Security Model

The Precursor Intelligence API is designed for production use by security teams. The controls below describe what we guarantee at the API boundary.

Credential handling

Your API key's full secret is shown once at creation in the dashboard and cannot be retrieved afterward. If the secret is lost, revoke the key and create a new one from Settings → API Keys.

Each request verifies the supplied key on every call. There is no in-process session and no token caching that survives a single request.

Keys are organisation-owned: all members of an organisation share one credit pool, and a single key works against every endpoint and every MCP tool by default.

Key best practices

Store your key in an environment variable or a secrets vault and inject it at runtime. Do not hard-code it in source files, commit it to version control, or expose it in client-side code.

# Set once in your environment
export PRECURSOR_API_KEY="<YOUR_API_KEY>"
 
# Use in requests
curl https://api.precursorintelligence.com/functions/v1/cve/CVE-2024-3094 \
  -H "Authorization: Bearer $PRECURSOR_API_KEY"

A compromised key can be revoked instantly from the dashboard. Creating a replacement takes seconds.

Per-key controls

• IP allowlist (optional): when set, requests from any source IP outside the allowlist are rejected. Up to 20 individual IPv4 or IPv6 addresses (no CIDR ranges). Recommended for any production credential.
• Expiry (optional): set an expiration date when the key is created; it stops working automatically once that time passes.
• Revocation: keys can be disabled at any time from the dashboard with immediate effect.
• Rotation: create a replacement key, roll it out, then revoke the old key for zero-downtime rotation.

Uniform 401 responses

Any credential failure (invalid key, revoked key, IP not on the allowlist) returns the same response with no further detail:

{ "error": "unauthorized" }

This prevents an attacker who holds a leaked credential from learning anything about your key's configuration. The dashboard audit log shows the specific reason for every failure on keys you own.

Transport

All requests must use HTTPS. HTTP is not served. Responses include Strict-Transport-Security with a two-year max-age:

Strict-Transport-Security: max-age=63072000; includeSubDomains

Other defensive headers returned on every response:

The API returns application/json only and is not intended to be embedded in browser contexts.

Auditability

Every request is recorded with:

• A unique request_id returned in the response body and as the x-request-id header.
• The owning key id and organisation id.
• Endpoint, HTTP status, latency, and response size.
• Source IP.
• Timestamp.

The same request_id is the join key into the billing ledger, so any charge can be traced to the call that produced it. Include it in any support email and we can locate the request immediately.

Data sourcing

All data returned by the API is derived from public intelligence sources (including NVD, EPSS, CISA KEV, CWE, Shadowserver, and MITRE ATT&CK) and Precursor Intelligence's own enrichment. The API does not return:

• Customer-specific telemetry from other organisations.
• Personally identifiable information.

You may treat API responses as public for the purposes of your internal data handling policies.

Responsible disclosure

Found a security issue? Email info@precursorintelligence.com. We respond within one business day and credit reporters in our advisories.