BlackTreeIndependent security intelligence← Back to the CVE catalogueA versioned, read-only JSON interface for approved machine clients. The human CVE website remains public and does not require an account.
Request access from BlackTree, store the issued key in a secret manager, and send it only in the HTTPS Authorization header. A key is displayed once and can be rotated or revoked independently.
curl -H "Authorization: Bearer $BLACKTREE_API_KEY" "https://cve.blacktree.nl/api/v1/cves?year=2026&sort=newest&limit=10"All integration endpoints require an Authorization bearer key. Read routes accept GET and HEAD. Bounded matching and enrichment operations accept POST and retain neither input nor results. The aggregate health route remains public.
/api/v1/healthNo storeConfirms that the catalogue contains current-year records. It exposes aggregate counts and core-source state, never credentials, source errors or infrastructure details.
No parameters.
{ status, records, years, lastRefresh, sourcesHealthy }/api/v1/statsNo storeReturns aggregate severity, exploitation, remediation, ENISA EUVD, national-guidance and material-change counts.
| Parameter | Accepted values and limits | Meaning |
|---|---|---|
year | 2015–2026 or all; default 2026 | CVE publication-year scope. |
{ year, supportedYears, yearCounts, total, wild, lab, patched, patchNow, severity, patch, national, coverage, cvssSources, recentChanges, computedAt?, sources, lastRefresh, healthy }/api/v1/cvesPrivate for 60 secondsReturns active public CVE records. Rejected identifiers are excluded. Full-text matching uses at most 120 characters and eight terms, and reports when its 500-record search ceiling was reached.
| Parameter | Accepted values and limits | Meaning |
|---|---|---|
year | 2015–2026 or all; default 2026 | CVE publication-year scope. |
q | Text, CVE ID or EUVD ID; maximum 120 characters | Search identifiers, vendor, product, title, description and CWE text. |
severity | Critical, High, Medium, Low, None, Unknown | Repeat or comma-separate values. |
patch | Patch available, Mitigation available, Awaiting fix | Repeat or comma-separate remediation states. |
urgency | Patch now, Within 72 hours, Within 7 days, Needs assessment, Scheduled, Monitor | Repeat or comma-separate urgency labels. |
cvssVersion | 4.0, 3.1, 3.0, 2.0 | Repeat or comma-separate scoring versions. |
epssMin | 0 through 1 | Minimum FIRST EPSS probability; missing scores are excluded. |
epssPercentileMin | 0 through 1 | Minimum FIRST EPSS percentile; missing scores are excluded. |
wild | true | Require CISA KEV confirmation. |
lab | true | Require a recorded public exploit or proof-of-concept reference. |
euvd | true | Require an active official ENISA EUVD mapping. |
euKev | true | Require a current known-exploited record in the ENISA EUVD dataset. |
vexState | known_affected, first_affected, last_affected, under_investigation, fixed, first_fixed, known_not_affected, recommended or none | Repeat or comma-separate vendor product states. none is distinct from known_not_affected. |
language | de, es, fr, hu, it, nl, pl | Repeat or comma-separate national-authority guidance languages. |
sort | newest, priority, cvss, epss; default newest | Result ordering. |
page | Integer 1 or higher; default 1 | One-based page. |
limit | 10 through 50; default 30 | Records per page; out-of-range values are clamped. |
{ items: CveSummary[], total, page, limit, pages, query, year, totalCapped, searchResultLimit }/api/v1/sbom/matchNo storeAccepts normalized component identities from a CycloneDX or SPDX SBOM and optional VEX statements. It matches explicit PURL and CPE identifiers first, preserves ambiguous and unmatched components, and does not store the input or result.
| Parameter | Accepted values and limits | Meaning |
|---|---|---|
components | 1 through 2,000 normalized components | Each component needs a name, PURL, CPE or explicit CVE ID. |
vexStatements | Optional, up to 5,000 statements | Applies affected, under investigation, fixed or known not affected to this response. |
{ generatedAt, privacy, supported, summary, results: [{ component, status, matches, truncated }] }/api/v1/integrations/wazuh/enrichNo storeAccepts only CVE identifiers from Wazuh and returns separate severity, exploitation, EPSS, remediation, vendor, authority and recent-change evidence. It rejects asset and agent context, stores neither input nor results, and never produces a composite BlackTree score.
| Parameter | Accepted values and limits | Meaning |
|---|---|---|
cveIds | 1 through 250 CVE identifiers | Unique vulnerability identifiers from active Wazuh findings. Hostnames, IP addresses, agent IDs, inventories and logs are not accepted. |
{ generatedAt, privacy, summary, unmatched, results: [{ id, severity, exploitation, epss, remediation, vendorEvidence, authorityGuidance, recentChanges, reportUrl }] }/api/v1/cves/{id}Private for 60 secondsReturns one source-attributed report, including ENISA EUVD context, national guidance, vendor CSAF/VEX, references, reciprocal BlackTree articles, EPSS history and material-change history when available.
