{"openapi":"3.1.0","info":{"title":"TridentStack Free CVE API","version":"1.0.0","description":"A free, no-key public API for CVE data that leads with remediation: the exact fixed versions and vendor advisories for each affected product, alongside CVSS, EPSS, and CISA KEV status. Each response carries machine-readable source and license provenance. See https://tridentstack.com/cve/about for attribution and licensing.","contact":{"name":"TridentStack","url":"https://tridentstack.com/cve/about"}},"servers":[{"url":"https://tridentstack.com/api/v1","description":"Production"}],"paths":{"/cve/{id}":{"get":{"summary":"Get one CVE with remediation","description":"Returns a full CVE record: CVSS, EPSS, CISA KEV, CWEs, references grouped with NVD tags, and the remediation object (fixed versions + advisories per affected product). Each remediation atom carries its own source and license; dataSources lists only the sources that contributed to this record.","operationId":"getCve","parameters":[{"name":"id","in":"path","required":true,"description":"CVE identifier, e.g. CVE-2026-9698 (case-insensitive).","schema":{"type":"string","pattern":"^CVE-\\d{4}-\\d{4,}$"}}],"responses":{"200":{"description":"The CVE record.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CveRecord"}}}},"400":{"description":"Malformed CVE id."},"404":{"description":"No such CVE in the catalog."},"429":{"description":"Rate limit exceeded. See Retry-After and X-RateLimit-* headers."}}}},"/cve/{id}/osv":{"get":{"summary":"Get one CVE in OSV format","description":"The same CVE remediation in the OSV schema (https://ossf.github.io/osv-schema/) so scanners like Trivy, Grype, and Renovate can consume it natively. Registered OSV ecosystems (PyPI/npm/Debian/Ubuntu/Red Hat/...) are emitted as-is; Apple/Windows/Microsoft/desktop-app ecosystems are TridentStack-extended and flagged in database_specific, which also carries per-source license provenance.","operationId":"getCveOsv","parameters":[{"name":"id","in":"path","required":true,"description":"CVE identifier, e.g. CVE-2026-9698 (case-insensitive).","schema":{"type":"string","pattern":"^CVE-\\d{4}-\\d{4,}$"}}],"responses":{"200":{"description":"The CVE in OSV schema.","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed CVE id."},"404":{"description":"No such CVE in the catalog."},"429":{"description":"Rate limit exceeded."}}}},"/cve":{"get":{"summary":"Search / list CVEs","description":"Keyset-paginated list of CVE summaries. Filter by query, severity, KEV status, EPSS, and year; sort by published date, EPSS, CVSS, CVE id, or fix availability. Returns lean rows; fetch /cve/{id} for full remediation.","operationId":"listCves","parameters":[{"name":"q","in":"query","description":"Free-text search (CVE id or description).","schema":{"type":"string"}},{"name":"severity","in":"query","description":"Severity filter (repeatable).","schema":{"type":"string","enum":["CRITICAL","HIGH","MEDIUM","LOW"]}},{"name":"kev","in":"query","description":"Filter by CISA KEV (actively-exploited) status. 'true' or 'false'.","schema":{"type":"string","enum":["true","false"]}},{"name":"fix","in":"query","description":"Filter by whether a remediation is available. 'true' or 'false'.","schema":{"type":"string","enum":["true","false"]}},{"name":"epss_min","in":"query","description":"Minimum EPSS score (0-1).","schema":{"type":"number","minimum":0,"maximum":1}},{"name":"year","in":"query","description":"CVE year (repeatable).","schema":{"type":"integer"}},{"name":"sort","in":"query","description":"Sort key.","schema":{"type":"string","enum":["published","epss","cvss","cve","fix","kev"]}},{"name":"dir","in":"query","description":"Sort direction.","schema":{"type":"string","enum":["asc","desc"],"default":"desc"}},{"name":"limit","in":"query","description":"Page size (1-100, default 50).","schema":{"type":"integer","minimum":1,"maximum":100,"default":50}},{"name":"cursor","in":"query","description":"Opaque pagination cursor from the previous response's nextCursor.","schema":{"type":"string"}}],"responses":{"200":{"description":"A page of CVE summaries.","content":{"application/json":{"schema":{"type":"object","properties":{"results":{"type":"array","items":{"$ref":"#/components/schemas/CveSummary"}},"nextCursor":{"type":["string","null"],"description":"Pass as cursor to fetch the next page; null at the end."