{ "openapi": "3.1.0", "info": { "title": "Threatist API", "termsOfService": "https://threatist.io/terms", "version": "1.0.0", "description": "Read-only access to Threatist vulnerability records. Every value carries its source; each record lists its sources once with license and fetch time. Without a key: 60 requests a minute and 1 000 a day per address. Times are RFC 3339 in UTC, dates YYYY-MM-DD; missing values are null and empty lists []. Enum values are lowercase with underscores, apart from CVSS values and severity and priority bands. Changes within /v1 are additive: new fields, endpoints, parameters and enum values can appear at any time, so ignore what you do not know. Removing or renaming a field, or changing its type or meaning, comes only with /v2." }, "servers": [ { "url": "/" } ], "paths": { "/v1/": { "get": { "operationId": "index", "summary": "Describe the API", "responses": { "200": { "description": "OK", "headers": { "RateLimit-Limit": { "$ref": "#/components/headers/RateLimit-Limit" }, "RateLimit-Remaining": { "$ref": "#/components/headers/RateLimit-Remaining" }, "RateLimit-Reset": { "$ref": "#/components/headers/RateLimit-Reset" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Index" } } } }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/openapi.json": { "get": { "operationId": "openapi", "summary": "This OpenAPI document", "responses": { "200": { "description": "OpenAPI 3.1 document", "content": { "application/json": { "schema": { "type": "object" } } } }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/vulns": { "get": { "operationId": "searchVulns", "summary": "Search records", "description": "The filters and sorts of the search page. A value the search page would ignore is a 400 here.", "parameters": [ { "$ref": "#/components/parameters/q" }, { "$ref": "#/components/parameters/sort" }, { "$ref": "#/components/parameters/band" }, { "$ref": "#/components/parameters/signal" }, { "$ref": "#/components/parameters/exploited" }, { "$ref": "#/components/parameters/cwe" }, { "$ref": "#/components/parameters/product" }, { "$ref": "#/components/parameters/published" }, { "$ref": "#/components/parameters/fixStatus" }, { "$ref": "#/components/parameters/impactType" }, { "$ref": "#/components/parameters/attackVector" }, { "$ref": "#/components/parameters/privileges" }, { "$ref": "#/components/parameters/userInteraction" }, { "$ref": "#/components/parameters/vendor" }, { "$ref": "#/components/parameters/component" }, { "$ref": "#/components/parameters/cursor" }, { "$ref": "#/components/parameters/limit" } ], "responses": { "200": { "description": "OK", "headers": { "RateLimit-Limit": { "$ref": "#/components/headers/RateLimit-Limit" }, "RateLimit-Remaining": { "$ref": "#/components/headers/RateLimit-Remaining" }, "RateLimit-Reset": { "$ref": "#/components/headers/RateLimit-Reset" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VulnList" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/vulns/{id}": { "get": { "operationId": "getVuln", "summary": "Get a record", "description": "By TI id. A CVE or GHSA id, another spelling or a merged id answers 308 to the record's TI address.", "parameters": [ { "name": "id", "in": "path", "description": "TI, CVE or GHSA id.", "schema": { "type": "string" }, "required": true } ], "responses": { "200": { "description": "OK", "headers": { "RateLimit-Limit": { "$ref": "#/components/headers/RateLimit-Limit" }, "RateLimit-Remaining": { "$ref": "#/components/headers/RateLimit-Remaining" }, "RateLimit-Reset": { "$ref": "#/components/headers/RateLimit-Reset" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Vuln" } } } }, "308": { "$ref": "#/components/responses/Moved" }, "404": { "$ref": "#/components/responses/NotFound" }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/vendors/{slug}/vulns": { "get": { "operationId": "vendorVulns", "summary": "A vendor's records", "description": "Most urgent first unless sort says otherwise.", "parameters": [ { "name": "slug", "in": "path", "description": "Vendor key.", "schema": { "type": "string" }, "required": true }, { "$ref": "#/components/parameters/q" }, { "$ref": "#/components/parameters/sort" }, { "$ref": "#/components/parameters/band" }, { "$ref": "#/components/parameters/signal" }, { "$ref": "#/components/parameters/exploited" }, { "$ref": "#/components/parameters/cwe" }, { "$ref": "#/components/parameters/product" }, { "$ref": "#/components/parameters/published" }, { "$ref": "#/components/parameters/fixStatus" }, { "$ref": "#/components/parameters/impactType" }, { "$ref": "#/components/parameters/attackVector" }, { "$ref": "#/components/parameters/privileges" }, { "$ref": "#/components/parameters/userInteraction" }, { "$ref": "#/components/parameters/component" }, { "$ref": "#/components/parameters/cursor" }, { "$ref": "#/components/parameters/limit" } ], "responses": { "200": { "description": "OK", "headers": { "RateLimit-Limit": { "$ref": "#/components/headers/RateLimit-Limit" }, "RateLimit-Remaining": { "$ref": "#/components/headers/RateLimit-Remaining" }, "RateLimit-Reset": { "$ref": "#/components/headers/RateLimit-Reset" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VulnList" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "404": { "$ref": "#/components/responses/NotFound" }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/kev": { "get": { "operationId": "kev", "summary": "Known exploited vulnerabilities", "description": "Entries now in CISA's KEV catalogue added in the window, newest first.", "parameters": [ { "name": "since", "in": "query", "description": "Window of the date added.", "schema": { "type": "string", "enum": [ "7d", "30d", "90d", "all" ], "default": "7d" } }, { "$ref": "#/components/parameters/cursor" }, { "$ref": "#/components/parameters/limit" } ], "responses": { "200": { "description": "OK", "headers": { "RateLimit-Limit": { "$ref": "#/components/headers/RateLimit-Limit" }, "RateLimit-Remaining": { "$ref": "#/components/headers/RateLimit-Remaining" }, "RateLimit-Reset": { "$ref": "#/components/headers/RateLimit-Reset" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KEVList" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/advisories/{id}": { "get": { "operationId": "getAdvisory", "summary": "Get a vendor advisory", "description": "RHSA, KB or ADV id; another spelling answers 308 to the canonical one.", "parameters": [ { "name": "id", "in": "path", "description": "RHSA-2021:5129, KB5043050 or ADV230003.", "schema": { "type": "string" }, "required": true } ], "responses": { "200": { "description": "OK", "headers": { "RateLimit-Limit": { "$ref": "#/components/headers/RateLimit-Limit" }, "RateLimit-Remaining": { "$ref": "#/components/headers/RateLimit-Remaining" }, "RateLimit-Reset": { "$ref": "#/components/headers/RateLimit-Reset" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdvisoryDetail" } } } }, "308": { "$ref": "#/components/responses/Moved" }, "404": { "$ref": "#/components/responses/NotFound" }, "429": { "$ref": "#/components/responses/RateLimited" } } } } }, "components": { "schemas": { "Problem": { "type": "object", "description": "RFC 9457 problem detail.", "required": [ "type", "title", "status", "detail", "code" ], "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer" }, "detail": { "type": "string" }, "code": { "type": "string", "enum": [ "not_found", "bad_request", "rate_limited", "method_not_allowed", "internal" ], "description": "Machine-readable error code." } } }, "Index": { "type": "object", "required": [ "name", "version", "docs", "openapi" ], "properties": { "name": { "type": "string" }, "version": { "type": "string" }, "docs": { "type": "string" }, "openapi": { "type": "string" } } }, "Alias": { "type": "object", "description": "Another id of the record, shown after the TI id.", "required": [ "id", "type", "url" ], "properties": { "id": { "type": "string" }, "type": { "type": "string", "enum": [ "CVE", "GHSA" ] }, "url": { "type": [ "string", "null" ] } } }, "Text": { "type": "object", "required": [ "text", "source" ], "properties": { "text": { "type": "string" }, "source": { "type": "string", "description": "Source key, listed once in the record's sources." } } }, "Score": { "type": "object", "description": "A CVSS score.", "required": [ "version", "vector", "baseScore", "severity", "source" ], "properties": { "version": { "type": "string" }, "vector": { "type": "string" }, "baseScore": { "type": "number", "minimum": 0, "maximum": 10 }, "severity": { "type": "string", "enum": [ "CRITICAL", "HIGH", "MEDIUM", "LOW", "NONE" ] }, "source": { "type": "string", "description": "Source key, listed once in the record's sources." } } }, "Attack": { "type": "object", "description": "Attack profile read from the primary CVSS vector, in the names of FIRST's CVSS JSON schemas. A value is null when the vector does not say: user interaction in CVSS 2.0, attack requirements before CVSS 4.0.", "required": [ "version", "attackVector", "privilegesRequired", "userInteraction", "attackComplexity", "attackRequirements", "confidentiality", "integrity", "availability", "source" ], "properties": { "version": { "type": "string", "description": "CVSS version of the primary vector." }, "attackVector": { "type": [ "string", "null" ], "enum": [ "NETWORK", "ADJACENT_NETWORK", "LOCAL", "PHYSICAL", null ] }, "privilegesRequired": { "type": [ "string", "null" ], "enum": [ "NONE", "LOW", "HIGH", null ], "description": "CVSS 2.0: from authentication, none → NONE, single or multiple → LOW." }, "userInteraction": { "type": [ "string", "null" ], "enum": [ "NONE", "REQUIRED", "PASSIVE", "ACTIVE", null ], "description": "PASSIVE and ACTIVE in CVSS 4.0 only." }, "attackComplexity": { "type": [ "string", "null" ], "enum": [ "LOW", "MEDIUM", "HIGH", null ], "description": "MEDIUM in CVSS 2.0 only." }, "attackRequirements": { "type": [ "string", "null" ], "enum": [ "NONE", "PRESENT", null ], "description": "CVSS 4.0 only." }, "confidentiality": { "type": [ "string", "null" ], "enum": [ "NONE", "LOW", "HIGH", "PARTIAL", "COMPLETE", null ], "description": "Impact on the vulnerable system; PARTIAL and COMPLETE in CVSS 2.0 only." }, "integrity": { "type": [ "string", "null" ], "enum": [ "NONE", "LOW", "HIGH", "PARTIAL", "COMPLETE", null ] }, "availability": { "type": [ "string", "null" ], "enum": [ "NONE", "LOW", "HIGH", "PARTIAL", "COMPLETE", null ] }, "source": { "type": "string", "description": "Source key of the primary CVSS, listed once in the record's sources." } } }, "ImpactType": { "type": "object", "description": "One impact type of the record: the impact the vendor states (Microsoft) comes first and alone; else each CWE through Threatist's reviewed table, where memory and read weaknesses take the impact from the primary CVSS. An empty list means no single impact is known.", "required": [ "type", "source" ], "properties": { "type": { "type": "string", "enum": [ "code_execution", "privilege_escalation", "security_bypass", "information_disclosure", "tampering", "denial_of_service", "spoofing", "cross_site_scripting", "sql_injection" ] }, "source": { "type": "string", "description": "\"microsoft\", or the CWE id the type was read from." } } }, "EPSS": { "type": "object", "required": [ "score", "percentile", "date", "source" ], "properties": { "score": { "type": "number", "minimum": 0, "maximum": 1 }, "percentile": { "type": "number", "minimum": 0, "maximum": 1 }, "date": { "type": "string", "format": "date" }, "source": { "type": "string", "description": "Source key, listed once in the record's sources." } } }, "KEV": { "type": "object", "description": "Listed in CISA's Known Exploited Vulnerabilities catalogue.", "required": [ "dateAdded", "dueDate", "ransomware", "source" ], "properties": { "dateAdded": { "type": [ "string", "null" ], "format": "date" }, "dueDate": { "type": [ "string", "null" ], "format": "date" }, "ransomware": { "type": [ "string", "null" ], "enum": [ "known", "unknown", null ] }, "source": { "type": "string", "description": "Source key, listed once in the record's sources." } } }, "KEVRemoval": { "type": "object", "description": "Removed from the KEV catalogue.", "required": [ "added", "removed", "source" ], "properties": { "added": { "type": [ "string", "null" ], "format": "date" }, "removed": { "type": "string", "format": "date" }, "source": { "type": "string", "description": "Source key, listed once in the record's sources." } } }, "CWE": { "type": "object", "required": [ "id", "name", "sources" ], "properties": { "id": { "type": "string", "pattern": "^CWE-[0-9]+$" }, "name": { "type": [ "string", "null" ], "description": "MITRE's name of the weakness." }, "sources": { "type": "array", "items": { "type": "string" } } } }, "SSVC": { "type": "object", "description": "CISA's SSVC decision points for the record.", "required": [ "exploitation", "automatable", "technicalImpact", "version", "source" ], "properties": { "exploitation": { "type": [ "string", "null" ] }, "automatable": { "type": [ "string", "null" ] }, "technicalImpact": { "type": [ "string", "null" ] }, "version": { "type": [ "string", "null" ] }, "source": { "type": "string", "description": "Source key, listed once in the record's sources." } } }, "Range": { "type": "object", "description": "Affected versions: from introduced, below lessThan or up to and including upTo. From the CNA, introduced without lessThan and upTo is that one version only, unless the product's defaultStatus is affected (as the Linux kernel CNA writes it): then it is the first affected version, and the versions in fixed are not affected. From GHSA, a range without an end is affected from introduced on. Versions are as the source writes them.", "required": [ "introduced", "lessThan", "upTo" ], "properties": { "introduced": { "type": [ "string", "null" ] }, "lessThan": { "type": [ "string", "null" ] }, "upTo": { "type": [ "string", "null" ] } } }, "Affected": { "type": "object", "required": [ "product", "vendor", "ecosystem", "ranges", "lastKnownAffected", "fixed", "status", "defaultStatus", "source" ], "properties": { "product": { "type": [ "string", "null" ] }, "vendor": { "type": [ "string", "null" ] }, "ecosystem": { "type": [ "string", "null" ] }, "ranges": { "type": "array", "items": { "$ref": "#/components/schemas/Range" } }, "lastKnownAffected": { "type": [ "string", "null" ] }, "fixed": { "type": "array", "items": { "type": "string" } }, "status": { "type": "string", "enum": [ "fix_available", "no_fix_listed", "not_affected" ] }, "defaultStatus": { "type": [ "string", "null" ], "description": "The CNA's status of the versions it does not list: affected, unaffected or unknown; null when the source gives none. It decides what a lone version in ranges means." }, "source": { "type": "string", "description": "Source key, listed once in the record's sources." } } }, "CPE": { "type": "object", "description": "A vulnerable CPE match of NVD's configurations. NVD gives each version range as its own match, so one CPE string can appear once per range.", "required": [ "criteria", "versionStartIncluding", "versionStartExcluding", "versionEndIncluding", "versionEndExcluding", "source" ], "properties": { "criteria": { "type": "string" }, "versionStartIncluding": { "type": [ "string", "null" ] }, "versionStartExcluding": { "type": [ "string", "null" ] }, "versionEndIncluding": { "type": [ "string", "null" ] }, "versionEndExcluding": { "type": [ "string", "null" ] }, "source": { "type": "string", "description": "Source key, listed once in the record's sources." } } }, "AdvisoryProduct": { "type": "object", "required": [ "name", "packages" ], "properties": { "name": { "type": "string" }, "packages": { "type": "array", "items": { "type": "string" } } } }, "Advisory": { "type": "object", "description": "A vendor advisory or update that fixes the record.", "required": [ "id", "kind", "title", "severity", "released", "url", "products", "source" ], "properties": { "id": { "type": "string" }, "kind": { "type": "string", "enum": [ "rhsa", "kb", "adv" ], "description": "rhsa: Red Hat Security Advisory; kb: Microsoft update; adv: Microsoft security advisory." }, "title": { "type": "string" }, "severity": { "type": [ "string", "null" ], "description": "The vendor's own rating." }, "released": { "type": [ "string", "null" ], "format": "date" }, "url": { "type": "string" }, "products": { "type": "array", "items": { "$ref": "#/components/schemas/AdvisoryProduct" } }, "source": { "type": "string", "description": "Source key, listed once in the record's sources." } } }, "RedHatFixed": { "type": "object", "required": [ "product", "advisories" ], "properties": { "product": { "type": "string" }, "advisories": { "type": "array", "items": { "type": "string" } } } }, "RedHatAffected": { "type": "object", "required": [ "product", "plan", "details" ], "properties": { "product": { "type": "string" }, "plan": { "type": [ "string", "null" ], "enum": [ "no_fix_planned", "none_available", null ] }, "details": { "type": [ "string", "null" ] } } }, "RedHatAssessment": { "type": "object", "required": [ "severity", "fixed", "affected", "notAffected", "source" ], "properties": { "severity": { "type": [ "string", "null" ] }, "fixed": { "type": "array", "items": { "$ref": "#/components/schemas/RedHatFixed" } }, "affected": { "type": "array", "items": { "$ref": "#/components/schemas/RedHatAffected" } }, "notAffected": { "type": "array", "items": { "type": "string" } }, "source": { "type": "string", "description": "Source key, listed once in the record's sources." } } }, "MicrosoftFix": { "type": "object", "required": [ "product", "build", "type", "url" ], "properties": { "product": { "type": "string" }, "build": { "type": [ "string", "null" ] }, "type": { "type": [ "string", "null" ] }, "url": { "type": [ "string", "null" ] } } }, "MicrosoftAssessment": { "type": "object", "required": [ "impact", "exploited", "publiclyDisclosed", "exploitability", "otherFixes", "noFix", "source" ], "properties": { "impact": { "type": [ "string", "null" ] }, "exploited": { "type": [ "boolean", "null" ] }, "publiclyDisclosed": { "type": [ "boolean", "null" ] }, "exploitability": { "type": [ "string", "null" ] }, "otherFixes": { "type": "array", "items": { "$ref": "#/components/schemas/MicrosoftFix" } }, "noFix": { "type": "array", "items": { "type": "string" } }, "source": { "type": "string", "description": "Source key, listed once in the record's sources." } } }, "Assessments": { "type": "object", "description": "Vendors' own assessments of the record.", "required": [ "redhat", "microsoft" ], "properties": { "redhat": { "anyOf": [ { "$ref": "#/components/schemas/RedHatAssessment" }, { "type": "null" } ] }, "microsoft": { "anyOf": [ { "$ref": "#/components/schemas/MicrosoftAssessment" }, { "type": "null" } ] } } }, "Reference": { "type": "object", "required": [ "url", "name", "kind", "exploitBy", "sources" ], "properties": { "url": { "type": "string" }, "name": { "type": [ "string", "null" ] }, "kind": { "type": "string", "enum": [ "exploit", "patch", "advisory", "other" ] }, "exploitBy": { "type": "array", "items": { "type": "string" }, "description": "Sources that tag the link as an exploit." }, "sources": { "type": "array", "items": { "type": "string" } } } }, "Event": { "type": "object", "required": [ "type", "at", "source", "old", "new" ], "properties": { "type": { "type": "string", "description": "What changed, such as published, kev_added, fix_available." }, "at": { "type": "string", "format": "date-time" }, "source": { "type": "string", "description": "Source key, listed once in the record's sources." }, "old": { "description": "The value before, or null." }, "new": { "description": "The value after, or null." } } }, "Priority": { "type": "object", "description": "Threatist priority: score, band and confidence only.", "required": [ "score", "band", "confidence" ], "properties": { "score": { "type": "integer", "minimum": 0, "maximum": 100 }, "band": { "type": "string", "enum": [ "CRITICAL", "HIGH", "MEDIUM", "LOW" ] }, "confidence": { "type": "string", "enum": [ "high", "medium", "low" ] } } }, "Rejection": { "type": "object", "description": "Why the record was rejected; fields are null when the source gave no rejection notice.", "required": [ "alias", "reason", "date", "source" ], "properties": { "alias": { "type": [ "string", "null" ] }, "reason": { "type": [ "string", "null" ] }, "date": { "type": [ "string", "null" ], "format": "date" }, "source": { "type": [ "string", "null" ], "description": "Source key, listed once in the record's sources." } } }, "Source": { "type": "object", "description": "A data source with its license and when Threatist last read it.", "required": [ "source", "name", "url", "license", "licenseUrl", "notice", "fetchedAt" ], "properties": { "source": { "type": "string" }, "name": { "type": "string" }, "url": { "type": "string" }, "license": { "type": [ "string", "null" ] }, "licenseUrl": { "type": [ "string", "null" ] }, "notice": { "type": [ "string", "null" ] }, "fetchedAt": { "type": [ "string", "null" ], "format": "date-time" } } }, "Generated": { "type": "object", "description": "Description and solution written by a language model from this record's facts only, apart from the sources' data. Null when the record has none (records created before the feature started have none).", "required": [ "title", "description", "solution", "model", "generatedAt" ], "properties": { "title": { "type": [ "string", "null" ], "description": "A short headline; null for summaries written before titles." }, "description": { "type": "string" }, "solution": { "type": "string" }, "model": { "type": "string", "description": "The model that wrote the texts, e.g. claude-haiku-5-5." }, "generatedAt": { "type": "string", "format": "date-time" } } }, "Vuln": { "type": "object", "description": "A Threatist record. Missing values are null, empty lists [].", "required": [ "id", "state", "aliases", "title", "published", "updated", "description", "cvss", "otherScores", "attack", "fixStatus", "impactTypes", "epss", "kev", "kevRemoval", "cwes", "ssvc", "affected", "cpes", "advisories", "assessments", "references", "timeline", "priority", "rejection", "sources", "generated", "links" ], "properties": { "id": { "type": "string", "pattern": "^TI-[0-9]{4}-[0-9]{5,}$", "description": "Threatist id, always the primary id of a record." }, "state": { "type": "string", "enum": [ "active", "rejected" ] }, "aliases": { "type": "array", "items": { "$ref": "#/components/schemas/Alias" } }, "title": { "type": [ "string", "null" ] }, "published": { "type": [ "string", "null" ], "format": "date" }, "updated": { "type": [ "string", "null" ], "format": "date" }, "description": { "anyOf": [ { "$ref": "#/components/schemas/Text" }, { "type": "null" } ] }, "cvss": { "anyOf": [ { "$ref": "#/components/schemas/Score" }, { "type": "null" } ] }, "otherScores": { "type": "array", "items": { "$ref": "#/components/schemas/Score" } }, "attack": { "anyOf": [ { "$ref": "#/components/schemas/Attack" }, { "type": "null" } ] }, "fixStatus": { "type": [ "string", "null" ], "enum": [ "fixed", "partial", "will_not_fix", "deferred", "no_fix_listed", null ], "description": "One fix state for the record. A fixed version from the CNA or a GitHub advisory, a Red Hat fix or a vendor fix advisory (RHSA, KB) counts as a fix; partial when Red Hat still lists products without one. will_not_fix and deferred come from Red Hat's plans when no source gives a fix. null when no source lists a product." }, "impactTypes": { "type": "array", "items": { "$ref": "#/components/schemas/ImpactType" } }, "epss": { "anyOf": [ { "$ref": "#/components/schemas/EPSS" }, { "type": "null" } ] }, "kev": { "anyOf": [ { "$ref": "#/components/schemas/KEV" }, { "type": "null" } ] }, "kevRemoval": { "anyOf": [ { "$ref": "#/components/schemas/KEVRemoval" }, { "type": "null" } ] }, "cwes": { "type": "array", "items": { "$ref": "#/components/schemas/CWE" } }, "ssvc": { "anyOf": [ { "$ref": "#/components/schemas/SSVC" }, { "type": "null" } ] }, "affected": { "type": "array", "items": { "$ref": "#/components/schemas/Affected" } }, "cpes": { "type": "array", "items": { "$ref": "#/components/schemas/CPE" } }, "advisories": { "type": "array", "items": { "$ref": "#/components/schemas/Advisory" } }, "assessments": { "$ref": "#/components/schemas/Assessments" }, "references": { "type": "array", "items": { "$ref": "#/components/schemas/Reference" } }, "timeline": { "type": "array", "items": { "$ref": "#/components/schemas/Event" } }, "priority": { "anyOf": [ { "$ref": "#/components/schemas/Priority" }, { "type": "null" } ] }, "rejection": { "anyOf": [ { "$ref": "#/components/schemas/Rejection" }, { "type": "null" } ] }, "sources": { "type": "array", "items": { "$ref": "#/components/schemas/Source" } }, "generated": { "anyOf": [ { "$ref": "#/components/schemas/Generated" }, { "type": "null" } ] }, "links": { "type": "object", "description": "self: this resource in the API; html: the page on threatist.", "additionalProperties": { "type": "string" } } } }, "VulnSummary": { "type": "object", "description": "A record in a list.", "required": [ "id", "aliases", "title", "published", "cvss", "epss", "kev", "priority", "cwes", "fixAvailable", "links" ], "properties": { "id": { "type": "string", "pattern": "^TI-[0-9]{4}-[0-9]{5,}$", "description": "Threatist id, always the primary id of a record." }, "aliases": { "type": "array", "items": { "$ref": "#/components/schemas/Alias" } }, "title": { "type": [ "string", "null" ] }, "published": { "type": [ "string", "null" ], "format": "date" }, "cvss": { "anyOf": [ { "$ref": "#/components/schemas/Score" }, { "type": "null" } ] }, "epss": { "anyOf": [ { "$ref": "#/components/schemas/EPSS" }, { "type": "null" } ] }, "kev": { "anyOf": [ { "$ref": "#/components/schemas/KEV" }, { "type": "null" } ] }, "priority": { "anyOf": [ { "$ref": "#/components/schemas/Priority" }, { "type": "null" } ] }, "cwes": { "type": "array", "items": { "$ref": "#/components/schemas/CWE" } }, "fixAvailable": { "type": "boolean", "description": "A fix exists: fixStatus is fixed or partial." }, "links": { "type": "object", "description": "self: this resource in the API; html: the page on threatist.", "additionalProperties": { "type": "string" } } } }, "VulnList": { "type": "object", "required": [ "data", "next", "total", "sort" ], "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/VulnSummary" } }, "next": { "type": [ "string", "null" ], "description": "Cursor of the next page; null on the last page." }, "total": { "type": "integer", "minimum": 0 }, "sort": { "type": "string", "enum": [ "relevance", "newest", "priority", "cvss", "epss" ], "description": "The sort that was applied." } } }, "KEVEntry": { "type": "object", "description": "A KEV entry; id is null while the CVE has no Threatist record.", "required": [ "cve", "id", "vendorProject", "product", "name", "dateAdded", "dueDate", "ransomware", "priority", "source", "links" ], "properties": { "cve": { "type": "string" }, "id": { "type": [ "string", "null" ], "pattern": "^TI-[0-9]{4}-[0-9]{5,}$", "description": "Threatist id, always the primary id of a record." }, "vendorProject": { "type": "string" }, "product": { "type": "string" }, "name": { "type": [ "string", "null" ] }, "dateAdded": { "type": "string", "format": "date" }, "dueDate": { "type": [ "string", "null" ], "format": "date" }, "ransomware": { "type": "string", "enum": [ "known", "unknown" ] }, "priority": { "anyOf": [ { "$ref": "#/components/schemas/Priority" }, { "type": "null" } ] }, "source": { "type": "string", "description": "Source key, listed once in the record's sources." }, "links": { "type": "object", "description": "self: this resource in the API; html: the page on threatist.", "additionalProperties": { "type": "string" } } } }, "KEVList": { "type": "object", "required": [ "data", "next", "total" ], "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/KEVEntry" } }, "next": { "type": [ "string", "null" ], "description": "Cursor of the next page; null on the last page." }, "total": { "type": "integer", "minimum": 0 } } }, "AdvisoryDetail": { "type": "object", "description": "An advisory with the CVEs it lists and their records.", "required": [ "id", "kind", "title", "severity", "released", "url", "products", "source", "cves", "records", "links" ], "properties": { "id": { "type": "string" }, "kind": { "type": "string", "enum": [ "rhsa", "kb", "adv" ], "description": "rhsa: Red Hat Security Advisory; kb: Microsoft update; adv: Microsoft security advisory." }, "title": { "type": "string" }, "severity": { "type": [ "string", "null" ], "description": "The vendor's own rating." }, "released": { "type": [ "string", "null" ], "format": "date" }, "url": { "type": "string" }, "products": { "type": "array", "items": { "$ref": "#/components/schemas/AdvisoryProduct" } }, "source": { "type": "string", "description": "Source key, listed once in the record's sources." }, "cves": { "type": "array", "items": { "type": "string" } }, "records": { "type": "array", "items": { "$ref": "#/components/schemas/VulnSummary" }, "description": "Active records the CVEs lead to, most urgent first, at most 500." }, "links": { "type": "object", "description": "self: this resource in the API; html: the page on threatist.", "additionalProperties": { "type": "string" } } } } }, "parameters": { "limit": { "name": "limit", "in": "query", "description": "Page size.", "schema": { "type": "integer", "minimum": 1, "maximum": 100, "default": 25 } }, "cursor": { "name": "cursor", "in": "query", "description": "The next value of the previous page.", "schema": { "type": "string" } }, "q": { "name": "q", "in": "query", "description": "Text, an id (TI, CVE, GHSA) or words.", "schema": { "type": "string", "maxLength": 200 } }, "sort": { "name": "sort", "in": "query", "description": "Default: relevance with q, newest