Search CWEs
Search the CWE catalogue by keyword. Returns matching weaknesses with their
abstraction level, status, likelihood of exploit, and description. Omit q to
return the full catalogue page up to limit.
/v1/cweCost: 1 credit per successful call
Query parameters
qstringoptionalKeyword to match against CWE names and descriptions. Accepted range:
1–80 characters. Omit to return the top entries up to limit.
limitintegeroptionaldefault: 50Maximum number of results to return. Accepted range: 1–100.
Request
curl "https://api.precursorintelligence.com/functions/v1/cwe?q=authentication&limit=20" \
-H "Authorization: Bearer $PRECURSOR_API_KEY"Response
{
"data": {
"count": 2,
"query": "authentication",
"limit": 20,
"items": [
{
"cwe_id": 287,
"name": "Improper Authentication",
"abstraction": "Class",
"status": "Stable",
"likelihood_of_exploit": "Medium",
"description": "When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct."
},
{
"cwe_id": 798,
"name": "Use of Hard-coded Credentials",
"abstraction": "Variant",
"status": "Stable",
"likelihood_of_exploit": "Medium",
"description": "The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data."
}
],
"generated_at": "2026-05-18T10:24:31.118Z"
},
"meta": {
"request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
"generated_at": "2026-05-18T10:24:31.118Z",
"credits": { "charged": 1, "remaining": 9998 }
}
}Response fields
data.countintegeroptionalNumber of entries returned (equals items.length).
data.querystring | nulloptionalThe keyword used for this request. null when no q was supplied.
data.limitintegeroptionalThe maximum number of results requested.
data.itemsarrayoptionalMatching CWE entries. Each object contains the fields below.
data.items[].cwe_idintegeroptionalCWE numeric identifier.
data.items[].namestringoptionalOfficial CWE weakness name.
data.items[].abstractionstringoptionalAbstraction level. Common values: Pillar, Class, Base, Variant, Compound.
data.items[].statusstringoptionalCWE entry status. Common values: Stable, Draft, Incomplete, Deprecated.
data.items[].likelihood_of_exploitstring | nulloptionalCWE-assigned likelihood of exploit (High, Medium, Low). null when not assigned.
data.items[].descriptionstringoptionalShort description of the weakness.
data.generated_atstringoptionalISO 8601 timestamp indicating when this response was generated.
Errors
| Status | error | When |
|---|---|---|
| 400 | invalid_q, invalid_limit | A parameter failed validation. |
| 401 | invalid_authorization | Missing or malformed Authorization header. |
| 401 | unauthorized | Invalid/revoked key, or IP not allowlisted. |
| 402 | insufficient_credits | Organisation credit balance is below 1. |
| 404 | not_found | The route or entity does not exist. |
| 405 | method_not_allowed | Only GET and OPTIONS are accepted. |
| 500 | internal | Unexpected server error (credit auto-refunded). |
See Errors for the full error reference.