| Parameter | Accepted values and limits | Meaning |
|---|---|---|
id | CVE-YYYY-NNNN or longer; path parameter | Case-insensitive CVE identifier. The response uses uppercase. |
CveSummary fields plus euvd[], references[], nationalGuidance[], vendorAdvisories[], blacktreeArticles[], epssHistory[] and changeHistory[]. Optional evidence remains null or an empty array rather than being inferred./api/v1/changesNo storeReturns CVEs grouped by meaningful, source-attributed changes. Identical refreshes and cosmetic edits are excluded.
| Parameter | Accepted values and limits | Meaning |
|---|---|---|
year | 2015–2026 or all; default 2026 | CVE publication-year scope. |
window | 24h or 7d; default 24h | Preset look-back when since is absent. |
since | ISO 8601 date-time | Explicit start time, bounded to the most recent 90 days. |
category | record, cvss, severity, exploitation, remediation, affected, guidance, coverage | Repeat or comma-separate change categories. |
page | Integer 1 or higher; default 1 | One-based page. |
limit | 10 through 50; default 30 | CVEs per page; out-of-range values are clamped. |
{ items: [{ cve, latestChangedAt, changeCount, importance, changes[] }], total, page, limit, pages, since, window }/api/v1/sitemapPrivate for 900 secondsSupplies the public XML sitemap routes. Integrators should use the catalogue endpoint instead of treating this route as a bulk export.
| Parameter | Accepted values and limits | Meaning |
|---|---|---|
year | Required integer 2015–2026 | One publication year; all is not supported. |
page | Integer 1 or higher; default 1 | One-based shard page. |
limit | 1,000 through 10,000; default 10,000 | Rows per shard; out-of-range values are clamped. |
{ year, page, limit, total, items: [{ id, modified }] }Responses use application/json; charset=utf-8. Dates are ISO 8601 in machine fields. Human-formatted companion fields may also be present. Missing evidence is represented explicitly and must not be interpreted as low risk.
{ "error": "Human-readable message", "code": "machine_readable_code" }Error responses use the same JSON content type and are not cached. Authentication failures do not reveal whether a key was expired, revoked or unknown.
Compatible fields may be added inside /api/v1. Existing fields will not silently change meaning. Breaking changes require a new major path. Consumers should ignore unknown fields.
| Status | Meaning |
|---|---|
200 | Request succeeded. |
400 | A route-specific required value is unsupported. |
401 | The bearer API key is missing, malformed, expired, revoked or inactive. |
403 | The API key plan does not include the required endpoint entitlement. |
404 | Endpoint or CVE not found. |
405 | Only GET and HEAD are accepted. |
429 | The source, per-key minute limit or monthly account quota was exceeded. |
500 | Unexpected server error. |
503 | Catalogue or bounded search temporarily unavailable. |
The public matching workspace parses original SBOM and VEX files inside the visitor’s browser. Nothing is transmitted until the visitor selects Match inventory.
Only normalized component references, names, versions, suppliers, PURLs, CPEs, explicit CVE identifiers and optional VEX statements are sent for the matching request. The original files are not uploaded.
The service processes the normalized request in memory and does not write the input or result to the catalogue database. Responses use Cache-Control: no-store. Application logs do not record request bodies.
Parsed input remains in the current browser page until it is cleared, replaced or the page is closed. Export is initiated locally by the visitor. Any future saved-inventory feature will require separate opt-in consent and retention controls.
The Wazuh operation accepts only batches of CVE identifiers. Asset names, agent identifiers, addresses, inventories and logs remain inside Wazuh. Returned signals stay separate and are not combined into a BlackTree score.
Each API key has a plan-specific per-minute limit and monthly quota. Responses include remaining-limit headers. A limit breach returns 429. Do not distribute requests or keys to bypass controls.
Honour Cache-Control. Catalogue and report responses can be reused for 60 seconds. Sitemap data can be reused for 15 minutes. Health, statistics and material changes are marked no-store.
When republishing results, identify “BlackTree CVE Intelligence” and link to the corresponding BlackTree report. Preserve the upstream source names and links carried in each response.
No blanket redistribution licence is granted by this documentation. Upstream CVE, CISA, ENISA, FIRST, NIST, authority and vendor content remains governed by its publisher’s terms. Contact BlackTree before bulk republication of BlackTree-authored analysis.
Use bounded pagination, specific searches and ordinary caching. Do not stress-test production, scrape around published limits, evade controls, interfere with other users or imply that missing evidence is a safety assessment.
Use BlackTree’s public contact form and clearly identify the report as a security disclosure. Include the affected URL or API route, the observed impact and concise reproduction steps. Do not include credentials, private keys, personal data or unnecessary live-system data in the initial message.