{"openapi":"3.1.0","info":{"title":"KEVWire API","version":"1.0.0","description":"Read-only, evidence-first security intelligence. Every record carries exact source URLs, measurement dates, and provenance. Missing metrics are null (unknown), never zero. Also available as an MCP server at /mcp."},"servers":[{"url":"https://kevwire.com"}],"paths":{"/api/intel":{"get":{"operationId":"searchRecords","summary":"Search and filter records (paginated)","parameters":[{"name":"q","in":"query","schema":{"type":"string","maxLength":500},"description":"Words to match (all must appear): CVE IDs, products, event names, headlines."},{"name":"kind","in":"query","schema":{"type":"string","enum":["vulnerability","breach","advisory","ai-research"]}},{"name":"kev","in":"query","schema":{"type":"boolean"},"description":"Only CISA Known Exploited Vulnerabilities."},{"name":"stacks","in":"query","schema":{"type":"string"},"description":"Comma-separated technology labels (any match). See metadata.technologies."},{"name":"hide","in":"query","schema":{"type":"string"},"description":"Comma-separated source IDs to exclude (see /api/sources)."},{"name":"region","in":"query","schema":{"type":"string"}},{"name":"ai","in":"query","schema":{"type":"string","enum":["any","defense","offense","infrastructure","unknown","none"]}},{"name":"sort","in":"query","schema":{"type":"string","enum":["urgent","newest","priority","epss","cvss"],"default":"urgent"}},{"name":"offset","in":"query","schema":{"type":"integer","minimum":0}},{"name":"limit","in":"query","schema":{"type":"integer","minimum":1,"maximum":100,"default":25}}],"responses":{"200":{"description":"A page of records with pagination, sources, stats, and technology labels.","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/api/record/{id}":{"get":{"operationId":"getRecord","summary":"One record by CVE, GHSA, or KEVWire ID","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"The record.","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"Not found."}}}},"/api/sources":{"get":{"operationId":"listSources","summary":"Source scope, limitations, and retrieval status","responses":{"200":{"description":"Sources.","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/api/health":{"get":{"operationId":"health","summary":"Ingestion health","responses":{"200":{"description":"Health.","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/api/trends":{"get":{"operationId":"trends","summary":"Monthly CISA KEV additions with methodology","responses":{"200":{"description":"Trend series.","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/api/export.json":{"get":{"operationId":"exportJson","summary":"All matching records (same filters, unpaginated unless limit is set)","parameters":[{"name":"q","in":"query","schema":{"type":"string","maxLength":500},"description":"Words to match (all must appear): CVE IDs, products, event names, headlines."},{"name":"kind","in":"query","schema":{"type":"string","enum":["vulnerability","breach","advisory","ai-research"]}},{"name":"kev","in":"query","schema":{"type":"boolean"},"description":"Only CISA Known Exploited Vulnerabilities."},{"name":"stacks","in":"query","schema":{"type":"string"},"description":"Comma-separated technology labels (any match). See metadata.technologies."},{"name":"hide","in":"query","schema":{"type":"string"},"description":"Comma-separated source IDs to exclude (see /api/sources)."},{"name":"region","in":"query","schema":{"type":"string"}},{"name":"ai","in":"query","schema":{"type":"string","enum":["any","defense","offense","infrastructure","unknown","none"]}},{"name":"sort","in":"query","schema":{"type":"string","enum":["urgent","newest","priority","epss","cvss"],"default":"urgent"}},{"name":"offset","in":"query","schema":{"type":"integer","minimum":0}},{"name":"limit","in":"query","schema":{"type":"integer","minimum":1,"maximum":100,"default":25}}],"responses":{"200":{"description":"Export.","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/api/export.csv":{"get":{"operationId":"exportCsv","summary":"All matching records as CSV","parameters":[{"name":"q","in":"query","schema":{"type":"string","maxLength":500},"description":"Words to match (all must appear): CVE IDs, products, event names, headlines."},{"name":"kind","in":"query","schema":{"type":"string","enum":["vulnerability","breach","advisory","ai-research"]}},{"name":"kev","in":"query","schema":{"type":"boolean"},"description":"Only CISA Known Exploited Vulnerabilities."},{"name":"stacks","in":"query","schema":{"type":"string"},"description":"Comma-separated technology labels (any match). See metadata.technologies."},{"name":"hide","in":"query","schema":{"type":"string"},"description":"Comma-separated source IDs to exclude (see /api/sources)."},{"name":"region","in":"query","schema":{"type":"string"}},{"name":"ai","in":"query","schema":{"type":"string","enum":["any","defense","offense","infrastructure","unknown","none"]}},{"name":"sort","in":"query","schema":{"type":"string","enum":["urgent","newest","priority","epss","cvss"],"default":"urgent"}},{"name":"offset","in":"query","schema":{"type":"integer","minimum":0}},{"name":"limit","in":"query","schema":{"type":"integer","minimum":1,"maximum":100,"default":25}}],"responses":{"200":{"description":"CSV.","content":{"text/csv":{"schema":{"type":"string"}}}}}}},"/feed.xml":{"get":{"operationId":"rss","summary":"RSS for any filter","parameters":[{"name":"q","in":"query","schema":{"type":"string","maxLength":500},"description":"Words to match (all must appear): CVE IDs, products, event names, headlines."},{"name":"kind","in":"query","schema":{"type":"string","enum":["vulnerability","breach","advisory","ai-research"]}},{"name":"kev","in":"query","schema":{"type":"boolean"},"description":"Only CISA Known Exploited Vulnerabilities."},{"name":"stacks","in":"query","schema":{"type":"string"},"description":"Comma-separated technology labels (any match). See metadata.technologies."},{"name":"hide","in":"query","schema":{"type":"string"},"description":"Comma-separated source IDs to exclude (see /api/sources)."},{"name":"region","in":"query","schema":{"type":"string"}},{"name":"ai","in":"query","schema":{"type":"string","enum":["any","defense","offense","infrastructure","unknown","none"]}},{"name":"sort","in":"query","schema":{"type":"string","enum":["urgent","newest","priority","epss","cvss"],"default":"urgent"}},{"name":"offset","in":"query","schema":{"type":"integer","minimum":0}},{"name":"limit","in":"query","schema":{"type":"integer","minimum":1,"maximum":100,"default":25}}],"responses":{"200":{"description":"RSS 2.0.","content":{"application/rss+xml":{"schema":{"type":"string"}}}}}}}}}