}}}}}},"429":{"description":"Rate limit exceeded."}}}},"/cve/batch":{"post":{"summary":"Batch CVE lookup","description":"Resolve up to 100 CVE ids in one request. Body: { \"ids\": [\"CVE-2024-3094\", ...] }. Returns full records for the ones found plus a notFound list for unknown/invalid ids.","operationId":"batchCve","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"},"maxItems":100}},"required":["ids"]}}}},"responses":{"200":{"description":"Resolved records plus the ids that were not found.","content":{"application/json":{"schema":{"type":"object","properties":{"results":{"type":"array","items":{"$ref":"#/components/schemas/CveRecord"}},"notFound":{"type":"array","items":{"type":"string"}}}}}}},"400":{"description":"Missing 'ids' array, or more than 100 ids."},"429":{"description":"Rate limit exceeded."}}}},"/cve/bulk.jsonl":{"get":{"summary":"Bulk catalog dump (JSON Lines)","description":"Streams the whole catalog, one lean CVE summary per line (cveId, severity, cvss, epss, isKev, hasRemediation, publishedAt, modifiedAt). Use ?after=CVE-XXXX to resume. Pair with /cve/modified.csv to sync only what changed.","operationId":"bulkCve","parameters":[{"name":"after","in":"query","description":"Resume after this CVE id.","schema":{"type":"string"}}],"responses":{"200":{"description":"A JSON Lines stream.","content":{"application/x-ndjson":{}}}}}},"/cve/modified.csv":{"get":{"summary":"Modified-time delta feed","description":"Streams `cve_id,modified` for the whole catalog so consumers can diff against their last sync and re-fetch only the records that changed.","operationId":"modifiedCve","parameters":[{"name":"after","in":"query","description":"Resume after this CVE id.","schema":{"type":"string"}}],"responses":{"200":{"description":"A CSV stream.","content":{"text/csv":{}}}}}}},"components":{"schemas":{"DataSource":{"type":"object","properties":{"name":{"type":"string"},"use":{"type":"string"},"license":{"type":"string"},"url":{"type":["string","null"]}}},"RemediationAtom":{"type":"object","properties":{"fixedVersion":{"type":"string","description":"Version, build, or KB that fixes the CVE for this product."},"affectedRange":{"type":["string","null"]},"advisoryId":{"type":["string","null"]},"sourceUrl":{"type":["string","null"]},"source":{"type":"string","description":"Human-readable source name."},"license":{"type":"string","description":"License of THIS atom (e.g. CC-BY-SA-4.0 for Ubuntu)."},"eol":{"type":["object","null"],"properties":{"eolFrom":{"type":["string","null"]},"eoesFrom":{"type":["string","null"]}},"description":"Present when the fix lands on an end-of-life distro release."}}},"CveRecord":{"type":"object","properties":{"cveId":{"type":"string"},"description":{"type":["string","null"]},"severity":{"type":["string","null"]},"cvss":{"type":["object","null"]},"epss":{"type":["object","null"]},"kev":{"type":["object","null"]},"cwes":{"type":"array","items":{"type":"string"}},"remediation":{"type":"object","properties":{"available":{"type":"boolean"},"products":{"type":"array","items":{"type":"object","properties":{"ecosystem":{"type":"string"},"product":{"type":"string"},"atoms":{"type":"array","items":{"$ref":"#/components/schemas/RemediationAtom"}}}}}}},"references":{"type":"array","items":{"type":"object","properties":{"url":{"type":"string"},"tags":{"type":"array","items":{"type":"string"}}}}},"publishedAt":{"type":["string","null"]},"modifiedAt":{"type":["string","null"]},"dataSources":{"type":"array","items":{"$ref":"#/components/schemas/DataSource"}},"_links":{"type":"object","properties":{"self":{"type":"string"},"html":{"type":"string"}}}}},"CveSummary":{"type":"object","properties":{"cveId":{"type":"string"},"severity":{"type":["string","null"]},"cvss":{"type":["number","null"]},"cvssVersion":{"type":["string","null"],"enum":["2.0","3.x","4.0",null]},"epss":{"type":["number","null"]},"isKev":{"type":"boolean"},"hasRemediation":{"type":"boolean"},"publishedAt":{"type":["string","null"]},"_links":{"type":"object","properties":{"self":{"type":"string"}}}}}}}}