API Overview

Interactive API Documentation

The full list of available API endpoints, request/response schemas, and parameter details is available in the interactive OpenAPI (Swagger) documentation at:

https://cvefeed.io/api/docs/

You can browse all endpoints, inspect request and response schemas, and try out API calls directly from the browser. Authentication is required — sign in to CVEFeed.io first, then visit the docs page.

Base URL

https://cvefeed.io/api/

There is no version prefix. Paths such as /api/v1/... do not exist and return 404.

Authentication

Most API requests require authentication via a project-scoped API token. A token has the form cvefeed_<prefix>_<secret> — send the whole string, including the cvefeed_ part:

curl -H "Authorization: Bearer cvefeed_B7gvgDVu_your_secret_here" \
  https://cvefeed.io/api/projects/{project_id}/vulns/

{project_id} is the numeric project ID shown on your project’s API Tokens page (/project/detail/<project-slug>/api-tokens/), labelled Project ID: with a Copy ID button next to it. It does not appear in the app’s URLs — those address a project by its slug — so copy it from that page rather than from the address bar. Each token is bound to a single project — using it against a different project’s ID returns 404.

A few read-only lookup endpoints are public and work without a token — they are marked in the Global table below.

See API Tokens for how to create and manage tokens.

Endpoints

Paths below are relative to the base URL. Copy each path’s trailing slash exactly as listed — a wrong slash does not fail cleanly in either direction. Omitting the slash from a path listed with one returns 301 Moved Permanently with the canonical path in Location, not 404: a GET client that follows redirects still succeeds, but most HTTP clients turn a redirected POST into a GET and drop the body, so the write silently does nothing — always send write requests to the exact path. Adding a slash to a path listed without one returns 404, except /projects/{project_id}/products/search/, which collides with the product-subscription detail route and returns 405 Method Not Allowed.

Project-scoped

Method	Path	Required scope
`GET`	`/projects/{project_id}/`	any token for the project
`GET`	`/projects/{project_id}/vulns/`	`vulnerabilities`
`GET` `POST`	`/projects/{project_id}/products/`	`subscriptions`
`DELETE`	`/projects/{project_id}/products/{product_id}/`	`subscriptions`
`GET`	`/projects/{project_id}/products/search`	`subscriptions`
`GET`	`/projects/{project_id}/alerts/`	`alerts`
`POST`	`/projects/{project_id}/alerts/{id}/mark-as-read/`	`alerts`
`POST`	`/projects/{project_id}/alerts/mark-all-as-read/`	`alerts`
`GET` `POST`	`/projects/{project_id}/email-recipients/`	`integrations`
`PUT` `PATCH` `DELETE`	`/projects/{project_id}/email-recipients/{id}/`	`integrations`
`GET` `POST`	`/projects/{project_id}/api-tokens/`	`project`
`POST`	`/projects/{project_id}/api-tokens/{id}/revoke/`	`project`
`GET`	`/projects/{project_id}/activity-log/`	`activity_log` (Enterprise)

GET /projects/{project_id}/ is the preflight endpoint: any token bound to the project can call it regardless of its scopes, and it returns the project’s tier features, subscription usage, and the calling token’s capability flags.

Some of these operations additionally require an admin or owner role when you authenticate with a session: every method on /projects/{project_id}/api-tokens/ (including revoke) and on /projects/{project_id}/activity-log/, plus POST /projects/{project_id}/email-recipients/ and DELETE /projects/{project_id}/email-recipients/{id}/. On email recipients the restriction is per-method — reading the list (GET) and toggling a recipient (PUT / PATCH) are open to any project member. Token-authenticated requests are governed by scopes instead, so a token with the right scope does not also need an admin role.

Global

Not project-scoped. Endpoints marked token require the vulnerabilities scope; endpoints marked public work with no Authorization header at all (send one anyway and its scope is still enforced). “Minimum tier” is the project owner’s tier — below it the request returns 403.

