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "413": { "$ref": "#/components/responses/TooLarge" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/inventory/{hostId}": { "parameters": [ { "name": "hostId", "in": "path", "required": true, "schema": { "type": "string", "maxLength": 128 } } ], "get": { "tags": [ "Inventory" ], "operationId": "getHost", "summary": "Host detail with current findings", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "type": "object", "properties": { "hostId": { "type": "string" }, "summary": { "$ref": "#/components/schemas/HostSummary" }, "findings": { "type": "array", "items": { "type": "object", "properties": { "assetKey": { "type": "string" }, "recordedDecision": { "type": [ "object", "null" ], "description": "The most specific decision for this finding (asset, host, then account-wide): id, scope, verdict, status, staleReasons, until." } } } }, "resolved": { "type": "array", "items": { "$ref": "#/components/schemas/ResolvedFinding" } } } }, "meta": { "$ref": "#/components/schemas/Meta" } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "description": "Host not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } }, "patch": { "tags": [ "Inventory" ], "operationId": "updateHost", "summary": "Toggle monitoring or rename", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "monitoring": { "type": "boolean" }, "hostname": { "type": "string" } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "type": "object", "properties": { "hostId": { "type": "string" }, "monitoring": { "type": "boolean" }, "hostname": { "type": [ "string", "null" ] } } }, "meta": { "$ref": "#/components/schemas/Meta" } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "description": "Host not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } }, "delete": { "tags": [ "Inventory" ], "operationId": "deleteHost", "summary": "Deregister a host", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "type": "object", "properties": { "hostId": { "type": "string" }, "deleted": { "type": "boolean" } } }, "meta": { "$ref": "#/components/schemas/Meta" } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "description": "Host not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/decisions": { "get": { "tags": [ "Decisions" ], "operationId": "listDecisions", "summary": "List your decisions", "parameters": [ { "name": "status", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Comma-separated: active, review_due, expired, stale." }, { "name": "verdict", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Comma-separated: patch_now, defer, accept, not_affected, mitigated." }, { "name": "cveId", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Comma-separated CVE ids." }, { "name": "hostId", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Decisions scoped to this host." }, { "name": "page", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 1000, "default": 1 }, "description": "Page; values above 1000 read page 1000." }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 200, "default": 50 }, "description": "Page size; values above 200 read 200." } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "type": "object", "properties": { "decisions": { "type": "array", "items": { "$ref": "#/components/schemas/Decision" } }, "total": { "type": "integer" }, "page": { "type": "integer" }, "limit": { "type": "integer" } } } } } } } }, "400": { "description": "Unknown status or verdict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } }, "post": { "tags": [ "Decisions" ], "operationId": "createDecision", "summary": "Record a decision", "description": "Records a verdict on a CVE, account-wide or on one host/asset, with the assumptions it rests on. Radar re-checks them on every signal change and daily; a broken one turns the decision stale with the reason and notifies you once (in-app, automations event decision_stale, email when alerts are on). One decision per CVE and scope: a second POST for the same CVE and scope (cve, or host with the same hostId and assetKey) returns 409 with the existing id, so PATCH that one instead. An account keeps at most 5000 decisions (400 beyond).", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecisionInput" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "type": "object", "properties": { "decision": { "$ref": "#/components/schemas/Decision" } } } } } } } }, "400": { "description": "Invalid input, an assumption that does not hold now (the response lists `broken`), or the account already keeps 5000 decisions", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Host not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "A decision for this CVE and scope exists; PATCH /decisions/{id} with the returned id instead", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": false }, "error": { "type": "string" }, "id": { "type": "string", "description": "The existing decision's id." } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/decisions/suggestions": { "get": { "tags": [ "Decisions" ], "operationId": "suggestDecisionAssumptions", "summary": "Assumptions that hold now for a CVE", "parameters": [ { "name": "cveId", "in": "query", "required": true, "schema": { "type": "string" }, "description": "CVE id." } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "type": "object", "properties": { "cveId": { "type": "string" }, "snapshot": { "type": "object" }, "assumptions": { "type": "array", "items": { "$ref": "#/components/schemas/Assumption" } } } } } } } } }, "400": { "description": "Invalid