<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Vulnerability Prioritization

## FIRST EPSS API

| Endpoint | Description |
|---|---|
| `GET /data/v1/epss?cve=CVE-XXXX-XXXX` | Single CVE EPSS score |
| `GET /data/v1/epss?cve=CVE-1,CVE-2` | Bulk CVE EPSS lookup |
| `GET /data/v1/epss?epss-gt=0.5` | All CVEs above threshold |
| `GET /data/v1/epss?percentile-gt=0.95` | Top 5% exploitable CVEs |

### Response Fields

| Field | Type | Description |
|---|---|---|
| `cve` | string | CVE identifier |
| `epss` | float | Exploitation probability (0–1) |
| `percentile` | float | Percentile rank among all CVEs |
| `date` | string | Score calculation date |

## CISA KEV API

| Endpoint | Description |
|---|---|
| `GET /feeds/known_exploited_vulnerabilities.json` | Full KEV catalog JSON |

### KEV Entry Fields

| Field | Type | Description |
|---|---|---|
| `cveID` | string | CVE identifier |
| `vendorProject` | string | Affected vendor |
| `product` | string | Affected product |
| `dateAdded` | string | Date added to KEV |
| `dueDate` | string | Required remediation deadline |
| `knownRansomwareCampaignUse` | string | Known/Unknown ransomware use |

## Agent Script

```bash
# Query EPSS scores
node agent.js epss CVE-2024-3400 CVE-2023-44228

# Check KEV status
node agent.js kev-check CVE-2024-3400 --catalog kev_catalog.json

# Calculate priority
node agent.js prioritize --cve CVE-2024-3400 --cvss 10.0 --epss 0.94 --kev --asset-tier 1

# Download KEV catalog
node agent.js download-kev --output kev_catalog.json
```
