API Reference · Your Data

CVE Exposure

"Am I exposed to this CVE?" as one self-contained resource. A new KEV entry lands, you ask this once, and the answer combines everything the platform knows: confirmed findings on your scanned attack surface, your watchlist and triage state, best-effort asset matches, the public severity picture, and whether the CVE is being exploited in the wild right now.

This is the SOAR-shaped endpoint — one call per CVE, one field to branch on.

GET

/v1/my/exposure/{cve_id}

Cost: 1 credit per successful call · Scope: api:org

Path parameters

cve_idstringrequired

A CVE identifier (CVE-YYYY-NNNNN). Case-insensitive; normalised server-side.

Request

curl "https://api.precursorintelligence.com/functions/v1/my/exposure/CVE-2026-21762" \
  -H "Authorization: Bearer $PRECURSOR_API_KEY"

Response

200 OK

{
  "data": {
    "cve_id": "CVE-2026-21762",
    "exposure": "confirmed",
    "public_summary": {
      "id": "CVE-2026-21762",
      "severity": { "cvss_score": 9.8, "cvss_level": "CRITICAL" },
      "epss": { "score": 0.94321, "percentile": 0.99912 },
      "cisa_kev": { "listed": true }
    },
    "my_findings": {
      "count": 1,
      "instances": 2,
      "items": [
        {
          "id": "3f0a1c9e-8f2b-4a67-9c31-5d7e2b8a4f10",
          "title": "FortiOS out-of-bounds write (SSL-VPN)",
          "severity": "critical",
          "cvss": null,
          "kev": false,
          "status": "open",
          "scan_id": "f63285e2-9c78-4020-b2bb-5c8bd2ca51ed"
        }
      ]
    },
    "my_watchlist": {
      "in_relevant_cves": true,
      "in_alerts": true,
      "triage_hits": 1
    },
    "matching_assets": {
      "confidence": "best_effort",
      "basis": "shadowserver_vendor_to_discovered_cpe",
      "count": 1,
      "items": [
        {
          "vendor": "fortinet",
          "product": "fortios",
          "version": "7.4.2",
          "cpe": "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*"
        }
      ]
    },
    "exploitation_recent": {
      "window_days": 30,
      "last_observed": "2026-08-17",
      "connections": 18244,
      "cisa_kev": true
    },
    "generated_at": "2026-08-19T09:30:00+00:00"
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "api_version": "1.3.0",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.exposurestringoptional

The one field to branch on: confirmed (a scan found this CVE on your attack surface), inferred (no finding, but your discovered software matches the CVE's affected vendors), or none (neither — which includes "unknown", see the callout below).

data.public_summaryobjectoptional

The public severity picture: CVSS score and level, EPSS score and percentile, CISA KEV listing.

data.my_findingsobjectoptional

Confirmed EdgeProtect findings for this CVE across the latest scan of each of your targets, with the total instance count.

data.my_watchlistobjectoptional

Whether the CVE appears in your relevant CVEs, your alert feed, and how many triage findings reference it.

data.exploitation_recentobjectoptional

Shadowserver honeypot activity for this CVE over the last 30 days: last observation date, connection count, and whether any observation was KEV-flagged.

matching_assets is inference, not fact

The asset match derives the CVE's affected vendors from Shadowserver honeypot observations, then matches them against vendors parsed from your discovered CPE strings — it labels itself confidence: "best_effort". An empty items array means unknown, not not affected: a CVE with no Shadowserver linkage can never produce a match. Branch on exposure, and treat inferred as a prompt to investigate, never as a verdict.

Errors

Status	`error`	When
400	`invalid_cve_id`	The path segment is not a valid CVE identifier. Free — rejected before billing.
401	`invalid_authorization`	Missing or malformed `Authorization` header.
401	`unauthorized`	Invalid/revoked key, IP not allowlisted, or the key lacks the `api:org` scope.
402	`insufficient_credits`	Organisation credit balance is below 1.
405	`method_not_allowed`	Only `GET` and `OPTIONS` are accepted.
500	`internal`	Unexpected server error (credit auto-refunded).

See Errors for the full error reference.