cveId", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/decisions/calibration": { "get": { "tags": [ "Decisions" ], "operationId": "decisionCalibration", "summary": "How deferrals and accepted risks held up", "parameters": [ { "name": "days", "in": "query", "required": false, "schema": { "type": "integer", "enum": [ 30, 90, 365 ], "default": 90 }, "description": "Window over decision creation dates." } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "type": "object", "properties": { "days": { "type": "integer" }, "since": { "type": "string", "format": "date-time" }, "decisions": { "type": "integer" }, "byVerdict": { "type": "object" }, "wentStale": { "type": "integer" }, "staleRate": { "type": "number" }, "medianDaysToStale": { "type": [ "number", "null" ] }, "expired": { "type": "integer" }, "reasons": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "label": { "type": "string" }, "count": { "type": "integer" } } } }, "cases": { "type": "array", "items": { "type": "object" } } } } } } } } }, "400": { "description": "days is not 30, 90 or 365", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/decisions/vex": { "get": { "tags": [ "Decisions" ], "operationId": "exportDecisionsVex", "summary": "Export every decision as VEX", "description": "Account-wide decisions name the product urn:offseq:radar:scope:account; host decisions name the asset's purl or the host. Stale and expired decisions are exported as under_investigation / in_triage.", "parameters": [ { "name": "format", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "openvex", "cyclonedx" ], "default": "openvex" }, "description": "openvex: OpenVEX 0.2.0 (application/json). cyclonedx: CycloneDX 1.5 VEX with vulnerabilities[].analysis (application/vnd.cyclonedx+json)." }, { "name": "status", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Comma-separated statuses." }, { "name": "verdict", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Comma-separated verdicts." }, { "name": "cveId", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Comma-separated CVE ids." } ], "responses": { "200": { "description": "VEX document (download)", "content": { "application/json": { "schema": { "type": "object", "description": "OpenVEX 0.2.0 document: statements[] with vulnerability, products, status (not_affected | affected | fixed | under_investigation), justification, impact_statement, action_statement, status_notes." } }, "application/vnd.cyclonedx+json": { "schema": { "type": "object", "description": "CycloneDX 1.5 BOM: components[] and vulnerabilities[] with analysis {state, justification, response, detail} and affects[]." } } } }, "400": { "description": "Unknown format, status or verdict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/decisions/{id}": { "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ], "patch": { "tags": [ "Decisions" ], "operationId": "updateDecision", "summary": "Edit a decision", "description": "Changing verdict, until or assumptions re-records it: assumptions must hold, a fresh snapshot is taken and the status returns to active. Note and justification edits keep the status.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecisionInput" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "type": "object", "properties": { "decision": { "$ref": "#/components/schemas/Decision" } } } } } } } }, "400": { "description": "Invalid input, or an assumption that does not hold now (the response lists `broken`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Decision not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } }, "delete": { "tags": [ "Decisions" ], "operationId": "deleteDecision", "summary": "Delete a decision", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "type": "object", "properties": { "id": { "type": "string" }, "deleted": { "type": "boolean" } } } } } } } }, "404": { "description": "Decision not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/decisions/{id}/confirm": { "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ], "post": { "tags": [ "Decisions" ], "operationId": "confirmDecision", "summary": "Re-confirm a decision", "description": "After review: takes a fresh snapshot, re-checks the assumptions and sets the status back to active. A body may change the decision in the same call.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecisionInput" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "const": true }, "data": { "type": "object", "properties": { "decision": { "$ref": "#/components/schemas/Decision" } } } } } } } }, "400": { "description": "Invalid input, or an assumption that does not hold now (the response lists `broken`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Decision not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } } }, "/inventory/{hostId}/vex": { "parameters": [ { "name": "hostId", "in": "path", "required": true, "schema": { "type": "string", "maxLength": 128 } } ], "get": { "tags": [ "Inventory", "Decisions" ], "operationId": "exportHostVex", "summary": "Export a host's decisions as VEX", "description": "The host's decisions plus account-wide ones on CVEs the host has or had, naming the affected assets by purl. Each CVE and product appears once: the most specific decision wins (asset > host > account). A patch_now CVE the host no longer matches is reported fixed / resolved.", "parameters": [ { "name": "format", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "openvex", "cyclonedx" ], "default": "openvex" }, "description": "openvex: OpenVEX 0.2.0 (application/json). cyclonedx: CycloneDX 1.5 VEX with vulnerabilities[].analysis (application/vnd.cyclonedx+json)." } ], "responses": { "200": { "description": "VEX document (download)", "content": { "application/json": { "schema": { "type": "object", "description": "OpenVEX 0.2.0 document: statements[] with vulnerability, products, status (not_affected | affected | fixed | under_investigation), justification, impact_statement, action_statement, status_notes." } }, "application/vnd.cyclonedx+json": { "schema": { "type": "object", "description": "CycloneDX 1.5 BOM: components[] and vulnerabilities[] with analysis {state, justification, response, detail} and affects[]." } } } }, "400": { "description": "Unknown format or invalid hostId", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Host not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/ServerError" } } } } }, "components": { "securitySchemes": { "ApiKey": { "type": "apiKey", "in": "header", "name": "X-API-Key" }, "Bearer": { "type": "http", "scheme": "bearer" } }, "parameters": { "filter_search": { "name": "search", "in": "query", "required": false, "schema": { "type": "string", "maxLength": 200 }, "description": "Full-text search over title, description, CVE, product, vendor, tags and AI summary. An exact CVE id matches that CVE.", "example": "nginx" }, "filter_q": { "name": "q", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Alias of `search`." }, "filter_type": { "name": "type", "in": "query", "required": false, "schema": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "description": "Threat type(s); comma-separated or repeated. Unrecognised values are ignored. One of: vulnerability, exploit, malware, phishing, botnet, campaign, threat-actor, breach, indicator, security-tool, analysis, security-news.", "example": "vulnerability" }, "filter_types": { "name": "types", "in": "query", "required": false, "schema": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "description": "Alias of `type`." }, "filter_severity": { "name": "severity", "in": "query", "required": false, "schema": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "description": "low | medium | high | critical; comma-separated or repeated.", "example": "critical,high" }, "filter_severities": { "name": "severities", "in": "query", "required": false, "schema": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "description": "Alias of `severity`." }, "filter_cve": { "name": "cve", "in": "query", "required": false, "schema": { "type": "string" }, "description": "CVE id, normalized: \"2025-1974\", \"cve-2025-1974\" and \"CVE-2025-1974\" match the same record.", "example": "CVE-2025-1974" }, "filter_cveId": { "name": "cveId", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Alias of `cve`." }, "filter_cwe": { "name": "cwe", "in": "query", "required": false, "schema": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "description": "CWE id(s), normalized: \"787\" → \"CWE-787\".", "example": "CWE-787" }, "filter_cwes": { "name": "cwes", "in": "query", "required": false, "schema": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "description": "Alias of `cwe`." }, "filter_product": { "name": "product", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Case-insensitive substring on product. With `ecosystem`, also a package coordinate filter.", "example": "nginx" }, "filter_products": { "name": "products", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Alias of `product`." }, "filter_vendor": { "name": "vendor", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Case-insensitive substring on vendorProject.", "example": "F5" }, "filter_vendorProject": { "name": "vendorProject", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Alias of `vendor`." }, "filter_vendors": { "name": "vendors", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Alias of `vendor`." }, "filter_affectedVersions": { "name": "affectedVersions", "in": "query", "required": false, "schema": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "description": "Version(s): matches the structured affectedVersions ranges and, unless fuzzy=false, the version in title, description, AI summary and Reddit text.", "example": "1.24.0" }, "filter_affectedVersion": { "name": "affectedVersion", "in": "query", "required": false, "schema": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "description": "Alias of `affectedVersions`." }, "filter_version": { "name": "version", "in": "query", "required": false, "schema": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "description": "Alias of `affectedVersions`." }, "filter_versions": { "name": "versions", "in": "query", "required": false, "schema": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "description": "Alias of `affectedVersions`." }, "filter_purl": { "name": "purl", "in": "query", "required": false, "schema": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "description": "Package URL coordinate filter (indexed ecosystem|name match, no version comparison; use POST /match for that).", "example": "pkg:npm/lodash" }, "filter_cpe": { "name": "cpe", "in": "query", "required": false, "schema": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "description": "CPE 2.3 vendor/product coordinate filter.", "example": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*" }, "filter_ecosystem": { "name": "ecosystem", "in": "query", "required": false, "schema": { "type": "string" }, "description": "OSV-style ecosystem (npm, PyPI, Go, Debian:11, ...). Combine with packageName or product for a coordinate filter.", "example": "npm" }, "filter_packageName": { "name": "packageName", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Package