---
title: "List KEV entries with pagination and filtering"
method: GET
path: "/kev/"
tags: ["kev"]
---

# List KEV entries with pagination and filtering

`GET /kev/`

## Query parameters

- `page` integer
- `per_page` integer
- `vuln_id` string
- `status_reason` 'confirmed' | 'suspected' | 'disputed' | 'historical' | 'unknown'
- `exploited` boolean
- `vulnerability_lookup_origin` string
- `date_from` string, date
- `date_to` string, date
- `author` string

## Headers

- `X-Fields` string, mask

## Response `200`

Success

- KEVList
  - `metadata` ListMetadata
    - `count` integer — Total number of the items of the data.
    - `page` integer — Number of the page.
    - `per_page` integer — Requested limit data.
  - `data` KEVEntry[]
    - `uuid` string — KEV entry UUID
    - `vulnerability` Vulnerability
      - `vulnId` string, required — Vulnerability ID
      - `altId` string[] — Alternative vulnerability identifiers
    - `gcve` GCVERoot
      - `origin_uuid` string — UUID of the origin instance where the KEV assertion originated
      - `gna` integer — GNA ID identifying the origin of the KEV assertion (0-65535)
      - `object_uuid` string — UUID of the KEV assertion in the GCVE ecosystem
    - `status` Status
      - `exploited` boolean, required — Exploitation observed
      - `status_reason` 'confirmed' | 'suspected' | 'disputed' | 'historical' | 'unknown', required — Status reason
      - `status_updated_at` string, date-time, required — Status update time
    - `characteristics` object — Technical characteristics
    - `timestamps` object — Temporal context
    - `scope` object — Geographical/sectoral context
    - `evidence` Evidence[] — Supporting evidence
      - `type` 'incident_response' | 'telemetry' | 'honeypot' | 'sinkhole' | 'vendor_report' | 'csirt_report' | 'public_report' | 'research_report' | 'unknown' — Evidence type (optional)
      - `source` string, required — Evidence source (required)
      - `signal` object — Evidence signal (string or array of strings)
      - `confidence` object — Confidence (number 0.0-1.0 or string)
      - `details` object — Implementation-specific details
    - `references` object — Related references

---

[API](https://skmtc.net/vulnerability-lookup/apis/vulnerability-lookup-api.md) · [All operations](https://skmtc.net/vulnerability-lookup/apis/vulnerability-lookup-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vulnerability-lookup/vulnerability-lookup-api/versions/e6ef25beb687/schema)