Access model
The API enforces exactly the same per-CVE access rules as the product, so anything you can read here is something your account is entitled to in the app.
The developer API is not yet generally available.
Access is currently limited to administrators while the API is in preview. Every endpoint returns 403 forbidden for non-admin accounts regardless of tier. The tier rules below describe the model that will apply at general availability.
Access is determined by your account tier:
- Free — the CVE catalog (list endpoint) plus full detail for every CISA KEV-listed CVE.
- Pro — everything in Free, plus full detail for the CVEs granted to your account.
- Enterprise — everything in Free, plus full detail for the CVEs granted to your organizations.
- Admin — unrestricted.
Denial responses
The list endpoint is open to every authenticated caller; per-CVE gating applies to the detail and sub-resource endpoints. A detail request outside your tier returns 403 with a specific code so the two cases are distinguishable programmatically:
free_tier— the CVE is not KEV-listed and your account is on the free tier.not_in_access_list— the CVE is not covered by your account’s or organization’s grants.