---
title: "Get CVE Timeline"
method: GET
path: "/entities/{entityId}/timeline"
tags: ["CVEs"]
---

# Get CVE Timeline

`GET /entities/{entityId}/timeline`

Returns a chronological list of significant events for a given CVE entity, including CVSS score changes, exploitation reports, vendor advisories, threat intelligence reports, and relationship discoveries.

## Path parameters

- `entityId` string, required

## Response `200`

Successful response containing the timeline events for the CVE.

- TimelineResponse
  - `events` TimelineEvent[] — List of timeline events, ordered from most recent to oldest.
    - `id` string, uuid, required — Unique identifier for the event.
    - `type` 'vulnerability:cvssScoreUpdate' | 'vulnerability:cvssScoreEstimation' | 'vulnerability:cveAssigned' | 'vulnerability:exploitation' | 'vulnerability:vendorAdvisory' | 'relationship:cveExploit' | 'threatIntelligenceReport' | 'trending' | 'firstArticle', required — The event type.
    - `ts` integer, required — Event timestamp in milliseconds since epoch.
    - `updated` integer, required — Last updated timestamp in milliseconds since epoch.
    - `score` number — CVSS score. Present on `vulnerability:cvssScoreUpdate` events.
    - `cvssCategoryEstimate` string — Feedly's estimated severity category. Present on `vulnerability:cvssScoreEstimation` events.
    - `sourceName` string — Name of the source that triggered the event.
    - `update` boolean — Whether this is an update to a previously set value. Present on score and advisory events.
    - `trending` boolean — Whether the CVE is trending. Present on `trending` events.
    - `entryId` string — Feedly entry ID of the article associated with the event.
    - `url` string, uri — URL of the source article or advisory.
    - `vendorName` string — Name of the vendor that issued the advisory. Present on `vulnerability:vendorAdvisory` events.
    - `advisoryId` string — Advisory identifier. Present on `vulnerability:vendorAdvisory` events.
    - `cveId` string — Feedly entity ID of the CVE. Present on `relationship:cveExploit` events.
    - `threatId` string — Feedly entity ID of the related threat (malware or threat actor). Present on `relationship:cveExploit` events.
    - `threatLabel` string — Human-readable name of the related threat. Present on `relationship:cveExploit` events.
    - `summary` string — AI-generated summary of the threat intelligence report. Present on `threatIntelligenceReport` events.

## Other responses

- `401` — Missing or invalid authorization token.
- `404` — Entity not found.

---

[API](https://skmtc.net/feedly/apis/streams-api.md) · [All operations](https://skmtc.net/feedly/apis/streams-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/feedly/streams-api/revisions/d38216a6d069/schema)