---
title: "Report known-exploited inclusion, in total or per period"
method: GET
path: "/euvd/stats/kev"
tags: ["euvd-stats"]
---

# Report known-exploited inclusion, in total or per period

`GET /euvd/stats/kev`

## Request

- Base URL: `/api` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/euvd/stats/kev`
- Auth: API key in header `X-API-KEY`

## Query parameters

- `granularity` '' | 'year' | 'month'
- `period` string

## Response `200`

Success.

- EUVDStatsKEV
  - `available` boolean: False before the KEV sync has built the exploited index.
  - `basis` string: What the counts are counted on: `membership` without granularity (set membership, carrying no date), `listed_at` with it (the date each catalogue listed the record, never the record's publication date).
  - `catalogs` object: Catalogue short name -> record count, or -> {period: count} with a granularity. These overlap: a record listed by two catalogues is counted by both, so they sum to more than `exploited` (or than `totals`).
  - `computed_at` string: When the period buckets were last prepared.
  - `exploited` integer: Records whose CVE appears in at least one of the catalogues in `catalogs` (a union, not their sum). Null in the period form, where `totals` carries the series.
  - `granularity` string: year or month with a period series, null without one.
  - `period` string: With granularity=month, the year broken into months.
  - `ratio` number: exploited / total, or null when the catalogue is empty.
  - `scope_catalogs` object: The catalogue short names the figure was measured over, present when `scoped`. Its own field because `catalogs` carries the per-catalogue series in the period form.
  - `scoped` boolean: True when the figure is restricted to the catalogues configured for this source (STATS_KEV_CATALOGS): `exploited` is then the union of exactly the catalogues listed in `catalogs`. False when it covers every catalogue the instance knows.
  - `total` integer: The denominator: records in the catalogue, published where that is known. Null in the period form.
  - `total_basis` string: Which population ``total`` counts: ``state_published`` for a source whose lifecycle index says what is published now, ``date_published`` for one that only records when a vulnerability was published, ``held`` for one that does neither. Null in the period form.
  - `totals` object: Period -> distinct records that became known exploited in it, each counted once in the period its first catalogue listed it. Only with a granularity.
  - `unattributed` integer: Exploited records held under a catalogue this instance cannot name, counted the same way when `scoped`: a record a scope leaves out is not unattributed, but one in no known catalogue still is. Non-zero means the local GCVE reference data is absent or stale. Null in the period form, where `unattributed_periods` carries the series.
  - `unattributed_periods` object: Period -> exploited records held under a catalogue this instance cannot name. Only with a granularity; the membership form reports the count in `unattributed`.

## Other responses

- `400`: The request could not be satisfied.

## Changes

- **2026-10-09** `aee06988b549`: 3 info
  - added the new optional `query` request parameter `granularity`
  - added the new optional `query` request parameter `period`
  - added the non-success response with the status `400`
- **2026-09-21** `a850f2cbf0bc`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api/changes/euvd/stats/kev/get.md)

---

[API](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api.md) - [All operations](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api/llms.txt) - [OpenAPI document](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api/revisions/b4dedf027493?raw)