API & Integrations

Put Early Exploitation Intelligence into Your Workflow

Automation-ready delivery for vulnerability management, CTI, SOC, and MSSP workflows. Pro API for deeper evidence and available telemetry; RSS and JSON for monitoring.

View API Docs View Pro Pricing Talk to Sales

Channels

Delivery Options

Choose the channel that matches your workflow — from free monitoring feeds to Enterprise automation.

Pro API

JSON access to early exploitation intelligence — warning status, confidence, evidence, limited sensor telemetry, PoCs, scanner integrations, mentions, tags, and IoCs. Self-serve at $599/mo.

View Pro Pricing

Enterprise

Everything in Pro plus full sensor telemetry, attacker intelligence API, deployable virtual patches (ModSecurity, Cloudflare, AWS WAF), and outbound webhooks.

Talk to Sales

Free KEV JSON Feed

Registered free API with summary KEV catalog fields. Requires a confirmed account and API token.

Free KEV RSS Feed

Registered free RSS with summary KEV catalog updates at GET /feeds/kevs.rss?token=…. Requires a confirmed account and personal feed URL from your dashboard. CISA KEV does not provide RSS — KEV Intelligence does.

Comparison

Free vs Pro Delivery

The Free KEV RSS Feed and Free KEV JSON Feed expose early exploitation warnings with summary fields. Pro API adds deeper evidence and immediate sensor telemetry.

Capability	Free KEV RSS Feed	Free KEV JSON Feed	Pro API
Exploited CVE catalog	Yes (token)	Yes (token)	Yes
Registration required	Yes	Yes	Yes
Confidence scoring	No	No	Yes
Sensor telemetry	No	No	Immediate API access
Full CVSS breakdown	Summary fields	Summary fields	Yes
PoCs and private PoCs	No	No	Yes
Scanner integrations	No	No	Yes
Mentions, tags, IoCs	No	No	Yes
Virtual patch availability	Yes	Yes (token)	Yes
Deployable virtual patch rules	No	No	Enterprise only

Enterprise

Enterprise API

The Enterprise API namespace at /api/v2/enterprise/* mirrors Pro enrichment and adds full sensor telemetry, attacker intelligence, virtual patches, and webhooks. Requires an Enterprise subscription and X-API-Token authentication.

GET /api/v2/enterprise/attackers — ranked source IPs observed targeting KEV Intelligence sensors across KEV-attested CVEs
GET /api/v2/enterprise/attackers/:ip — per-IP profile with cross-CVE context, geo, ASN, and raw request paths and payload samples

View API Docs Attacker Intelligence Talk to Sales

Schema

Pro API Example Fields

Representative enriched fields available via GET /api/v2/pro/kevs — not exposed on the free public feed.

{
  "cve_id": "CVE-2024-1234",
  "title": "...",
  "affected_vendor": "...",
  "affected_product": "...",
  "description": "...",
  "references": ["..."],
  "cvss_score": 9.8,
  "cvss_v3_1": { "base_score": 9.8, "vector": "..." },
  "epss_score": 0.95,
  "exploit_status": { "exploited_in_the_wild": true },
  "cwes": [{ "cwe_id": "CWE-79", "name": "..." }],
  "tags": [{ "name": "wordpress", "colour": "#FF5733" }],
  "proof_of_concepts": [{ "poc_type": "github", "title": "...", "private": false, "quality_confidence": 0.87, "quality_assessed_by": "ai" }],
  "scanner_integrations": [{ "scanner": "Nuclei", "plugin_id": "..." }],
  "mentions": [{ "source": "...", "url": "...", "date": "..." }],
  "iocs": [{ "ioc_type": "ip", "value": "...", "first_seen_at": "..." }],
  "primary_source": { "name": "CISA", "url": "..." },
  "all_sources": [{ "name": "...", "url": "..." }]
}

Sensor telemetry, confidence scoring, and per-observation fields are available on Pro CVE endpoints and related Pro API resources. See the API docs for the full schema.

View API Docs Talk to Sales View Pro Pricing

Automate

Ready to Plug Into Your Workflow?

Start with free RSS or JSON monitoring, upgrade to Pro for enriched automation, or talk to us about Enterprise telemetry and virtual patches.

View API Docs View Pricing