name for the ecosystem coordinate filter.", "example": "lodash" }, "filter_country": { "name": "country", "in": "query", "required": false, "schema": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "description": "Country (name or ISO code) in affectedCountries or AI-identified countries.", "example": "US" }, "filter_countries": { "name": "countries", "in": "query", "required": false, "schema": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "description": "Alias of `country`." }, "filter_source": { "name": "source", "in": "query", "required": false, "schema": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "description": "Feed source name, case-insensitive exact match.", "example": "NVD" }, "filter_sources": { "name": "sources", "in": "query", "required": false, "schema": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "description": "Alias of `source`." }, "filter_tag": { "name": "tag", "in": "query", "required": false, "schema": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "description": "Tag(s), case-insensitive exact match.", "example": "rce" }, "filter_tags": { "name": "tags", "in": "query", "required": false, "schema": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "description": "Alias of `tag`." }, "filter_hasExploits": { "name": "hasExploits", "in": "query", "required": false, "schema": { "type": "boolean" }, "description": "Known exploitation in the wild." }, "filter_exploited": { "name": "exploited", "in": "query", "required": false, "schema": { "type": "boolean" }, "description": "Alias of `hasExploits`." }, "filter_hasPatch": { "name": "hasPatch", "in": "query", "required": false, "schema": { "type": "boolean" }, "description": "A patch is available." }, "filter_patched": { "name": "patched", "in": "query", "required": false, "schema": { "type": "boolean" }, "description": "Alias of `hasPatch`." }, "filter_kev": { "name": "kev", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "true", "false", "overdue", "active", "upcoming" ] }, "description": "CISA KEV: listed (true), past the BOD 22-01 due date (overdue), due date ahead (active), due within 14 days (upcoming), or not listed (false)." }, "filter_cisaKev": { "name": "cisaKev", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "true", "false", "overdue", "active", "upcoming" ] }, "description": "Alias of `kev`." }, "filter_mirageExploited": { "name": "mirageExploited", "in": "query", "required": false, "schema": { "type": "boolean" }, "description": "CVEs OffSeq Mirage honeypots saw exploited." }, "filter_observedInWild": { "name": "observedInWild", "in": "query", "required": false, "schema": { "type": "boolean" }, "description": "CVEs OffSeq Mirage saw exploited or exposed in the wild (true only)." }, "filter_ransomware": { "name": "ransomware", "in": "query", "required": false, "schema": { "type": "boolean" }, "description": "Known ransomware-campaign use (per CISA KEV)." }, "filter_publicExploit": { "name": "publicExploit", "in": "query", "required": false, "schema": { "type": "boolean" }, "description": "A public exploit or PoC is known (Metasploit, Exploit-DB, nuclei, PoC-in-GitHub). Unlike hasExploits, this does not mean exploited in the wild." }, "filter_exploitMaturity": { "name": "exploitMaturity", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Comma-separated maturity levels: WEAPONIZED, PUBLIC_EXPLOIT_REMOTE, PUBLIC_EXPLOIT, POC_HIGH, POC_LOW. Takes precedence over publicExploit.", "example": "WEAPONIZED,PUBLIC_EXPLOIT_REMOTE" }, "filter_euvdExploited": { "name": "euvdExploited", "in": "query", "required": false, "schema": { "type": "boolean" }, "description": "ENISA EUVD lists the CVE as exploited." }, "filter_exploitedNotInKev": { "name": "exploitedNotInKev", "in": "query", "required": false, "schema": { "type": "boolean" }, "description": "Exploited per ENISA EUVD or OffSeq Mirage, but not in CISA KEV." }, "filter_epssRising": { "name": "epssRising", "in": "query", "required": false, "schema": { "type": "boolean" }, "description": "EPSS rose by at least 0.05 over the last 7 days (tracked CVEs: in KEV, EPSS >= 0.10 or percentile >= 0.9)." }, "filter_includeArchived": { "name": "includeArchived", "in": "query", "required": false, "schema": { "type": "boolean" }, "description": "Include items from archived sources." }, "filter_minEpss": { "name": "minEpss", "in": "query", "required": false, "schema": { "type": "number", "minimum": 0, "maximum": 1 }, "description": "Minimum EPSS probability." }, "filter_maxEpss": { "name": "maxEpss", "in": "query", "required": false, "schema": { "type": "number", "minimum": 0, "maximum": 1 }, "description": "Maximum EPSS probability." }, "filter_epssRange": { "name": "epssRange", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "critical", "high", "medium", "low" ] }, "description": "EPSS band: critical ≥0.5, high 0.1–0.5, medium 0.01–0.1, low <0.01." }, "filter_minPercentile": { "name": "minPercentile", "in": "query", "required": false, "schema": { "type": "number", "minimum": 0, "maximum": 100 }, "description": "Minimum EPSS percentile, 0..1 or 0..100." }, "filter_maxPercentile": { "name": "maxPercentile", "in": "query", "required": false, "schema": { "type": "number", "minimum": 0, "maximum": 100 }, "description": "Maximum EPSS percentile, 0..1 or 0..100." }, "filter_publishedAfter": { "name": "publishedAfter", "in": "query", "required": false, "schema": { "type": "string", "format": "date" }, "description": "Published on or after this