VDB API quickstart

Get an organisation id and API key, store them for the CLI, check they authenticate, and run your first vulnerability, package and exploit lookups with the CLI and with curl.

1. Get credentials

Register for a free Community account at vulnetix.com/resolve/register. Its daily quota is 50 requests. Paid plans and higher limits are on vulnetix.com/pricing.

Your credentials are on the console’s Account page:

Value	Looks like	Used for
Org ID	`xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`	Every credential method
API Key	`<orgId>:<64 hex characters>`	The `ApiKey` header. The console shows it with the org id already in front
Secret	A random string	SigV4 signing. The API key is HMAC-SHA256 of the org id, keyed with this secret

2. Store them for the CLI

The quickest way is the browser sign-in:

vulnetix auth login

With a key you already have, and no browser:

vulnetix auth login --org-id "$VULNETIX_ORG_ID" --api-key "$VULNETIX_API_KEY" --noninteractive

This writes ~/.vulnetix/credentials.json (mode 0600). --store project writes .vulnetix/credentials.json in the current directory instead, and --store keyring keeps the secret in the OS keychain and only metadata on disk.

In CI, set environment variables instead:

export VULNETIX_ORG_ID="your-org-uuid"
export VULNETIX_API_KEY="your-api-key-hex"

The full list of credential sources, and the order the CLI tries them in, is in CLI flags, output and cache.

3. Check they work

vulnetix auth status    # which credential source wins, and every source found
vulnetix auth verify    # makes an authenticated call
vulnetix vdb status     # CLI version, API health, auth method and result

With curl, an authenticated route that returns quickly is a good probe. 401 means the key is wrong; 200 means it is accepted:

curl -s -o /dev/null -w '%{http_code}\n' \
  -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  https://api.vdb.vulnetix.com/v2/ecosystems

4. First queries

Look up a vulnerability by any advisory id. CVE, GHSA, PYSEC, RUSTSEC, GO, RHSA, DSA, USN and many more are accepted:

vulnetix vdb vuln CVE-2021-44228
vulnetix vdb vuln GHSA-jfh8-3a1q-hjz9
vulnetix vdb vuln RHSA-2025:1730

Find what affects a package, or a specific version of it:

vulnetix vdb vulns express
vulnetix vdb purl pkg:npm/express@4.17.1
vulnetix vdb advisories pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1

Exploits, fixes and KEV status for one CVE:

vulnetix vdb exploits CVE-2021-44228
vulnetix vdb fixes CVE-2021-44228
vulnetix vdb kev get CVE-2021-44228

The same three calls with curl:

AUTH="Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}"
curl -s -H "$AUTH" "https://api.vdb.vulnetix.com/v2/exploits/CVE-2021-44228?limit=10"
curl -s -H "$AUTH" "https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-44228/fixes/registry"
curl -s -H "$AUTH" "https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-44228/kev"

Authentication: the header forms, SigV4 and JWTs.
Rate limits: how the daily quota is counted.
Recipes: CI gates, bulk lookups and jq filters.