Errors

Every error converges on one envelope, so clients can branch on a stable machine code.

The envelope carries a machine-readable error code, an optional human-readable message, and optional structured details (validation issues, for example). Branch on the code, not the message — messages may be reworded, codes are stable.

{
  "error": "free_tier",
  "message": "This CVE is outside the free tier. Free accounts can access CISA KEV-listed CVEs; upgrade for full catalog access."
}

Error codes

Code	Status	Meaning
`unauthenticated`	401	No credential, or the Bearer token failed verification.
`invalid_cve_id`	400	The path parameter is not a valid CVE identifier.
`Validation failed`	400	A query parameter failed validation; details.issues lists each problem.
`invalid_cursor`	400	The pagination cursor is malformed or does not match the requested sort.
`free_tier`	403	The CVE is outside the free tier (see the access model).
`not_in_access_list`	403	The CVE is not covered by your account’s or organization’s grants.
`not_found`	404	No record exists for the requested CVE.
`rate_limited`	429	Rate limit exceeded; retry after the Retry-After delay.
`internal_error`	500	Unexpected server error.