VDB API overview

The Vulnetix Vulnerability Database API serves vulnerability, exploit, fix, KEV, detection-rule and package intelligence over HTTPS at api.vdb.vulnetix.com, and the vulnetix vdb CLI commands wrap it.

The VDB API is a read API over the Vulnetix Vulnerability Database. You send an advisory id, a package, a purl, a CPE or another input, and it answers with the vulnerability record, affected versions, fixes, exploits, KEV status, scores, detection rules and remediation guidance it holds for it.


Base URL	`https://api.vdb.vulnetix.com/v2`
Legacy base URL	`https://api.vdb.vulnetix.com/v1` (deprecated)
OpenAPI document	`GET /v2/spec` (JSON), `GET /v2/spec/ui` (Swagger UI)
Health	`GET /health` returns `{"status":"healthy"}`, no credential
Authentication	`Authorization: ApiKey <orgId>:<hex>`, or a Bearer token. See Authentication
Limits	A daily request quota per API key. See Rate limits
Format	JSON. A few routes stream files (exploit archives, raw advisories, CSV, STIX)
CLI	`vulnetix vdb`, about 95 commands over the same routes

v1 and v2

v2 is the current API and the CLI’s default. v1 is kept for backwards compatibility and will be removed. v2 has every v1 route except four: GET /v1/openapi, GET /v1/vuln/{identifier}/fixes (split on v2 into fixes/registry, fixes/distributions and fixes/source), GET /v1/vuln/{identifier}/tree-sitter and POST /v1/packages/safe-harbour-batch. v2 adds timelines, scorecards, the unified KEV catalogue, the detection-rule searches, input kinds and remediation plans.

What a call looks like

export VULNETIX_ORG_ID="your-org-uuid"
export VULNETIX_API_KEY="your-api-key-hex"

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-44228/fixes/registry?ecosystem=maven&limit=5"

The same lookup with the CLI:

vulnetix vdb fixes CVE-2021-44228 --ecosystem maven -o json

Routes without a credential

Everything under /v2 needs a credential except these:

Route	Returns
`GET /v2/spec`, `GET /v2/spec/ui`	The OpenAPI 3 document and its Swagger UI
`GET /v2/auth/token`	A 15-minute JWT, in exchange for a SigV4-signed request
`GET /v2/auth/api-key`	Your static API key, in exchange for a SigV4-signed request
`GET /v2/packages/free-demo`	The packages whose Safe Harbour data is free on every plan
`POST /v2/crit/lookup`, `GET /v2/crit/lookup/{provider}/{service}/{resource_type}`	CRIT cloud resource lookups
`GET /health`, `GET /ready`	Liveness and readiness

Plans

Every authenticated response carries X-VDB-Plan: community, pro, teams or enterprise. The plan sets the daily quota and decides which fields you see. Fields above your plan come back as null, and the response lists them, so a Community key never gets an error for asking. See Errors and plan-gated answers.

Data sources and licensing

The database aggregates public, vendor, government and Vulnetix-derived sources. Which sources feed it, and the terms under which you may use and redistribute what the API returns, are published on the VDB site:

Where to go next

Quickstart: get a key and make your first queries.
Endpoint reference: every v2 route, grouped by resource, with its parameters.
vulnetix vdb commands: the CLI reference.

Platform IaC

The VDB API has no configuration of its own to declare. Config-as-code for the Vulnetix platform (vulnetix config validate|kinds|schema, the published JSON Schemas and the kinds) is described on Platform IaC.