Security data. Ready to build with.

Start with a request

Use /api/v1/ for integrations. No account, token or API key required.

curl 'https://www.clawpit.io/api/v1/cves.json?kev=1&limit=10'

During local development, replace the origin with http://localhost:5101.

Choose your data

GET /api/v1/index.json

Catalog, coverage counts, upstream check times and last successful synchronization.

GET /api/v1/cves.json

Tracked CVEs. Filter with q, kev=1, severity=critical, scope=sources, or comma-separated ids. Sort by updated, epss or cvss.

GET /api/v1/cves/{cve}.json

One CVE, reported affected versions, available fixes, upstream records, CVSS, dated EPSS, KEV status and original references. Replace {cve} with a tracked identifier.

GET /api/v1/changes.json

Material CVE record and KEV changes, plus EPSS crossings of 1%, 10% or 50%. Filter by comma-separated ids (up to 100).

GET /api/v1/news.json

Currently editorially approved, published Egret reports. An empty list means none have been published. Drafts and withdrawn reports are excluded.

GET /api/v1/articles/{id}.json

One published report with reviewer, scope and original-source attribution.

GET /api/v1/sources.json

Original publisher links and short excerpts. These are discovery records, awaiting editorial review. Filters: q, exact publisher, and window=30|90|all (default 30 days).

Pagination and caching

List endpoints accept page (default 1) and limit (default 25, maximum 50). Follow pagination.next until it is null. Pages beyond the result set return an empty list. An empty ids= filter matches nothing.

GET and HEAD responses include ETags and a 60-second cache lifetime. Send If-None-Match to check for changes. Invalid queries return JSON problem details with HTTP 400; unknown endpoints and unavailable reports return 404. Write methods return 405. API requests never trigger scraping or AI generation.

Understand coverage and freshness

The tracker covers the downloaded CISA KEV catalog and CVEs found in monitored sources. Coverage is incomplete across the wider CVE universe. CVE synchronization is scheduled every six hours; enrichment rotates in bounded batches. Failures retain the last successful snapshot. Check the catalog’s upstream success times and each record’s *_checked fields.

CVSS describes reported technical severity. EPSS values run from 0 to 1 and estimate exploitation probability over the next 30 days. KEV inclusion is evidence of known exploitation; absence does not establish safety or personal exposure. Missing values remain null. Unix timestamps use seconds; report dates use ISO 8601 UTC.

Source discovery follows its collection schedule. Reports appear after quality checks, managing-editor sign-off and publication. Change timestamps record when Egret observed a change.

Attribution

Credit Egret (clawpit.io), link back to the relevant record, and retain attribution and links to original publishers and vulnerability providers. Upstream material remains subject to its owners’ terms. Read the terms of use.