---
title: "CVE data attribution manifest"
method: GET
path: "/cve/attribution"
tags: ["cve"]
---

# CVE data attribution manifest

`GET /cve/attribution`

## Request

- Base URL: `https://api.ismalicious.com`
- URL: `https://api.ismalicious.com/cve/attribution`
- Auth: none required

Every upstream the CVE answers draw on, with its publisher, licence,
what its terms allow (`redistribution`: `allowed`, `conditional`,
`forbidden`, `silent`), the credit it asks for, and, for the sources
served against their terms, the clause quoted (`restricted`). `notices`
are the two every CVE copy must carry: MITRE's copyright designation with
the CVE Program Terms of Use licence, and the NVD notice. Each `/cve`
answer links here with a `Link: <…/cve/attribution>; rel="license"`
header; `/cve/{id}` also carries its own `attribution` block. Free: no
key needed, no quota spent, cached for a day.

## Response `200`

`{version, updated, creditsUrl, notices[{id, text, licence, url}], shortNotice, restrictedNote, sources{<id>: {name, publisher, family, licence, licenceUrl, redistribution, attribution, url, recordUrl, always, catalogTokens, signalSources, advisorySources, packageSources, fields, restricted{terms}, registerRow}}}`, the year filled in the notices

- object

## Changes

- **2026-11-01** `e802f56e895a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/cve/attribution/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) - [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/b6f45e6169a7?raw)