---
title: "Known chained pairs: CVEs a cited source reports were used together"
method: GET
path: "/api/chains.json"
---

# Known chained pairs: CVEs a cited source reports were used together

`GET /api/chains.json`

## Request

- Base URL: `https://cve-security.com`
- URL: `https://cve-security.com/api/chains.json`
- Auth: one of:
  - `bearerAuth` (a scheme the document does not define)
  - API key in header `X-API-Key`

Pairs of CVEs that a cited source reports were used together in one exploit chain (VulnCheck KEV entry text, Metasploit modules, SigmaHQ rules, press or research sentences, exploit code read by a model, community text judged by a local model), newest first. Every row carries both CVEs with their CISA KEV status, the claim kind (observed or potential), the quoted evidence with its source, URL and date, and community discussion counts. Keyed; private-cacheable for 900s. Data attribution: VulnCheck KEV (community); Metasploit Framework; SigmaHQ.

## Query parameters

- `source` 'vulncheck_kev' | 'metasploit' | 'sigma' | 'press' | 'research' | 'academic' | 'community' | 'github_poc' | 'exploitdb' | 'exploit_code'
- `since` string, date
- `claim` 'observed' | 'potential'
- `limit` integer

## Response `200`

{ generated, source, since, claim, count, attribution[], note, rates, rows: [{cve_a, cve_a_url, cve_a_kev, cve_b, cve_b_url, cve_b_kev, claim_kind, claim_label, lanes[], first_seen, first_date, evidence: [{source, source_label, source_url, source_title, date, quote, claim_kind, observed_basis, support, code_summary}], discussed}] }. The evidence of an observed pair lists the sources that report the attack first; observed_basis says where a row states the attack (quote, context or source) and support holds the sentence when the quote alone does not state it. On a row of exploit code, code_summary {text, url, label} says in our words which CVEs the exploit uses and links to the file.

## Other responses

- `401`: Missing or invalid key
- `503`: Known chains have not been built yet

---

[API](https://skmtc.dev/cve-security/apis/cve-security-api.md) · [All operations](https://skmtc.dev/cve-security/apis/cve-security-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cve-security/apis/cve-security-api/revisions/2470f9c9a4eb?raw)