API Reference

Overview

The Precursor Intelligence REST API is a set of GET endpoints that return JSON. All endpoints share the same authentication and credit model.

Base URL:

https://api.precursorintelligence.com/functions/v1/

Endpoints

Every endpoint is GET and costs 1 credit per successful call, except GET /meta/account which is free. All share the response envelope and error model below.

CVE & EPSS

Endpoint	Description
`GET /cve/{cve-id}`	Full intelligence record for a single CVE: NVD data, CVSS, EPSS, CISA KEV, Shadowserver activity, risk scoring, and attributed threat actors with citations.
`GET /cve/{cve-id}/actors`	Threat actors reported to have exploited a CVE, each with an evidence quote and source URL.
`GET /cve/high-epss`	CVEs with an EPSS exploit-probability above a threshold.
`GET /cve/kev-recent`	CISA KEV catalogue entries added within the last N days.
`GET /cve/notable-events`	Recent notable CVE events (new NVD entry, EPSS delta, new KEV listing).
`GET /cve/by-vendor`	The highest-EPSS CVEs affecting a given vendor.

CPE & Products

Endpoint	Description
`GET /cpe/{vendor}`	All tracked products for a vendor, with per-product CVE counts.
`GET /cpe/{vendor}/{product}`	Version breakdown and CVE counts for a specific product.
`GET /cpe/{vendor}/{product}/{version}`	Up to 200 CVE records affecting a specific version.
`GET /cpe?search=`	Full-text search across product names.
`GET /cpe?ranking=top_vendors`	Top vendors by total CVE count.

CWE

Endpoint	Description
`GET /cwe/{cwe-id}`	A single CWE record: description, relationships, consequences, mitigations.
`GET /cwe?q=`	Search the CWE catalogue.
`GET /cwe/top`	The most-referenced CWEs across all scored CVEs.

MITRE ATT&CK

Endpoint	Description
`GET /mitre/techniques/{id}`	A single technique, enriched with the groups, software, campaigns, mitigations, and detections related to it.
`GET /mitre/techniques`	List techniques, optionally filtered by tactic.
`GET /mitre/techniques/top`	The most-referenced techniques.
`GET /mitre/tactics`	All 14 Enterprise tactics with statistics.
`GET /mitre/groups`	List ATT&CK adversary groups.
`GET /mitre/groups/{attack-id}`	A single ATT&CK group.

Atomic Red Team

Endpoint	Description
`GET /atomics/techniques`	The Atomic Red Team technique index.
`GET /atomics/tests`	Paged atomic tests, filterable by technique and platform.
`GET /atomics/tests/{id}`	A single atomic test: executors, dependencies, inputs.

Threat Actors

Endpoint	Description
`GET /actors`	Threat actors ranked by evidence volume, filterable by `?type=` (ransomware, apt, cybercrime, hacktivist).
`GET /actors/{name}`	Full dossier: aliases, ATT&CK techniques, campaigns, related groups, ransomware tradecraft, CVEs, industries and malware — each with an evidence quote and source URL.
`GET /actors/{name}/cves`	CVEs an actor is reported to exploit, with CVSS, EPSS and CISA KEV, ordered for a patch queue.
`GET /actors?industry=`	Threat actors that target a given industry, with citations.

IOCs

Endpoint	Description
`GET /ioc?value=`	Exact-match IOC lookup with enrichment.
`GET /ioc?q=`	Substring IOC search, filterable by type and malware.
`GET /ioc/recent`	IOCs first seen in the last N days.

Malware Samples

Endpoint	Description
`GET /malware?q=`	Search MalwareBazaar samples.
`GET /malware/{sha256}`	A single malware sample by hash.
`GET /malware/recent`	Recently observed samples.
`GET /malware/top`	The most-referenced malware families.

Blacklists

Endpoint	Description
`GET /blacklist/ssl/{sha1}`	Check the abuse.ch SSL (SSLBL) certificate blacklist.
`GET /blacklist/ja3/{md5}`	Check the abuse.ch JA3 fingerprint blacklist.

Shadowserver

Endpoint	Description
`GET /shadowserver/cve/{cve-id}`	Daily honeypot observations for a single CVE.
`GET /shadowserver/top-cves`	Top CVEs by honeypot connections.
`GET /shadowserver/top-vendors`	Top vendors by honeypot connections.
`GET /shadowserver/daily-stats`	Aggregate daily honeypot statistics.

