API Reference

Overview

The Precursor Intelligence REST API is a set of GET endpoints that return JSON. All endpoints share the same authentication and credit model.

Base URL:

https://api.precursorintelligence.com/functions/v1/

Endpoints

Endpoint	Description
`GET /cve/{cve-id}`	Full intelligence record for a single CVE: NVD data, CVSS, EPSS, CISA KEV status, Shadowserver honeypot activity, and risk scoring.
`GET /cpe/{vendor}`	All tracked products for a vendor, with per-product CVE counts.
`GET /cpe/{vendor}/{product}`	Version breakdown and CVE counts for a specific vendor and product.
`GET /cpe/{vendor}/{product}/{version}`	Up to 200 CVE records affecting a specific vendor, product, and version.

Response envelope

Every successful response uses the same outer shape:

200 OK

{
  "data": { },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

meta is consistent across all endpoints. data contains the endpoint-specific payload.

Response envelope fields

Field	Type	Description
`data`	object	Endpoint-specific payload. See each endpoint's reference for the full field list.
`meta.request_id`	string	UUID identifying this request. Returned in the `x-request-id` response header as well.
`meta.generated_at`	string	ISO 8601 UTC timestamp for when the response was generated.
`meta.credits.charged`	integer	Credits deducted for this call (1 for a successful call).
`meta.credits.remaining`	integer	Credits remaining in your organisation's pool after this call.

Conventions

Authentication: all requests require Authorization: Bearer $PRECURSOR_API_KEY. Keys are created in the dashboard at precursorintelligence.com under Settings → API Keys.
Credits: each successful call costs 1 credit, shared across your organisation. See Credits for top-up and balance details.
HTTP method: all endpoints are GET. Requests using any other method return 405 method_not_allowed.
Case sensitivity: path parameters are case-insensitive on input and are normalised server-side (CVE-2024-3094 and cve-2024-3094 resolve identically).
Timestamps: all timestamps are RFC 3339 UTC strings.
Numeric scores: CVSS and EPSS values are JSON numbers, not strings.
Absent fields: fields with no data are omitted from the response; they are never returned as null.
Errors: all error bodies follow the shape { "error": "<machine_code>" }. See Errors for the full list of codes.

Errors

Status	`error`	When
`400`	`invalid_cve_id` (or similar)	A path parameter failed validation.
`401`	`unauthorized`	The API key is missing, invalid, or revoked.
`402`	`insufficient_credits`	Your organisation's credit balance is zero.
`404`	`not_found`	The route or the requested entity does not exist in the dataset.
`405`	`method_not_allowed`	A non-GET method was used.
`500`	`internal`	An unexpected server error occurred.

See Errors for the complete error reference.

Quickstart

Make your first request in under five minutes.

Authentication

API keys, IP allowlists, and credential management.