API documentation

This is a draft. CVE Triage is in development, and the full reference will be generated from the OpenAPI specification when it launches. Paths and field names may change before then.

Base URL

https://api.stackbyte.app

Authentication

Send your key in the X-API-Key header. Live keys start with sb_live_ and sandbox keys with sb_test_. We store only a hash of each key, so a lost key cannot be recovered, only replaced.

curl https://api.stackbyte.app/v1/cve/CVE-2021-44228 \
  -H "X-API-Key: sb_live_..."

Endpoints

CVE Triage and account endpoints. Other APIs will be added as they launch.

Endpoint	Description	Credits
GET /v1/cve/{cve_id}	Look up one CVE.	1
POST /v1/cve/batch	Look up a list of CVEs.	1 per 10
GET /v1/cve/recently-exploited	CVEs recently added to the CISA KEV catalogue.	1
GET /v1/account/usage	Plan, credit balance and calls in the last 30 days.	0

Any repeat of the same request within 24 hours costs 1 credit. See pricing.

Responses

Every response has a data object and a meta object. A lookup that finds no record returns data: null with status 200 and is charged as normal.

{
  "data": { ... },
  "meta": {
    "sources": ["NVD", "FIRST EPSS", "CISA KEV"],
    "data_as_of": "2026-09-23",
    "credits_charged": 1,
    "credits_remaining": 1999,
    "cached": false,
    "attribution": "..."
  }
}

Errors

401: The X-API-Key header is missing, or the key is invalid or revoked.
402: Not enough credits for the call. Only the free plan stops at its limit.
422: A parameter is missing or badly formed, for example a malformed CVE ID.
429: Too many requests in a short period. Wait a moment and retry.

Failed requests are not charged.

Client libraries

Available when CVE Triage launches.

pip install stackbyte
npm install @stackbyte/sdk
MCP server: stackbyte-mcp