API Reference

Get a Product

Returns vulnerability counts and a per-version breakdown for a specific vendor/product pair tracked in the CPE catalog.

GET

/cpe/{vendor}/{product}

Cost: 1 credit per successful call

Path parameters

vendorstringrequired

The CPE vendor token (e.g. microsoft, apache, tukaani). Case-insensitive, 1–255 characters. Forward slashes and control characters are not allowed.

productstringrequired

The CPE product token (e.g. windows_10, httpd, xz). Same constraints as vendor.

URL-encode any spaces or special characters before sending the request.

Request

curl https://api.precursorintelligence.com/functions/v1/cpe/apache/httpd \
  -H "Authorization: Bearer $PRECURSOR_API_KEY"

Response

200 OK

{
  "data": {
    "vendor": "apache",
    "product": "httpd",
    "cve_count": 217,
    "version_count": 348,
    "versions": {
      "2.4.62": [],
      "2.4.61": ["CVE-2024-38476"],
      "2.4.59": [
        "CVE-2024-36387",
        "CVE-2024-38472",
        "CVE-2024-38473",
        "CVE-2024-38474",
        "CVE-2024-38475",
        "CVE-2024-38476",
        "CVE-2024-38477"
      ]
    }
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.vendorstringoptional

The vendor token as stored in the CPE catalog, normalized to lowercase.

data.productstringoptional

The product token as stored in the CPE catalog, normalized to lowercase.

data.cve_countintegeroptional

Total distinct CVEs affecting any tracked version of this product.

data.version_countintegeroptional

Total distinct versions tracked for this product in the CPE catalog.

data.versionsobjectoptional

A map of version string to CVE identifier array. Each key is a version string as it appears in the CPE record; each value is an array of CVE IDs (e.g. ["CVE-2024-38476"]) affecting that version, sorted ascending. An empty array means no CVEs are linked to that version. Use GET /v1/cpe/{vendor}/{product}/{version} to retrieve full CVE details.

Errors

Status	`error`	When
401	`unauthorized`	The API key is missing, revoked, or invalid.
402	`insufficient_credits`	Your credit balance is zero. Top up from the dashboard.
404	`not_found`	No CPE data exists for this vendor/product combination, or the token contains a disallowed character or exceeds 255 characters.
405	`method_not_allowed`	A non-GET HTTP method was used.
500	`internal`	An unexpected server error occurred.

See Errors for the full error reference and response body format.