API Reference

Get a Vendor

Return the CVE count, product count, and per-product CVE lists for a single CPE vendor.

GET

/cpe/{vendor}

Cost: 1 credit per successful call

Path parameters

vendorstringrequired

The CPE vendor identifier. Case-insensitive on input (lowercased server-side). Forward slashes and control characters are rejected. Maximum 255 characters. URL-encode any special characters before sending.

Request

curl https://api.precursorintelligence.com/functions/v1/cpe/microsoft \
  -H "Authorization: Bearer $PRECURSOR_API_KEY"

Response

200 OK

{
  "data": {
    "vendor": "microsoft",
    "cve_count": 9817,
    "product_count": 412,
    "products": {
      "windows_10": [
        "CVE-2024-21333",
        "CVE-2024-21337",
        "CVE-2024-30088"
      ],
      "windows_11": [
        "CVE-2024-21334",
        "CVE-2024-38080"
      ],
      "office": [
        "CVE-2024-20673",
        "CVE-2024-38020"
      ]
    }
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.vendorstringoptional

Lowercased canonical vendor identifier, as stored in the CPE catalog.

data.cve_countintegeroptional

Total number of distinct CVEs affecting any product under this vendor.

data.product_countintegeroptional

Number of distinct products tracked for this vendor.

data.productsobjectoptional

A JSON object keyed by product name. Each value is an array of CVE IDs (strings) affecting that product, sorted alphabetically. Use GET /v1/cpe/{vendor}/{product} to get a per-version breakdown for any single product.

meta.request_idstringoptional

Unique identifier for this request. Include this in any support enquiry.

meta.generated_atstringoptional

ISO 8601 timestamp indicating when the response was produced.

meta.creditsobjectoptional

Credit accounting for the call: charged (always 1 for a successful call) and remaining (organisation balance after this call).

Errors

Status	`error`	When
401	`unauthorized`	Missing, invalid, revoked, or expired API key, or the request originated from a disallowed IP.
402	`insufficient_credits`	Organisation credit balance is below 1.
404	`not_found`	The vendor token is malformed (contains a forward slash, a control character, or exceeds 255 characters), or no CPE records are tracked for this vendor.
405	`method_not_allowed`	Request method other than GET or OPTIONS.
500	`internal`	Unexpected server error.

For the full error format and a list of response headers, see the Errors reference.