---
title: "Look up one vulnerability by its identifier"
method: GET
path: "/api/v1/databanks/{slug}/vulnerability"
tags: ["Data", "Provenance"]
---

# Look up one vulnerability by its identifier

`GET /api/v1/databanks/{slug}/vulnerability`

## Request

- Base URL: `https://api.daystruct.ai`
- URL: `https://api.daystruct.ai/api/v1/databanks/{slug}/vulnerability`
- Auth: one of:
  - none
  - HTTP bearer

Defined for the cybersecurity databank. The entity here is the vulnerability, so this is the entry point for a caller that holds an identifier rather than a package it is running -- every other route requires a package name. Returns the affected package and range, the version that fixes it, severity, and exploitation status. Fields are returned as claims carrying their own authority: status 'known' with authority 'exclusive' means Daystruct has evidence for the value, while status 'unknown' with authority 'non_exclusive' means Daystruct has no evidence either way and the answer does not contradict or supersede what the caller already knows. Exploitation is never reported as false, because the known-exploited catalog held here is a partial slice.

## Path parameters

- `slug` string, required

## Query parameters

- `cve` string, required

## Headers

- `X-Daystruct-Client-Id` string
- `X-Daystruct-Agent` string
- `X-Daystruct-Use-Case` string
- `X-Daystruct-Agent-Id` string, uuid

## Response `200`

A bounded JSON envelope with pagination metadata.

## Other responses

- `400`: Invalid query.
- `429`: Rate limit exceeded.

---

[API](https://skmtc.dev/daystruct/apis/daystruct-api.md) · [All operations](https://skmtc.dev/daystruct/apis/daystruct-api/llms.txt) · [OpenAPI document](https://skmtc.dev/daystruct/apis/daystruct-api/revisions/8cd3c7f60e18?raw)