---
title: "Cve Timeline"
method: GET
path: "/api/cves/{cve_id}/timeline"
tags: ["cves"]
---

# Cve Timeline

`GET /api/cves/{cve_id}/timeline`

## Request

- Base URL: `https://kernelscan.io`
- URL: `https://kernelscan.io/api/cves/{cve_id}/timeline`
- Auth: none declared

CVE lifecycle timeline (backend#368) — threat and kernel-code events.

A separate, lazily-loaded endpoint rather than a block inside
``/public``: the timeline needs the sighting table and every fix row, and
joining that into the CVE payload would make each of the ~20 rows on a list
page pay for a detail-only visualisation. A detail view opens, this fires
once.

Visibility follows the CVE browser (see _can_view_cve_detail): anonymous
callers get public CVEs only, signed-in users everything their plan's feed
window shows. Anything else is a 404, never a 403, so the endpoint cannot be
used to probe which CVEs exist outside the caller's window.

## Path parameters

- `cve_id` string, required

## Query parameters

- `branch` string, nullable: Product kernel series, e.g. "6.6" — floats that lane to the top in product context. Cosmetic ordering only; it never changes which events are returned.

## Response `200`

Successful Response

- object

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/kernelscan/apis/kernelscan-api.md) · [All operations](https://skmtc.dev/kernelscan/apis/kernelscan-api/llms.txt) · [OpenAPI document](https://skmtc.dev/kernelscan/apis/kernelscan-api/revisions/4fa51d41484e?raw)