date.", "example": "2025-01-01" }, "filter_startDate": { "name": "startDate", "in": "query", "required": false, "schema": { "type": "string", "format": "date" }, "description": "Alias of `publishedAfter`." }, "filter_from": { "name": "from", "in": "query", "required": false, "schema": { "type": "string", "format": "date" }, "description": "Alias of `publishedAfter`." }, "filter_publishedBefore": { "name": "publishedBefore", "in": "query", "required": false, "schema": { "type": "string", "format": "date" }, "description": "Published on or before this date.", "example": "2025-12-31" }, "filter_endDate": { "name": "endDate", "in": "query", "required": false, "schema": { "type": "string", "format": "date" }, "description": "Alias of `publishedBefore`." }, "filter_to": { "name": "to", "in": "query", "required": false, "schema": { "type": "string", "format": "date" }, "description": "Alias of `publishedBefore`." }, "filter_days": { "name": "days", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 3650 }, "description": "Ingested within the last N days.", "example": 7 }, "filter_minCvss": { "name": "minCvss", "in": "query", "required": false, "schema": { "type": "number", "minimum": 0, "maximum": 10 }, "description": "Minimum CVSS base score." }, "filter_maxCvss": { "name": "maxCvss", "in": "query", "required": false, "schema": { "type": "number", "minimum": 0, "maximum": 10 }, "description": "Maximum CVSS base score." }, "filter_fuzzy": { "name": "fuzzy", "in": "query", "required": false, "schema": { "type": "boolean", "default": true }, "description": "Set false to match affectedVersions only against structured ranges." }, "filter_sort": { "name": "sort", "in": "query", "required": false, "schema": { "type": "string", "default": "-publishedDate" }, "description": "Comma-separated sort fields, prefix - for descending. Allowed: publishedDate, createdAt, cvssScore, severity, voteScore, viewCount, title, epssScore, epssPercentile, epss_rising (largest 7-day EPSS rise first; tracked CVEs only), priority (highest priority score first).", "example": "-cvssScore" }, "filter_order": { "name": "order", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "asc", "desc", "ascending", "descending" ] }, "description": "Direction for sort fields given without a - prefix." }, "page": { "name": "page", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "default": 1 }, "description": "Page number." }, "limit": { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "default": 10 }, "description": "Results per page; capped at your plan's maxResultsPerRequest (X-Limit-Capped header)." }, "searchLimit": { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "default": 20 }, "description": "Results per page; capped at your plan's maxResultsPerRequest (X-Limit-Capped header)." }, "strict": { "name": "strict", "in": "query", "required": false, "schema": { "type": "boolean" }, "description": "Only version-confirmed matches (also accepted as \"strict\" in the JSON body)." }, "filter_minPriority": { "name": "minPriority", "in": "query", "required": false, "schema": { "oneOf": [ { "type": "integer", "minimum": 0, "maximum": 100 }, { "type": "string", "enum": [ "critical", "high", "medium", "low" ] } ] }, "description": "Stored priorityScore at least this value, or at least the floor of a band (critical 76, high 50, medium 25, low 0).", "example": 76 } }, "responses": { "Unauthorized": { "description": "Missing or invalid API key", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "Forbidden": { "description": "Plan does not include this feature", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "RateLimited": { "description": "Plan rate limit reached", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "TooLarge": { "description": "Over the plan cap or body size; data names the cap", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "ServerError": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "schemas": { "Error": { "type": "object", "properties": { "success": { "type": "boolean", "const": false }, "error": { "type": "string" }, "message": { "type": "string" }, "data": { "type": "object" } } }, "Meta": { "type": "object", "properties": { "timestamp": { "type": "string", "format": "date-time" }, "version": { "type": "string", "const": "v1" } }, "additionalProperties": true }, "Pagination": { "type": "object", "properties": { "page": { "type": "integer" }, "limit": { "type": "integer" }, "total": { "type": "integer" }, "pages": { "type": "integer" }, "hasNext": { "type": "boolean" }, "hasPrev": { "type": "boolean" } } }, "Threat": { "type": "object", "additionalProperties": true, "properties": { "_id": { "type": "string" }, "slug": { "type": "string" }, "externalId": { "type": "string" }, "source": { "type": "string" }, "type": { "type": "string" }, "title": { "type": "string" }, "description": { "type": "string" }, "cveId": { "type": [ "string", "null" ] }, "cvssScore": { "type": [ "number", "null" ] }, "cvssVector": { "type": [ "string", "null" ] }, "severity": { "type": "string", "enum": [ "low", "medium", "high", "critical" ] }, "vendorProject": { "type": "string" }, "product": { "type": "string" }, "affectedVersions": { "type": "array", "items": { "type": "string" } }, "affectedPackages": { "type": "array", "items": { "type": "object" } }, "cwes": { "type": "array", "items": { "type": "string" } }, "tags": { "type": "array", "items": { "type": "string" } }, "affectedCountries": { "type": "array", "items": { "type": "string" } }, "knownExploitsInWild": { "type": "boolean" }, "patchAvailable": { "type": [ "boolean", "null" ] }, "patchLinks": { "type": "array", "items": { "type": "string" } }, "references": { "type": "array", "items": { "type": "object" } }, "kev": { "type": [ "object", "null" ], "properties": { "addedDate": { "type": "string" }, "dueDate": { "type": "string" }, "ransomwareUse": { "type": "string" }, "requiredAction": { "type": "string" } } }, "epss": { "type": [ "object", "null" ], "properties": { "score": { "type": "number" }, "percentile": { "type": "number" }, "previousScore": { "type": "number" }, "previousPercentile": { "type": "number" }, "delta7d": { "type": "number", "description": "Score now minus score about 7 days ago (tracked CVEs only)." }, "peakScore": { "type": "number" }, "peakAt": { "type": "string", "format": "date-time" } } }, "publishedDate": { "type": "string", "format": "date-time" }, "enrichment": { "type": "object" }, "exploit": { "type": [ "object", "null" ], "description": "Strongest public exploit evidence. Never downgrades when evidence disappears.", "properties": { "maturity": { "type": "string", "enum": [ "WEAPONIZED", "PUBLIC_EXPLOIT_REMOTE", "PUBLIC_EXPLOIT", "POC_HIGH", "POC_LOW" ] }, "sources": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "ref": { "type": "string" }, "url": { "type": "string" } } } }, "firstSeenAt": { "type": "string", "format": "date-time" }, "updatedAt": { "type": "string", "format": "date-time" } } }, "euvd": { "type": [ "object", "null" ], "description": "ENISA EUVD exploitation flag.", "properties": { "id": { "type": "string", "example": "EUVD-2026-12345" }, "exploited": { "type": "boolean" }, "exploitedSince": { "type": "string", "format": "date-time" }, "updatedAt": { "type": "string", "format": "date-time" } } }, "consensus": { "type": [ "object", "null" ], "description": "Detail responses only. Whether the CVSS scorers agree; exploited_outside_kev is an informational flag that never makes a CVE contested.", "properties": { "label": { "type": "string", "enum": [ "agree", "contested", "thin" ] }, "scorers": { "type": [ "integer", "null" ], "description": "Distinct CVSS scorers; null when the scorer list is not known yet." }, "flags": { "type": "array", "items": { "type": "string", "enum": [ "score_spread", "severity_vs_likelihood", "exploited_outside_kev", "disputed", "thin" ] } } } }, "priority": { "$ref": "#/components/schemas/Priority" }, "priorityScore": { "type": "integer", "description": "Stored priority score behind sort=priority and minPriority. Refreshed by the KEV, EPSS, EUVD, Mirage and exploit syncs; priority.score is computed on read." } } }, "Match": { "type": "object", "properties": { "id": { "type": "string" }, "cveId": { "type": [ "string", "null" ] }, "title": { "type": "string" }, "slug": { "type": [ "string", "null" ] }, "severity": { "type": [ "string", "null" ] }, "cvssScore": { "type": [ "number", "null" ] }, "cvssVector": { "type": [ "string", "null" ] }, "type": { "type": "string" }, "source": { "type": "string" }, "publishedDate": { "type": [ "string", "null" ] }, "kev": { "type": [ "object", "null" ], "properties": { "addedDate": { "type": "string" }, "dueDate": { "type": [ "string", "null" ] }, "ransomwareUse": { "type": [ "string", "null" ] }, "requiredAction": { "type": [ "string", "null" ] } } }, "epss": { "type": [ "object", "null" ], "properties": { "score": { "type": "number" }, "percentile": { "type": [ "number", "null" ] } } }, "knownExploitsInWild": { "type": "boolean" }, "exploit": { "type": [ "object", "null" ], "properties": { "maturity": { "type": "string", "enum": [ "WEAPONIZED", "PUBLIC_EXPLOIT_REMOTE", "PUBLIC_EXPLOIT", "POC_HIGH", "POC_LOW" ] } } }, "exploitation": { "type": "object", "description": "Exploitation evidence outside CISA KEV.", "properties": { "euvd": { "type": "boolean", "description": "ENISA EUVD lists it as exploited." }, "mirage": { "type": "boolean", "description": "OffSeq Mirage honeypots observed exploitation." } } }, "patchAvailable": { "type": [ "boolean", "null" ] }, "affectedVersions": { "type": "array", "items": { "type": "string" } }, "fixedVersions": { "type": "array", "items": { "type": "string" } }, "remediation": { "type": [ "string", "null" ] }, "patchLinks": { "type": "array", "items": { "type": "string" } }, "cwes": { "type": "array", "items": { "type": "string" } }, "references": { "type": "array", "items": { "type": "string" } }, "matchBasis": { "type": [ "string", "null" ], "enum": [ "coordinate", "cpe", "coordinate-unconfirmed", null ] }, "matchedRange": { "type": [ "string", "null" ] }, "matchedCoordinate": { "type": [ "string", "null" ] }, "confirmed": { "type": "boolean" }, "nameOnly": { "type": "string", "description": "Present when a bare Maven or Packagist name matched this advisory by artifact name only: the advisory package's full name (group:artifact or vendor/package)." } } }, "MatchResult": { "type": "object", "properties": { "query": {}, "mode": { "type": "string", "enum": [ "purl", "cpe", "package" ] }, "ecosystem": { "type": [ "string", "null" ] }, "version": { "type": [ "string", "null" ] }, "totalCandidates": { "type": "integer" }, "truncated": { "type": "boolean" }, "totalMatches": { "type": "integer" }, "matches": { "type": "array", "items": { "$ref": "#/components/schemas/Match" } }, "upgradeTo": { "type": [ "string", "null" ], "description": "Smallest known version fixing every match on this package." }, "unfixed": { "type": "array", "items": { "type": "string" }, "description": "Matches with no known fix above the queried version." }, "note": { "type": "string", "description": "Present when any match is nameOnly: names up to five full package names to pass (or a purl) for an exact