---
title: "Searches through the vulnerabilities."
method: POST
path: "/api/v2/riskintelligence/vulnerabilities/search"
tags: ["Risk Intelligence"]
---

# Searches through the vulnerabilities.

`POST /api/v2/riskintelligence/vulnerabilities/search`

Create a search operation for vulnerabilities. This endpoint will not return the list of resulting vulnerabilities, but instead it will return a search key, that can be used to list the vulnerabilities found by using getVulnerabilities operation. 
 **Attention**: Every unique client id can create a maximum of 100000 search key per day. 
 **Attention**: All array type search criteria may take a maximum of 100000 values each.

## Request body

- object
  - `GenericSearchText` string — A generic search text which will be searched over many of the vulnerability fields.
  - `Cves` string[], nullable — The list of CVE ids
  - `EcosystemIds` number[], nullable — The list of ecosystem ids that the companies are defined under.
  - `TagIds` number[], nullable — The list of tag ids that the companies are attributed with.
  - `CvssGreaterThan` number, float — The value of minimum CVSS of the CVE detail. 0 means all CVE details.
  - `CvssLessThan` number, float — The value of maximum CVSS of the CVE detail. 10 means all CVE details.
  - `EpssGreaterThan` number, float — The value of minimum EPSS of the CVE detail. 0 means all CVE details..
  - `EpssLessThan` number, float — The value of maximum EPSS of the CVE detail. 100 means all CVE details.
  - `CurrentExposureGreaterThan` number — The value of minimum current exposure of the vulnerability. 0 means all findings.
  - `CurrentExposureLessThan` number — The value of maximum EPSS of the vulnerability findings. 0 means all findings.
  - `ExploitabilityScoreGreaterThan` number, float — The value of minimum exploitibility score of the vulnerability. 0 means all findings.
  - `ExploitabilityScoreLessThan` number, float — The value of maximum exploitibility score of the vulnerability. 10 means all findings.
  - `AddedToKevDateFrom` string, datetime — The earliest date on which the vulnerability was added to Kev.
  - `AddedToKevDateTo` string, datetime — The latest date on which the vulnerability was added to Kev.
  - `TagApplyDateFrom` string, datetime — The earliest date on which the vulnerability was applied to the tag.
  - `TagApplyDateTo` string, datetime — The latest date on which the vulnerability was applied to the tag.
  - `TagExpiryDateFrom` string, datetime — The earliest date on which the tag was expired.
  - `TagExpiryDateTo` string, datetime — The latest date on which the tag was expired.
  - `InKev` boolean — Indicates whether the CveId related to the relevant finding is one of the known exploited vulnerabilities (KEV) based on CISA’s KEV catalog.
  - `ExploitPoC` boolean — True means vulnerability is exploited PoC.
  - `MentionedCyberSecCom` boolean — The vulnerability is mentioned in cyber security community or not.
  - `ExploitedByThreatActors` boolean — True means vulnerability is exploited Threat Actors.
  - `TagProcess` string — The current status of focus Tag Process.
  - `ConfidenceLevel` 'Low' | 'Medium' | 'High' | 'Very High' — The confidence level of vulnerability.
  - `Lev1LessThan` number, float — The value of maximum LEV1 of the CVE detail. 100 means all CVE details.
  - `Lev1GreaterThan` number, float — The value of minimum LEV1 of the CVE detail. 0 means all CVE details.
  - `Lev2LessThan` number, float — The value of maximum LEV2 of the CVE detail. 100 means all CVE details.
  - `Lev2GreaterThan` number, float — The value of minimum LEV2 of the CVE detail. 0 means all CVE details.
  - `TagConfidences` string[], nullable — The confidence levels of tags

## Response `200`

Success

- object
  - `Key` string, required — A key in GUID format, which points to the newly created company search action. Use this key in getVulnerabilities action as a URL parameter in order to fetch the results. The key has a life time of 6 hours. A new search operation should be performed when the search keys are expired.

## Other responses

- `400` — BadRequest
- `401` — Unauthorized
- `default` — Failure

---

[API](https://skmtc.net/blackkitetech/apis/black-kite-api.md) · [All operations](https://skmtc.net/blackkitetech/apis/black-kite-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/blackkitetech/black-kite-api/revisions/7dadaba760fb/schema)