without. relevance needs q.", "schema": { "type": "string", "enum": [ "relevance", "newest", "priority", "cvss", "epss" ] } }, "band": { "name": "band", "in": "query", "description": "Priority bands, any of (case-insensitive). Repeat or separate with commas.", "schema": { "type": "array", "items": { "type": "string", "enum": [ "CRITICAL", "HIGH", "MEDIUM", "LOW" ] } }, "explode": true }, "signal": { "name": "signal", "in": "query", "description": "kev: in KEV; fix: fixStatus is fixed or partial; nofix: fixStatus is no-fix-listed, will-not-fix or deferred; cve: has a CVE id. All must match.", "schema": { "type": "array", "items": { "type": "string", "enum": [ "kev", "fix", "nofix", "cve" ] } }, "explode": true }, "exploited": { "name": "exploited", "in": "query", "description": "true is the same as signal=kev.", "schema": { "type": "boolean" } }, "cwe": { "name": "cwe", "in": "query", "description": "CWE ids, any of.", "schema": { "type": "array", "items": { "type": "string", "pattern": "^CWE-[0-9]{1,6}$" } }, "explode": true }, "product": { "name": "product", "in": "query", "description": "Affected products, any of.", "schema": { "type": "array", "items": { "type": "string", "maxLength": 200 }, "maxItems": 20 }, "explode": true }, "published": { "name": "published", "in": "query", "description": "Published in the last 7 days, 30 days or 12 months.", "schema": { "type": "string", "enum": [ "7d", "30d", "12m" ] } }, "fixStatus": { "name": "fixStatus", "in": "query", "description": "Fix states, any of (case-insensitive; hyphens are taken for underscores, as in the portal's addresses), as fixStatus in a record. Repeat or separate with commas.", "schema": { "type": "array", "items": { "type": "string", "enum": [ "fixed", "partial", "will_not_fix", "deferred", "no_fix_listed" ] } }, "explode": true }, "impactType": { "name": "impactType", "in": "query", "description": "Impact types, any of (case-insensitive; hyphens are taken for underscores, as in the portal's addresses), as impactTypes[].type in a record. Repeat or separate with commas.", "schema": { "type": "array", "items": { "type": "string", "enum": [ "code_execution", "privilege_escalation", "security_bypass", "information_disclosure", "tampering", "denial_of_service", "spoofing", "cross_site_scripting", "sql_injection" ] } }, "explode": true }, "attackVector": { "name": "attackVector", "in": "query", "description": "Attack vector of the primary CVSS, any of (case-insensitive). Repeat or separate with commas.", "schema": { "type": "array", "items": { "type": "string", "enum": [ "network", "adjacent", "local", "physical" ] } }, "explode": true }, "privileges": { "name": "privileges", "in": "query", "description": "none: the primary CVSS needs no privileges (CVSS 2.0: no authentication).", "schema": { "type": "string", "enum": [ "none" ] } }, "userInteraction": { "name": "userInteraction", "in": "query", "description": "none: the primary CVSS needs no user interaction (CVSS 2.0 records do not match, as 2.0 does not record it).", "schema": { "type": "string", "enum": [ "none" ] } }, "vendor": { "name": "vendor", "in": "query", "description": "Vendor key, as in /vendors/{slug}.", "schema": { "type": "string" } }, "component": { "name": "component", "in": "query", "description": "A product of the vendor; needs vendor.", "schema": { "type": "string" } } }, "headers": { "RateLimit-Limit": { "description": "Requests allowed in the window.", "schema": { "type": "integer" } }, "RateLimit-Remaining": { "description": "Requests left in the window.", "schema": { "type": "integer" } }, "RateLimit-Reset": { "description": "Seconds until the window resets.", "schema": { "type": "integer" } } }, "responses": { "BadRequest": { "description": "A query parameter is not valid.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "NotFound": { "description": "No such resource.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "RateLimited": { "description": "The quota is used up.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "headers": { "Retry-After": { "description": "Seconds to wait.", "schema": { "type": "integer" } } } }, "Moved": { "description": "The canonical address of the resource.", "headers": { "Location": { "schema": { "type": "string" } } } } } } }