---
title: "Correlate a CVE with a specific organisation's exposure"
method: POST
path: "/v1/metered/cve-identity-risk"
tags: ["Threat intelligence"]
---

# Correlate a CVE with a specific organisation's exposure

`POST /v1/metered/cve-identity-risk`

## Request

- Base URL: `https://api.relayshield.net`
- URL: `https://api.relayshield.net/v1/metered/cve-identity-risk`
- Auth: one of:
  - API key in header `X-RS-API-KEY`
  - HTTP bearer

Closes the loop from vulnerability to live identity exposure. Combines CISA KEV status, EPSS, infostealer corpus hits for the exploiting malware families, ransomware victim listing and exploit chatter into one 0-100 score for a specific domain.

**Billing.** $0.40 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.

## Request body

- object
  - `cve_id` string, required: CVE identifier. Format CVE-YYYY-NNNNN, case-insensitive.
  - `domain` string, required: Domain to correlate against.

## Response `200`

Success. `ok` is true and `data` holds the result.

- object
  - `ok` true, required
  - `data` object, required
    - `cve_id` string: The uppercased CVE ID.
    - `domain` string: The lowercased domain.
    - `risk_score` integer: 0-100. Higher is worse.
    - `risk_level` 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW': CRITICAL at 75+, HIGH at 50+, MEDIUM at 25+, otherwise LOW.
    - `in_kev` boolean: True when the CVE is in CISA KEV.
    - `epss_score` number: EPSS exploitation probability, 0.0 to 1.0.
    - `ransomware_linked` boolean: True when the CVE is linked to known ransomware campaigns.
    - `affected_product` string: Product named on the KEV record.
    - `exploiting_families` string[]: Malware families known to exploit this CVE.
    - `stealer_corpus_hits` object[]: Where an exploiting family and the domain co-occur in the corpus.
      - `family` string: Malware family.
      - `ioc_count` integer: Indicators matched.
      - `latest` string: Most recent sighting.
    - `on_ransomware_victim_list` boolean: True when the domain appears on a ransomware leak site.
    - `victim_groups` string[]: Groups claiming the domain.
    - `exploit_chatter_count` integer: Pre-publication chatter signals for this CVE.
    - `risk_factors` string[]: One line per signal that contributed, with its reasoning.
    - `recommendation` string: Recommended action for the score band.

## Other responses

- `400`: `cve_id` is missing or malformed, or `domain` is missing.
- `401`: Missing or invalid API key.
- `402`: No credits and no active subscription. The response carries `topup_url`.
- `405`: Wrong HTTP method. Every endpoint is POST.

---

[API](https://skmtc.dev/relayshield/apis/relayshield-api.md) · [All operations](https://skmtc.dev/relayshield/apis/relayshield-api/llms.txt) · [OpenAPI document](https://skmtc.dev/relayshield/apis/relayshield-api/revisions/4d4721b936dd?raw)