---
title: "Bulk catalog export (keyed, CC BY 4.0)"
method: GET
path: "/api/export/{file}"
---

# Bulk catalog export (keyed, CC BY 4.0)

`GET /api/export/{file}`

## Request

- Base URL: `https://cve-security.com`
- URL: `https://cve-security.com/api/export/{file}`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

The full served catalog as one gzipped JSONL, one object per non-withdrawn CVE with identity, scores (CVSS/EPSS), exploitation (KEV/ransomware), the four detection-content flags with Nuclei/Metasploit references, has_fix, exploit-code flags, tier and description snippet. Rebuilt nightly from the same computations /metrics publishes, so the export cannot disagree with the site. Fetch manifest.json (tiny) first and compare sha256 before pulling the blob (~30 MB). Counts as one request against the key's daily limit. The key is attribution, not a paywall, the data is CC BY 4.0. `?as_of=YYYY-MM-DD` (historical snapshots) is reserved for non-free tiers. New in 1.4.0: packages.jsonl.gz, the OSS package↔CVE mapping (one object per cve/ecosystem/package) with OSV version ranges verbatim (ranges[].fixed = upgrade targets; ranges[].affected_through = last vulnerable version, so upgrade past it), plus KEV/EPSS/severity per row; described by the same manifest.json under its `packages` key. New in 1.5.2: kcv-watch.jsonl.gz, the KCV Watch chain candidates of every tier (the site lists A and B; tier C is here and over /api/kcv-watch.json), one pair per line with the tier, bridge, grade, entry step, caption, both CVEs' KEV, EPSS and publication facts and the extraction provenance; rebuilt nightly, described by its own data_exports pointer. New in 1.7.0: cvss_score, cvss_version and severity are the one score the catalog lists for the CVE, and cvss_source names who gave it (nvd, cna or the ADP's short name); manifest fields_version moves to 5. New in 1.8.0: that score follows the tiered policy of the CVE record's scores.best (the CNA when the CVE Program lists it as a vendor or open-source organization, then NVD, then CISA ADP, then any other CNA, then other ADPs).

## Path parameters

- `file` 'cves.jsonl.gz' | 'manifest.json', required

## Query parameters

- `as_of` string

## Response `200`

The gzipped JSONL (application/gzip, X-Content-Sha256 header) or the manifest ({kind, as_of, generated, count, bytes, sha256, fields[], license, attribution, notes})

## Other responses

- `401`: Missing or invalid key
- `403`: Dated snapshot requested on the free tier
- `404`: Unknown file or dated snapshot not held
- `429`: Daily limit exhausted (resets 00:00 UTC)
- `503`: Not published yet, or temporary datastore error

---

[API](https://skmtc.dev/cve-security/apis/cve-security-api.md) · [All operations](https://skmtc.dev/cve-security/apis/cve-security-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cve-security/apis/cve-security-api/revisions/2470f9c9a4eb?raw)