Vexday API

Authentication

Generate a free key in your dashboard. Send it on every request, via header or query parameter:

# Header (recomendado)
curl https://api.vexday.io/api/v1/kev \
  -H "Authorization: Bearer vx_live_sua_chave"

# ou parâmetro de query
curl "https://api.vexday.io/api/v1/kev?api_key=vx_live_sua_chave"

Rate limit

The limit is per account, adding up its keys, and comes from the plan: free, 50 requests per day and 10 per minute; Starter, 1,000 per day; Pro, 5,000; MSSP, 20,000. Counters reset at midnight UTC. Check your plan and usage at /api/v1/status. Honor the Retry-After header on 429 responses. Product integration? Talk to us — the partner plan raises the limits without changing the content: the API remains read-only and TLP:CLEAR. Each plan's limits, on Pricing →

Endpoints

Example response

GET /api/v1/cve/CVE-2024-3400

{
  "data": {
    "cve_id": "CVE-2024-3400",
    "cvss_score": 10.0,
    "cvss_severity": "CRITICAL",
    "epss_score": 0.94,
    "in_kev": true,
    "kev_ransomware": true,
    "risk_score": 100,
    "pocs": [ { "source": "exploitdb", "verified": true } ],
    "affected": [ { "vendor": "Palo Alto", "product": "PAN-OS" } ],
    "affected_versions": [
      {
        "vendor": "Palo Alto", "product": "PAN-OS",
        "version": "11.1", "less_than": "11.1.2-h3",
        "status": "affected", "version_type": "custom"
      }
    ],
    "actors": [ "..." ]
  }
}

Version applicability

The affected_versions field carries version ranges (lessThan exclusive, lessThanOrEqual inclusive) from the CNA container. It lets you decide whether a specific version is in scope — but the comparison is the consumer's: use a semantic comparator per version_type, don't compare as text. An empty range means the CNA published no bounds (don't assume 'not affected').

RSS feeds (no key)

For RSS readers, aggregators and light automations. No authentication, 15-minute cache. Replace {lang} with pt, es or en.

Incremental sync

To keep a copy up to date without re-downloading the base: /api/v1/changes?since=<ISO-8601> returns the ids that changed (CVEs, incidents, victims; 30-day window) plus a next_since for the next call. Pair it with /api/v1/cve/batch to fetch details in bulk. A batch of N ids consumes N of the daily quota.

# 1) o que mudou desde ontem?
curl "https://api.vexday.io/api/v1/changes?since=2026-09-09T00:00:00Z" \
  -H "Authorization: Bearer vx_live_sua_chave"

# 2) detalhes em lote das CVEs que mudaram
curl -X POST "https://api.vexday.io/api/v1/cve/batch" \
  -H "Authorization: Bearer vx_live_sua_chave" \
  -H "Content-Type: application/json" \
  -d '{"ids": ["CVE-2024-3400", "CVE-2026-1234"]}'

MCP for AI assistants (MSSP plan)

On the MSSP plan, your AI assistant (Claude.ai, ChatGPT, Claude Code, Cursor and other MCP clients) queries Vexday directly, with the API's data, limits and credits, and crosses CVEs with the technologies you monitor in the alerts. The 16 tools, how to connect and example questions: MCP page → · See the MSSP plan →