---
title: "Find CVEs actively targeting your declared stack"
method: POST
path: "/v1/metered/tech-stack-cve"
tags: ["Threat intelligence"]
---

# Find CVEs actively targeting your declared stack

`POST /v1/metered/tech-stack-cve`

## Request

- Base URL: `https://api.relayshield.net`
- URL: `https://api.relayshield.net/v1/metered/tech-stack-cve`
- Auth: one of:
  - API key in header `X-RS-API-KEY`
  - HTTP bearer

Pass the products you run, or a domain whose stored stack RelayShield already holds, and get back the KEV and high-EPSS CVEs that match. Covers AI agent orchestration frameworks (Langflow, LangChain, AutoGPT, CrewAI, Flowise, self-hosted n8n) and their common companion infrastructure, which is the exact vector used in the first documented autonomous-AI-agent ransomware operation.

**Billing.** $0.20 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.

**Note.** The proof-of-concept lookup is deliberately bounded to the top 3 non-KEV matches. A CVE already in KEV is being exploited in the wild, which is a strictly stronger signal than a public PoC existing.

## Request body

- object: At least one of: `tech_stack`, `domain`.
  - `tech_stack` string[]: Product names. Entries shorter than 3 characters are ignored.
  - `domain` string: Domain whose stored tech stack should be used. Only consulted when `tech_stack` is absent.

## Response `200`

Success. `ok` is true and `data` holds the result.

- object
  - `ok` true, required
  - `data` object, required
    - `tech_stack_queried` string[]: The stack actually used, whether supplied or loaded from the domain.
    - `total_matches` integer: CVEs matching the stack.
    - `critical_count` integer: Matches that are in KEV or ransomware-linked.
    - `summary` string: One-line roll-up.
    - `critical_cves` object[]: Up to 10 KEV or ransomware-linked matches.
      - `cve_id` string: CVE identifier.
      - `matched_product` string: Which stack entry matched.
      - `epss_score` number: EPSS exploitation probability.
      - `in_kev` boolean: True when in CISA KEV.
      - `ransomware_campaign` boolean: True when linked to a ransomware campaign.
      - `cvss_score` number, nullable: CVSS base score. null when unscored.
      - `description` string: Description, truncated to 200 characters.
      - `published` string: Publication or KEV-addition date.
      - `poc_available` boolean: Present on up to 3 non-KEV matches: whether a public proof-of-concept exists.
    - `all_matches` object[]: Up to 25 matches, sorted KEV first, then ransomware-linked, then by EPSS.

## Other responses

- `400`: `tech_stack` is missing or not a list and no stored stack was found for `domain`.
- `401`: Missing or invalid API key.
- `402`: No credits and no active subscription. The response carries `topup_url`.
- `405`: Wrong HTTP method. Every endpoint is POST.

---

[API](https://skmtc.dev/relayshield/apis/relayshield-api.md) · [All operations](https://skmtc.dev/relayshield/apis/relayshield-api/llms.txt) · [OpenAPI document](https://skmtc.dev/relayshield/apis/relayshield-api/revisions/4d4721b936dd?raw)