---
title: "Get single KEV entry"
method: GET
path: "/kev/{kev_uuid}"
tags: ["kev"]
---

# Get single KEV entry

`GET /kev/{kev_uuid}`

## Headers

- `X-Fields` string, mask

## Response `200`

Success

- KEVEntry
  - `uuid` string — KEV entry UUID
  - `vulnerability` Vulnerability
    - `vulnId` string, required — Vulnerability ID
    - `altId` string[] — Alternative vulnerability identifiers
  - `gcve` GCVERoot
    - `origin_uuid` string — UUID of the origin instance where the KEV assertion originated
    - `gna` integer — GNA ID identifying the origin of the KEV assertion (0-65535)
    - `object_uuid` string — UUID of the KEV assertion in the GCVE ecosystem
  - `status` Status
    - `exploited` boolean, required — Exploitation observed
    - `status_reason` 'confirmed' | 'suspected' | 'disputed' | 'historical' | 'unknown', required — Status reason
    - `status_updated_at` string, date-time, required — Status update time
  - `characteristics` object — Technical characteristics
  - `timestamps` object — Temporal context
  - `scope` object — Geographical/sectoral context
  - `evidence` Evidence[] — Supporting evidence
    - `type` 'incident_response' | 'telemetry' | 'honeypot' | 'sinkhole' | 'vendor_report' | 'csirt_report' | 'public_report' | 'research_report' | 'unknown' — Evidence type (optional)
    - `source` string, required — Evidence source (required)
    - `signal` object — Evidence signal (string or array of strings)
    - `confidence` object — Confidence (number 0.0-1.0 or string)
    - `details` object — Implementation-specific details
  - `references` object — Related references

---

[API](https://skmtc.net/vulnerability-lookup/apis/vulnerability-lookup-api.md) · [All operations](https://skmtc.net/vulnerability-lookup/apis/vulnerability-lookup-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vulnerability-lookup/vulnerability-lookup-api/versions/e6ef25beb687/schema)