---
title: "Publication change stream (keyed, cursorable)"
method: GET
path: "/api/updates"
---

# Publication change stream (keyed, cursorable)

`GET /api/updates`

## Request

- Base URL: `https://cve-security.com`
- URL: `https://cve-security.com/api/updates`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

Every event this site published, in the order WE published it: first_published (CVE newly tracked), kev_added, detection_added (first ET/Snort signature), remediation_added (first vendor fix). Walk forward with `cursor` from each response's next_cursor; `since` is first-call convenience with strictly-after semantics. published_at is this site's publish time (rows before 2026-07-26 are day-granular; a bare-date `since` therefore excludes that day's legacy day-bucket rows); source_date is the origin date (NVD/CISA/detection) for context. Events for withdrawn CVE identifiers are omitted. Keyed: this stream is an integration surface, so it uses the same free account key as /api/cve/{id} and counts against the daily limit. The same stream without a key: the MCP get_updates tool (AI agents) and the Atom feeds /feeds/updates.xml + /feeds/updates/{new-cves|kev|detection|remediation}.xml (newest-100 window for feed readers). Per-IP rate limited (30/min).

## Query parameters

- `cursor` string
- `since` string
- `type` 'first_published' | 'kev_added' | 'detection_added' | 'remediation_added'
- `limit` integer

## Response `200`

{ as_of, events[], next_cursor, has_more }, each event: id, cve_id, change_type, published_at, source_date, detail, severity, kev_listed, url. as_of is the stream's newest publish stamp; hold next_cursor and re-poll to tail the stream.

- object

## Other responses

- `400`: Malformed cursor/since/type, or cursor and since together
- `401`: Missing or invalid key
- `429`: IP rate limit or daily key limit (Retry-After / X-RateLimit-* headers)
- `503`: Stream unavailable, an outage, NOT 'no updates'

---

[API](https://skmtc.dev/cve-security/apis/cve-security-api.md) · [All operations](https://skmtc.dev/cve-security/apis/cve-security-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cve-security/apis/cve-security-api/revisions/2470f9c9a4eb?raw)