Remediation

Endpoint	Description
`GET /remediation/summary/{cve-id}`	AI-generated remediation summaries for a CVE.
`GET /remediation/affected-systems`	The most-referenced affected systems.

Supply Chain

Endpoint	Description
`GET /supply-chain/incidents`	List supply-chain incidents.
`GET /supply-chain/incidents/{id}`	A single incident with its affected packages.
`GET /supply-chain/packages?name=`	Find incidents affecting a given package.

Account & Meta

Endpoint	Description
`GET /meta/account`	Your credit balance, key metadata, and rate-limit state. Free.

Your Data · Vulnerability Intelligence

All /my endpoints return your organisation's own data rather than public threat intel, and require a key with the api:org scope (api:read does not imply it). The organisation always comes from the API key — there is no way to name a tenant in a request.

Endpoint	Description
`GET /my/cves`	CVEs matched to your watched vendors and products, highest EPSS first.
`GET /my/triage`	Your triaged CVEs: Precursor's vulnerability score and action priority, with threat-actor, malware and industry context.
`GET /my/alerts`	Your watchlist alert feed, newest first. `?since=` makes polling cheap.
`GET /my/exposure/{cve_id}`	"Am I exposed to this CVE?" — confirmed findings, watchlist state, best-effort asset matches, and in-the-wild activity in one document.

Your Data · Attack Surface

Your EdgeProtect attack-surface data. The scan is the unit: one scan document contains the whole snapshot, so you never pay per table.

Endpoint	Description
`GET /my/vulnerabilities`	EdgeProtect findings across the latest scan of every target — your current attack surface, worst first.
`GET /my/scans`	Your scans, newest first — each with its target and rollup counts embedded.
`GET /my/scans/{scan_id}`	One whole scan as a single document: hosts (with IPs + open ports), domains, DNS, SSL certificates, network ranges, vulnerabilities. `?sections=` to slim it.
`GET /my/scans/{scan_id}/delta`	Precomputed diff vs the previous scan of the same target.
`GET /my/scans/{scan_id}/credentials`	Breach-exposed credentials, redacted to existence flags — the password and breach PII never leave the database.

Response envelope

Every successful response uses the same outer shape:

200 OK

{
  "data": { },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

meta is consistent across all endpoints. data contains the endpoint-specific payload.

Response envelope fields

Field	Type	Description
`data`	object	Endpoint-specific payload. See each endpoint's reference for the full field list.
`meta.request_id`	string	UUID identifying this request. Returned in the `x-request-id` response header as well.
`meta.generated_at`	string	ISO 8601 UTC timestamp for when the response was generated.
`meta.credits.charged`	integer	Credits deducted for this call (1 for a successful call).
`meta.credits.remaining`	integer	Credits remaining in your organisation's pool after this call.

Conventions

Authentication: all requests require Authorization: Bearer $PRECURSOR_API_KEY. Keys are created in the dashboard at precursorintelligence.com under Settings → API Keys.
Credits: each successful call costs 1 credit, shared across your organisation. See Credits for top-up and balance details.
HTTP method: all endpoints are GET. Requests using any other method return 405 method_not_allowed.
Case sensitivity: path parameters are case-insensitive on input and are normalised server-side (CVE-2024-3094 and cve-2024-3094 resolve identically).
Timestamps: all timestamps are RFC 3339 UTC strings.
Numeric scores: CVSS and EPSS values are JSON numbers, not strings.
Absent fields: fields with no data are omitted from the response; they are never returned as null.
Errors: all error bodies follow the shape { "error": "<machine_code>" }. See Errors for the full list of codes.

Errors

Status	`error`	When
`400`	`invalid_cve_id` (or similar)	A path parameter failed validation.
`401`	`unauthorized`	The API key is missing, invalid, or revoked.
`402`	`insufficient_credits`	Your organisation's credit balance is zero.
`404`	`not_found`	The route or the requested entity does not exist in the dataset.
`405`	`method_not_allowed`	A non-GET method was used.
`500`	`internal`	An unexpected server error occurred.

See Errors for the complete error reference.

Quickstart

Make your first request in under five minutes.

Authentication

API keys, IP allowlists, and credential management.