Precursor IntelligenceAPI Docs
Concepts

Changelog

Every response carries an api_version field and an x-api-version header, so you can always tell which release answered your call. Versions follow semver: we add fields freely in minor releases, and anything that changes the meaning or shape of an existing field gets its own note here.

v1.3.0 (2026-08-19)

Nine new organisation-scoped endpoints, covering your attack surface and the CVEs you are tracking. All of them need a key with the api:org scope.

Your attack surface

The scan is the billable unit. One credit buys the whole snapshot, not one table of it, so walking your attack surface does not multiply per-call costs.

  • GET /v1/my/scans lists your scans, newest first, each with its target and rollup counts for everything the scan found.
  • GET /v1/my/scans/{scan_id} returns the whole scan as one document: hosts (with IP addresses, open ports and what is listening on them), domains, DNS records, SSL certificates, network ranges, and vulnerabilities with their instances. Use ?sections= to project a subset at the same price.
  • GET /v1/my/scans/{scan_id}/delta returns the precomputed diff against the previous scan of the same target.
  • GET /v1/my/scans/{scan_id}/credentials returns breach-exposed credentials for the scan's domain, reduced to account, breach source and existence flags. Passwords and breach PII are never returned.

What matters to you

  • GET /v1/my/cves returns CVEs matched to your watched vendors and products, highest EPSS first. Narrow the list with ?kev_only= and ?min_epss=.
  • GET /v1/my/vulnerabilities returns findings across the latest scan of every target, ordered by severity, each with its instance count.
  • GET /v1/my/triage returns your triaged CVEs with their vulnerability score and action priority, plus threat actor, malware and industry context. ?priority=immediate is your patch queue.
  • GET /v1/my/alerts returns your watchlist alert feed, newest first. With ?since=, polling costs one credit and returns nothing when nothing fired.
  • GET /v1/my/exposure/{cve_id} answers "am I exposed to this CVE?" in one document: confirmed findings, watchlist and triage state, best-effort asset matches, and 30 days of in-the-wild activity. Branch on the single exposure field (confirmed, inferred or none).

Notes

  • Every collection is keyset-paginated. Follow next_cursor until it is null, replaying the same filters. There is deliberately no total count.
  • Scan documents are immutable once the scan completes, so you can fetch once and cache indefinitely. The intended loop is to poll /v1/my/scans, then fetch the delta or the full document when a new scan appears.
  • Across all /v1/my endpoints the organisation comes from your API key. There is no way to name a tenant in a request, and tenant responses are never shared-cacheable.
  • An unknown scan id and another organisation's scan id are indistinguishable: both return 200 with data: null.

v1.2.0 (2026-08-04)

Expanded threat actor intelligence. Every claim now carries the quote that supports it and the URL that quote came from, across 815 actors, 7,800 technique links, 1,300 campaigns and 6,500 cited claims.

New endpoints

  • GET /v1/cve/{cve-id}/actors returns the threat actors reported to have exploited a CVE, each with an evidence quote and source URL.
  • GET /v1/actors/{name}/cves returns the CVEs an actor exploits, joined to CVSS, EPSS, CISA KEV and action priority, ordered KEV first.

New MCP tools (the server now exposes 71)

  • get_cve_threat_actors maps a CVE to attributed actors, with citations.
  • list_threat_actor_cves maps an actor to CVEs, ordered for a patch queue.

Changed

  • GET /v1/cve/{cve-id} and the get_cve tool gained a top-level threat_actors block with cited attribution. classification.threat_actors keeps its existing shape and now carries the union of the cited names and the previous attribution set, so coverage only grows.
  • GET /v1/actors/{name} now returns a full dossier: aliases, ATT&CK techniques, campaigns, related groups, ransomware tradecraft, and linked CVEs, industries and malware. {name} resolves a slug, an alias or a display name, and follows a merged actor through to its surviving record.
  • GET /v1/actors is ranked by corroborated evidence volume rather than mention frequency, and accepts ?type= (ransomware, apt, cybercrime, hacktivist).
  • GET /v1/actors?industry= matches industry names, slugs and aliases rather than one exact spelling, and reports what your string resolved to.
  • get_threat_actor_techniques now resolves ransomware operations and other actors outside MITRE's named intrusion sets. A source field says which dataset answered.
  • map_assets_to_actor and appliances_exploited_by_actor resolve actors across both datasets and union the results.

v1.0.0 (2026-06-10)

Initial public release.

  • GET /v1/cve/{cve-id} returns the full CVE intelligence record: NVD data, CVSS metrics, EPSS scoring, CISA KEV status, honeypot activity and Precursor Intelligence risk scoring.
  • GET /v1/cpe/{vendor}, GET /v1/cpe/{vendor}/{product} and GET /v1/cpe/{vendor}/{product}/{version} return vendor, product and version coverage with CVE mapping.
  • The Precursor Intelligence MCP server launched at https://api.precursorintelligence.com/functions/v1/mcp with 41 tools covering CVE intelligence, MITRE ATT&CK, Atomic Red Team, threat actors, IOCs, malware samples and honeypot data.
  • Bearer authentication using API keys managed from the dashboard.
  • Pay-per-call credit model with atomic deduction. Credits are refunded automatically on errors, and per-request credit usage is visible in the dashboard.