Method	Path	Auth	Minimum tier
`GET`	`/vulnerability/`, `/vulnerability/{cve_id}/`, `/vulnerability/{cve_id}/change-history/`	public	Free
`GET`	`/cveql/suggestions/`, `/cveql/introspect/`	public	Free
`POST`	`/cveql/search/`, `/cveql/validate/`	public	Free
`GET`	`/product/`, `/product/{id}/`, `/product/{id}/vulnerabilities/`	token	Free
`GET`	`/vendor/`, `/vendor/{id}/`, `/vendor/{id}/products/`	token	Free
`GET`	`/news/`, `/news/{id}/`	token	Free
`GET`	`/cwe/`, `/cwe/{id}/`, `/cwe/{id}/vulnerabilities/`	token	Pro
`GET`	`/capec/`, `/capec/{id}/`	token	Pro
`GET`	`/epss/`, `/epss/shifting-epss-scores`	token	Pro
`GET`	`/exploit-intel/`	token	Pro
`GET`	`/vulnerability/list-by-cpe`, `/product/list-by-cpe`, `/vendor/list-by-cpe`	token	Pro

{cve_id} is the CVE identifier itself — for example /vulnerability/CVE-2024-3094/.

Rate Limits

Authenticated requests are limited by the project owner’s subscription tier — not the individual member’s or token’s. All requests to the same project (from any token or member) share one bucket.

Tier	API requests / min	CVEQL requests / min
Free	30	10
Starter	90	20
Pro	180	30
Enterprise	720	40

CVEQL (/cveql/…) has its own bucket — CVEQL calls do not consume the general API allowance, and vice versa.

Unauthenticated calls to the public endpoints are limited per IP address instead:

Endpoint group	Anonymous limit
`/vulnerability/` and `/vulnerability/{cve_id}/…`	15 / min
`/cveql/…`	5 / min
Everything else	30 / min

Response Format

All responses are JSON. Successful responses return the data directly or wrapped in a pagination envelope:

{
  "count": 42,
  "next": "https://cvefeed.io/api/projects/5127/vulns/?page=2",
  "previous": null,
  "results": [...]
}

Error Responses

Errors return appropriate HTTP status codes with a detail message:

{
  "detail": "Authentication credentials were not provided."
}

Status	Meaning
401	Missing, malformed, expired, or revoked token
403	Token lacks the required scope, or the project owner’s tier is below the endpoint’s minimum
404	Resource not found — see below
429	Rate limit exceeded

A 404 from a project-scoped endpoint is the most commonly misread response. It is returned for:

a mistyped path, or an extra trailing slash on a path listed without one (a missing trailing slash returns a 301 redirect instead — see Endpoints);
a project_id the token is not bound to (each token belongs to exactly one project);
a project you are not a member of;
a project-scoped path called with no credentials at all — the project is resolved before authentication is evaluated, so anonymous requests get 404, not 401.

If you believe your token is valid, check the path against the endpoint tables first.

Token Scopes

API tokens use resource-based scoping. Each endpoint requires a specific scope:

Scope	Endpoints
`vulnerabilities`	`/projects/{project_id}/vulns/` and all global lookup endpoints
`subscriptions`	`/projects/{project_id}/products/`, `/projects/{project_id}/products/search`
`alerts`	`/projects/{project_id}/alerts/`
`integrations`	`/projects/{project_id}/email-recipients/`
`activity_log`	`/projects/{project_id}/activity-log/`
`project`	`/projects/{project_id}/api-tokens/`

A token without the required scope receives a 403 Forbidden response.

Agent & MCP Discovery

CVEFeed publishes machine-readable discovery documents for AI agents and MCP clients:

Resource	Path
API catalog (RFC 9727)	`/.well-known/api-catalog`
Agent Skills index (Cloudflare RFC v0.2.0)	`/.well-known/agent-skills/index.json`
OAuth Protected Resource Metadata (RFC 9728)	`/.well-known/oauth-protected-resource`
MCP Server Card (SEP-1649)	`/.well-known/mcp/server-card.json`

Each skill is also served individually at /.well-known/agent-skills/<slug>/SKILL.md with a SHA-256 digest for integrity verification. For the full natural-language experience via Claude Desktop / Cursor / Cline, see the MCP integration guide.