API Reference · Your Data

Triage Findings

Your organisation's triaged CVEs: Precursor's own vulnerability score and action priority for each, enriched with the threat-actor, malware and industry context that justified the score. Ordered by vulnerability_score descending — page one is your patch queue.

Unlike GET /my/vulnerabilities this is not scan-derived; triage rows are scored for your organisation directly, so they exist whether or not you run EdgeProtect scans.

GET

/v1/my/triage

Cost: 1 credit per successful call · Scope: api:org

Query parameters

prioritystringoptional

Only findings with this action priority: immediate, urgent, high, medium, low or monitor. Unknown values are a 400, not an empty page.

limitintegeroptional

Page size, 1–200. Default 50. Out-of-range is a 400, not a silent clamp.

cursorstringoptional

Opaque pagination cursor from a previous page's next_cursor. Replay the same filters with it.

Request

curl "https://api.precursorintelligence.com/functions/v1/my/triage?priority=immediate" \
  -H "Authorization: Bearer $PRECURSOR_API_KEY"

Response

200 OK

{
  "data": {
    "count": 1,
    "items": [
      {
        "id": "b7c25c10-4f8e-49f0-a2d5-91e3c66f7ab2",
        "cve_id": "CVE-2026-21762",
        "vulnerability_score": 92,
        "action_priority": "immediate",
        "epss_score": 0.94321,
        "cvss_impact": 9.8,
        "match_type": "product",
        "known_exploited": true,
        "seen_wild": true,
        "threat_actors": ["Volt Typhoon", "APT41"],
        "malware_families": ["COATHANGER"],
        "targeted_industries": ["Government", "Telecommunications"],
        "risk_categories": ["remote_code_execution", "perimeter_device"],
        "published_date": "2026-07-14",
        "created_at": "2026-08-12T04:10:22+00:00"
      }
    ],
    "next_cursor": "eyJrIjogIjkyIi...",
    "has_more": true,
    "generated_at": "2026-08-19T09:30:00+00:00"
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "api_version": "1.3.0",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.items[].vulnerability_scoreinteger | nulloptional

Precursor's composite risk score for this CVE in your context — the sort key of the collection.

data.items[].action_prioritystringoptional

The recommended action bucket, from immediate down to monitor. Filter with ?priority=.

data.items[].known_exploited / seen_wildbooleanoptional

Whether the CVE is in the CISA KEV catalogue / has been observed exploited in the wild.

data.items[].threat_actors / malware_families / targeted_industries / risk_categoriesarray of stringsoptional

The intelligence context behind the score. Empty arrays mean no linkage is known, not that none exists.

data.next_cursorstring | nulloptional

Follow until null, replaying the same filters. Opaque — do not parse it.

Errors

Status	`error`	When
400	`invalid_priority`, `invalid_limit`, `invalid_cursor`	A parameter failed validation. Free — rejected before billing.
401	`invalid_authorization`	Missing or malformed `Authorization` header.
401	`unauthorized`	Invalid/revoked key, IP not allowlisted, or the key lacks the `api:org` scope.
402	`insufficient_credits`	Organisation credit balance is below 1.
405	`method_not_allowed`	Only `GET` and `OPTIONS` are accepted.
500	`internal`	Unexpected server error (credit auto-refunded).

See Errors for the full error reference.