v1

latestOpenAPI 3.0.0Proprietary - Commercial Use Only2026-08-06172139621.6 KB

Risk Intelligence

Searches through the vulnerabilities.

Create a search operation for vulnerabilities. This endpoint will not return the list of resulting vulnerabilities, but instead it will return a search key, that can be used to list the vulnerabilities found by using getVulnerabilities operation. Attention: Every unique client id can create a maximum of 100000 search key per day. Attention: All array type search criteria may take a maximum of 100000 values each.

post/api/v2/riskintelligence/vulnerabilities/search

Request body

GenericSearchTextstring

A generic search text which will be searched over many of the vulnerability fields.

Cvesstring[] nullable

The list of CVE ids

EcosystemIdsnumber[] nullable

The list of ecosystem ids that the companies are defined under.

TagIdsnumber[] nullable

The list of tag ids that the companies are attributed with.

CvssGreaterThannumber float

The value of minimum CVSS of the CVE detail. 0 means all CVE details.

CvssLessThannumber float

The value of maximum CVSS of the CVE detail. 10 means all CVE details.

EpssGreaterThannumber float

The value of minimum EPSS of the CVE detail. 0 means all CVE details..

EpssLessThannumber float

The value of maximum EPSS of the CVE detail. 100 means all CVE details.

CurrentExposureGreaterThannumber

The value of minimum current exposure of the vulnerability. 0 means all findings.

CurrentExposureLessThannumber

The value of maximum EPSS of the vulnerability findings. 0 means all findings.

ExploitabilityScoreGreaterThannumber float

The value of minimum exploitibility score of the vulnerability. 0 means all findings.

ExploitabilityScoreLessThannumber float

The value of maximum exploitibility score of the vulnerability. 10 means all findings.

AddedToKevDateFromstring datetime

The earliest date on which the vulnerability was added to Kev.

AddedToKevDateTostring datetime

The latest date on which the vulnerability was added to Kev.

TagApplyDateFromstring datetime

The earliest date on which the vulnerability was applied to the tag.

TagApplyDateTostring datetime

The latest date on which the vulnerability was applied to the tag.

TagExpiryDateFromstring datetime

The earliest date on which the tag was expired.

TagExpiryDateTostring datetime

The latest date on which the tag was expired.

InKevboolean

Indicates whether the CveId related to the relevant finding is one of the known exploited vulnerabilities (KEV) based on CISA’s KEV catalog.

ExploitPoCboolean

True means vulnerability is exploited PoC.

MentionedCyberSecComboolean

The vulnerability is mentioned in cyber security community or not.

ExploitedByThreatActorsboolean

True means vulnerability is exploited Threat Actors.

TagProcessstring

The current status of focus Tag Process.

ConfidenceLevel'Low' | 'Medium' | 'High' | 'Very High'

The confidence level of vulnerability.

Lev1LessThannumber float

The value of maximum LEV1 of the CVE detail. 100 means all CVE details.

Lev1GreaterThannumber float

The value of minimum LEV1 of the CVE detail. 0 means all CVE details.

Lev2LessThannumber float

The value of maximum LEV2 of the CVE detail. 100 means all CVE details.

Lev2GreaterThannumber float

The value of minimum LEV2 of the CVE detail. 0 means all CVE details.

TagConfidencesstring[] nullable

The confidence levels of tags

Example request

{
  "GenericSearchText": "CVE-2024",
  "Cves": [
    "CVE-2024-55956"
  ],
  "AddedToKevDateFrom": "1999-09-29T16:47:36.527Z",
  "AddedToKevDateTo": "2001-09-29T16:47:36.527Z",
  "TagApplyDateFrom": "2021-04-01",
  "TagApplyDateTo": "2024-04-01",
  "TagExpiryDateFrom": "2021-04-01",
  "TagExpiryDateTo": "2024-04-01",
  "InKev": true,
  "ExploitPoC": true,
  "MentionedCyberSecCom": true,
  "ExploitedByThreatActors": true,
  "TagProcess": "APPLIED",
  "ConfidenceLevel": "High",
  "TagConfidences": [
    "High"
  ]
}

Response

Success

Keystring required

A key in GUID format, which points to the newly created company search action. Use this key in getVulnerabilities action as a URL parameter in order to fetch the results. The key has a life time of 6 hours. A new search operation should be performed when the search keys are expired.

Example response

{
  "Key": "0f8fad5b-d9cb-469f-a165-70867728950e"
}