--- title: "Resolve an external identifier to its CVEs" method: GET path: "/cve/resolve" tags: ["cve"] --- # Resolve an external identifier to its CVEs `GET /cve/resolve` ## Request - Base URL: `https://api.ismalicious.com` - URL: `https://api.ismalicious.com/cve/resolve` - Auth: one of: - API key in header `X-API-KEY` - HTTP bearer - HTTP basic What an id from another database names in the catalogue, as a LIST: a GHSA advisory can cover several CVEs, a bundle advisory (USN, RHSA, ALSA, DSA, SUSE-SU…) fixes several. Each match carries its `relation` (`alias`: the same flaw; `bundle`: an advisory that fixes it with others; `exploit-module`, `exploit-reference`; `embedded`: the id spells the CVE id out), the `sources` that assert it, the id's own `url` and the `licenses` the asserting records carry. A CVE id answers itself. At most 50 matches, aliases first, then newest first; `count` is every CVE the id names and `truncated` says when `matches` lists fewer (an ALSA can fix 323). `GET /cve/{id}` and `GET /cve?id=` accept the same ids and answer with the document when an id names exactly one CVE. Every answer carries `Link: ; rel="license"`. Costs one request of the monthly quota. ## Query parameters - `id` string ## Response `200` `{id, scheme, count, truncated, matches[{cveId, scheme, externalId, relation, sources[], url, licenses[]}]}`: `count` is every CVE the id names, `matches` the first 50 of them (`truncated` when there are more) - object ## Other responses - `400`: `id` missing, or neither a CVE id nor an accepted external id - `401`: Unauthorized - Missing or invalid API key - `404`: No CVE known under this id - `429`: Too many requests - Rate limit exceeded - `500`: Database error ## Changes - **2026-11-01** `c6e57c81b8fd`: 1 info - endpoint added [Operation history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/cve/resolve/get.md) --- [API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) - [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/b6f45e6169a7?raw)