match." }, "error": { "type": "string", "description": "Present when this query could not be evaluated." } } }, "ScanFinding": { "type": "object", "properties": { "purl": { "type": "string" }, "ecosystem": { "type": [ "string", "null" ] }, "version": { "type": [ "string", "null" ] }, "id": { "type": "string" }, "cveId": { "type": [ "string", "null" ] }, "title": { "type": "string" }, "severity": { "type": [ "string", "null" ] }, "cvssScore": { "type": [ "number", "null" ] }, "epss": { "type": [ "number", "null" ] }, "kev": { "type": "boolean" }, "kevDueDate": { "type": [ "string", "null" ] }, "ransomware": { "type": "boolean" }, "exploited": { "type": "boolean", "description": "In CISA KEV, or exploited in the wild per ENISA EUVD, OffSeq Mirage or other reports." }, "exploitMaturity": { "type": [ "string", "null" ], "enum": [ "WEAPONIZED", "PUBLIC_EXPLOIT_REMOTE", "PUBLIC_EXPLOIT", "POC_HIGH", "POC_LOW", null ], "description": "Strongest public exploit evidence; adds 10/7/3 to riskScore and breaks ranking ties." }, "riskScore": { "type": "integer", "minimum": 0, "maximum": 100, "description": "Finding risk score, not the threat priority score: severity points plus the shared EPSS, KEV, exploit and exploited points, ×0.6 when the version is unconfirmed. Scans carry no network exposure." }, "decision": { "type": "string", "enum": [ "act-now", "soon", "schedule", "track" ] }, "confirmed": { "type": "boolean" }, "matchBasis": { "type": [ "string", "null" ] }, "matchedRange": { "type": [ "string", "null" ] }, "fixedVersions": { "type": "array", "items": { "type": "string" } }, "upgradeTo": { "type": [ "string", "null" ] }, "url": { "type": [ "string", "null" ] } } }, "ScanReport": { "type": "object", "properties": { "format": { "type": "string" }, "packages": { "type": "integer", "description": "Unique packages read from the file." }, "findings": { "type": "array", "items": { "$ref": "#/components/schemas/ScanFinding" }, "description": "Riskiest first: CISA KEV, then risk score, known ransomware use, EPSS, exploit maturity, CVSS, earlier KEV due date." }, "remediation": { "type": "array", "items": { "type": "object", "properties": { "purl": { "type": "string" }, "version": { "type": "string" }, "findings": { "type": "integer" }, "upgradeTo": { "type": [ "string", "null" ] }, "unfixed": { "type": "array", "items": { "type": "string" } } } } }, "notChecked": { "type": "array", "items": { "type": "object", "properties": { "purl": { "type": "string" }, "reason": { "type": "string" } } } }, "summary": { "type": "object", "properties": { "total": { "type": "integer" }, "critical": { "type": "integer" }, "high": { "type": "integer" }, "medium": { "type": "integer" }, "low": { "type": "integer" }, "unknown": { "type": "integer" }, "kev": { "type": "integer" }, "ransomware": { "type": "integer" }, "exploited": { "type": "integer" }, "packagesAffected": { "type": "integer" } } }, "gate": { "type": "object", "properties": { "failOn": { "type": "string" }, "tripped": { "type": "boolean" } } } } }, "ResolvedFinding": { "type": "object", "description": "A finding from the previous scan that is gone. A finding Radar could not re-check is left out.", "properties": { "cveId": { "type": "string" }, "assetKey": { "type": "string" }, "reason": { "type": "string", "enum": [ "removed", "upgraded", "no_longer_affected" ] } } }, "HostSummary": { "type": "object", "properties": { "total": { "type": "integer" }, "confirmed": { "type": "integer" }, "kev": { "type": "integer" }, "exposed": { "type": "integer" }, "bySeverity": { "type": "object" }, "byDecision": { "type": "object" }, "actNow": { "type": "integer" } } }, "Priority": { "type": "object", "description": "Threat-level patch priority from CVSS, EPSS, CISA KEV (ransomware use, overdue), exploit maturity and EUVD/Mirage exploitation. Exposure is not known here; host and scan findings carry a separate riskScore (0–100) that adds network exposure (host findings only) and shares the EPSS, KEV, overdue, exploit and exploited points. Factor points sum to score. Formula changes bump version.", "properties": { "score": { "type": "integer", "minimum": 0, "maximum": 100 }, "band": { "type": "string", "enum": [ "critical", "high", "medium", "low" ] }, "factors": { "type": "array", "items": { "type": "object", "properties": { "factor": { "type": "string", "enum": [ "cvss", "epss", "kev", "ransomware", "kevOverdue", "exploit", "exploited", "booster", "kevFloor", "exploitedFloor" ] }, "points": { "type": "integer" }, "detail": { "type": "string", "example": "EPSS 0.94 (99th percentile)" } } } }, "version": { "type": "string", "example": "2026-10" } } }, "PrioritizedCve": { "type": "object", "properties": { "rank": { "type": "integer", "minimum": 1 }, "cveId": { "type": "string" }, "title": { "type": [ "string", "null" ] }, "url": { "type": [ "string", "null" ] }, "slug": { "type": [ "string", "null" ] }, "vendorProject": { "type": [ "string", "null" ] }, "product": { "type": [ "string", "null" ] }, "cwes": { "type": "array", "items": { "type": "string" } }, "severity": { "type": [ "string", "null" ] }, "cvssScore": { "type": [ "number", "null" ] }, "cvssVector": { "type": [ "string", "null" ] }, "epss": { "type": [ "object", "null" ], "properties": { "score": { "type": "number" }, "percentile": { "type": [ "number", "null" ] }, "delta7d": { "type": [ "number", "null" ] } } }, "kev": { "type": [ "object", "null" ], "properties": { "addedDate": { "type": "string", "format": "date-time" }, "dueDate": { "type": [ "string", "null" ], "format": "date-time" }, "ransomwareUse": { "type": [ "string", "null" ] } } }, "exploitMaturity": { "type": [ "string", "null" ], "enum": [ "WEAPONIZED", "PUBLIC_EXPLOIT_REMOTE", "PUBLIC_EXPLOIT", "POC_HIGH", "POC_LOW", null ] }, "exploited": { "type": "object", "properties": { "kev": { "type": "boolean" }, "euvd": { "type": "boolean" }, "mirage": { "type": "boolean" } } }, "remoteUnauthenticated": { "type": "boolean", "description": "CVSS vector AV:N with PR:N (v2: Au:N)." }, "priority": { "$ref": "#/components/schemas/Priority" }, "why": { "type": [ "string", "null" ], "description": "Why this CVE sits above the next one; null on the last row.", "example": "Tied with CVE-2024-21887 at 100; EPSS 0.94 vs 0.12 breaks the tie" } } }, "Pattern": { "type": "object", "properties": { "kind": { "type": "string", "enum": [ "product", "vendor", "ransomware", "exploitedOutsideKev", "remoteUnauthenticated", "epssRising", "cwe" ] }, "label": { "type": "string" }, "cveIds": { "type": "array", "items": { "type": "string" }, "description": "In rank order." }, "note": { "type": "string" } } }, "Assumption": { "type": "object", "required": [ "type" ], "properties": { "type": { "type": "string", "enum": [ "not_in_kev", "epss_below", "no_public_exploit", "not_weaponized", "not_exploited", "cvss_below", "manual" ], "description": "not_in_kev, no_public_exploit, not_weaponized and not_exploited (KEV, ENISA EUVD, OffSeq Mirage) are re-checked automatically; epss_below (0-1) and cvss_below (0-10) need threshold; manual needs text and is due for review at reviewBy (default 90 days)." }, "threshold": { "type": "number" }, "text": { "type": "string", "maxLength": 300 }, "reviewBy": { "type": "string", "format": "date-time" }, "label": { "type": "string", "readOnly": true } } }, "DecisionInput": { "type": "object", "properties": { "cveId": { "type": "string", "example": "CVE-2026-12345", "description": "Required on create; fixed afterwards." }, "scope": { "type": "string", "enum": [ "cve", "host" ], "default": "cve", "description": "cve applies account-wide; host needs hostId. Create only." }, "hostId": { "type": "string", "maxLength": 128 }, "assetKey": { "type": "string", "description": "ecosystem|name of one asset on the host, as host findings return it." }, "verdict": { "type": "string", "enum": [ "patch_now", "defer", "accept", "not_affected", "mitigated" ], "description": "Required on create." }, "justification": { "type": "string", "enum": [ "component_not_present", "vulnerable_code_not_present", "vulnerable_code_not_in_execute_path", "vulnerable_code_cannot_be_controlled_by_adversary", "inline_mitigations_already_exist" ], "description": "VEX justification, for not_affected and mitigated only: component_not_present, vulnerable_code_not_present, vulnerable_code_not_in_execute_path, vulnerable_code_cannot_be_controlled_by_adversary or inline_mitigations_already_exist." }, "note": { "type": "string", "maxLength": 2000 }, "until": { "type": "string", "format": "date-time", "description": "Future date; required for defer. Once passed the decision turns expired." }, "assumptions": { "type": "array", "maxItems": 16, "items": { "$ref": "#/components/schemas/Assumption" }, "description": "Must all hold when recorded or re-confirmed; GET /decisions/suggestions prefills the ones that hold now." } } }, "Decision": { "type": "object", "properties": { "id": { "type": "string" }, "cveId": { "type": "string" }, "scope": { "type": "string", "enum": [ "cve", "host" ] }, "hostId": { "type": [ "string", "null" ] }, "assetKey": { "type": [ "string", "null" ] }, "verdict": { "type": "string", "enum": [ "patch_now", "defer", "accept", "not_affected", "mitigated" ] }, "verdictLabel": { "type": "string" }, "justification": { "type": [ "string", "null" ], "enum": [ "component_not_present", "vulnerable_code_not_present", "vulnerable_code_not_in_execute_path", "vulnerable_code_cannot_be_controlled_by_adversary", "inline_mitigations_already_exist", null ] }, "note": { "type": "string" }, "until": { "type": [ "string", "null" ], "format": "date-time" }, "assumptions": { "type": "array", "items": { "$ref": "#/components/schemas/Assumption" } }, "status": { "type": "string", "enum": [ "active", "review_due", "expired", "stale" ], "description": "stale: an assumption broke; expired: until passed; review_due: a manual assumption's review date passed. Stale and expired decisions stop suppressing alerts." }, "statusLabel": { "type": "string" }, "staleReasons": { "type": "array", "items": { "type": "string" }, "example": [ "entered CISA KEV on 2026-10-27", "EPSS 0.03 → 0.41 (threshold 0.10)" ] }, "statusChangedAt": { "type": "string", "format": "date-time" }, "suppressing": { "type": "boolean", "description": "Whether the decision currently silences host-finding and starred-CVE alerts (accept, not_affected, mitigated, defer before until; active or review_due)." }, "snapshot": { "type": "object", "description": "Signals when recorded or last re-confirmed.", "properties": { "kev": { "type": "boolean" }, "epss": { "type": [ "number", "null" ] }, "maturity": { "type": [ "string", "null" ] }, "cvss": { "type": [ "number", "null" ] } } }, "history": { "type": "array", "items": { "type": "object", "properties": { "from": { "type": [ "string", "null" ] }, "to": { "type": "string" }, "at": { "type": "string", "format": "date-time" }, "kinds": { "type": "array", "items": { "type": "string" } }, "reasons": { "type": "array", "items": { "type": "string" } } } } }, "createdAt": { "type": "string", "format": "date-time" }, "updatedAt": { "type": "string", "format": "date-time" } } } } } }