---
title: "GET /stats/time_to_exploit"
method: GET
path: "/stats/time_to_exploit"
tags: ["stats"]
---

# GET /stats/time_to_exploit

`GET /stats/time_to_exploit`

## Request

- Base URL: `/api` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/stats/time_to_exploit`
- Auth: API key in header `X-API-KEY`

Returns the publication-to-exploitation summary of a source, over the whole source, over the records it published in one year, or per publication year with granularity=year.

## Query parameters

- `source` string
- `period` string
- `granularity` '' | 'year'

## Response `200`

Success.

- StatsTimeToExploit
  - `available` boolean: False when the cross-store scan has never run.
  - `before_publication_mean_days` number: Mean of the intervals of the records listed before publication (a negative number); absent when there are none.
  - `computed_at` string: When the snapshot was taken.
  - `count` integer: Records the figure rests on -- those ever exploited. Reported for every period, because one publication year's exploited records can be a dozen.
  - `cves_exploited` integer: Distinct CVEs those entries named -- the denominator of the two unmatched counts.
  - `entries_scanned` integer: Known-exploited catalogue entries the scan read.
  - `excluded_not_published` integer: Exploited records left out because they are not currently published: withdrawn or reserved. Zero for a source that keeps no lifecycle index, where nothing is narrowed.
  - `exploited_before_publication` integer: Of count, how many were listed before the record was published.
  - `granularity` string: year with the per-year series.
  - `max_days` number: Longest observed interval.
  - `mean_days` number: Mean days from publication to first listing, one decimal.
  - `median_days` number: Median days, reported alongside the mean.
  - `min_days` number: Shortest observed interval.
  - `p90_days` number: 90th percentile, nearest rank.
  - `period` string: The publication year the summary covers, or null for the whole source.
  - `records_outside_year_range` integer: With a granularity, records whose publication year falls outside the years the series is drawn over: `years` sums to `count` minus this.
  - `scope_catalogs` object: The catalogue short names the figure was measured over, present when `scoped`. Its own field because `catalogs` carries the per-catalogue series in the period form.
  - `scoped` boolean: True when the figure was measured over the catalogues configured for this source (STATS_KEV_CATALOGS), which `scope_catalogs` then names. False when it covers every catalogue the instance knows.
  - `source` string: The source reported on.
  - `unmatched_no_publication_date` integer: Exploited records carrying no publication date, so they could not be dated.
  - `unmatched_no_record` integer: Exploited CVEs this source holds no record for, so they could not be dated. Reported rather than dropped: the figures above are a mean over what remains.
  - `years` object: With granularity=year: publication year -> the same summary (count, mean_days, median_days, p90_days, min_days, max_days, exploited_before_publication, before_publication_mean_days), over every year the source spans; a year whose records were never exploited is {count: 0}.

## Other responses

- `400`: The request could not be satisfied.

## Changes

- **2026-10-09** `8b40b3c9fc59`: 1 info
  - added the new optional `query` request parameter `granularity`
- **2026-10-09** `aee06988b549`: 1 info
  - added the new optional `query` request parameter `period`
- **2026-09-21** `a850f2cbf0bc`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api/changes/stats/time_to_exploit/get.md)

---

[API](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api.md) - [All operations](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api/llms.txt) - [OpenAPI document](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api/revisions/b4dedf027493?raw)