API Reference

Search CWEs

Search the CWE catalogue by keyword. Returns matching weaknesses with their abstraction level, status, likelihood of exploit, and description. Omit q to return the full catalogue page up to limit.

GET
/v1/cwe

Cost: 1 credit per successful call

Query parameters

qstringoptional

Keyword to match against CWE names and descriptions. Accepted range: 1–80 characters. Omit to return the top entries up to limit.

limitintegeroptionaldefault: 50

Maximum number of results to return. Accepted range: 1–100.

Request

curl "https://api.precursorintelligence.com/functions/v1/cwe?q=authentication&limit=20" \
  -H "Authorization: Bearer $PRECURSOR_API_KEY"

Response

200 OK
{
  "data": {
    "count": 2,
    "query": "authentication",
    "limit": 20,
    "items": [
      {
        "cwe_id": 287,
        "name": "Improper Authentication",
        "abstraction": "Class",
        "status": "Stable",
        "likelihood_of_exploit": "Medium",
        "description": "When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct."
      },
      {
        "cwe_id": 798,
        "name": "Use of Hard-coded Credentials",
        "abstraction": "Variant",
        "status": "Stable",
        "likelihood_of_exploit": "Medium",
        "description": "The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data."
      }
    ],
    "generated_at": "2026-05-18T10:24:31.118Z"
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.countintegeroptional

Number of entries returned (equals items.length).

data.querystring | nulloptional

The keyword used for this request. null when no q was supplied.

data.limitintegeroptional

The maximum number of results requested.

data.itemsarrayoptional

Matching CWE entries. Each object contains the fields below.

data.items[].cwe_idintegeroptional

CWE numeric identifier.

data.items[].namestringoptional

Official CWE weakness name.

data.items[].abstractionstringoptional

Abstraction level. Common values: Pillar, Class, Base, Variant, Compound.

data.items[].statusstringoptional

CWE entry status. Common values: Stable, Draft, Incomplete, Deprecated.

data.items[].likelihood_of_exploitstring | nulloptional

CWE-assigned likelihood of exploit (High, Medium, Low). null when not assigned.

data.items[].descriptionstringoptional

Short description of the weakness.

data.generated_atstringoptional

ISO 8601 timestamp indicating when this response was generated.

Errors

StatuserrorWhen
400invalid_q, invalid_limitA parameter failed validation.
401invalid_authorizationMissing or malformed Authorization header.
401unauthorizedInvalid/revoked key, or IP not allowlisted.
402insufficient_creditsOrganisation credit balance is below 1.
404not_foundThe route or entity does not exist.
405method_not_allowedOnly GET and OPTIONS are accepted.
500internalUnexpected server error (credit auto-refunded).

See Errors for the full error reference.