<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Analyzing Vulnerability Intelligence

## EPSS API

**Base URL:** `https://api.first.org/data/v1/`

### Get EPSS Scores
```bash
curl "https://api.first.org/data/v1/epss?cve=CVE-2024-1234,CVE-2024-5678"
```

### Get All Scores (CSV)
```bash
curl "https://api.first.org/data/v1/epss?envelope=false" -o epss_scores.csv
```

## CISA KEV Catalog

### Full Catalog (JSON)
```bash
curl https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
```

### Check Specific CVE
```bash
curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json | \
  jq '.vulnerabilities[] | select(.cveID == "CVE-2024-1234")'
```

## NVD API 2.0

**Base URL:** `https://services.nvd.nist.gov/rest/json/cves/2.0`

### Get CVE
```bash
curl "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-1234" \
  -H "apiKey: NVD_API_KEY"
```

### Search by Keyword
```bash
curl "https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=apache+log4j" \
  -H "apiKey: NVD_API_KEY"
```

## Exploit-DB API

### Search Exploits
```bash
searchsploit apache 2.4.49
searchsploit -j apache 2.4.49  # JSON output
```

## Key Prioritization Thresholds

| Signal | Threshold | Action |
|--------|-----------|--------|
| EPSS > 0.9 | Near-certain exploit | Patch immediately |
| CISA KEV | Confirmed exploitation | Patch by due date |
| CVSS >= 9.0 | Critical severity | Prioritize within 48h |
| Public exploit | Available on Exploit-DB | Elevate priority |
