---
title: "GET /stats/vulnerability/sources"
method: GET
path: "/stats/vulnerability/sources"
tags: ["stats"]
---

# GET /stats/vulnerability/sources

`GET /stats/vulnerability/sources`

## Request

- Base URL: `/api` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/stats/vulnerability/sources`
- Auth: API key in header `X-API-KEY`

Compare the number of records each source holds. Sources overlap -- several describe the same CVE -- so the counts are not additive and no share of their sum is given. Sources holding no records are omitted.

## Response `200`

Success.

- StatsSourceDistribution
  - `sources` StatsSourceRecords[]: Sources ranked by records held, descending. Sources overlap, so these do not sum to a vulnerability count.
    - `records` integer: Records this source holds.
    - `source` string: Imported vulnerability source.

## Changes

- **2026-10-28** `d8432b44794a`: 1 info
  - endpoint added
- **2026-10-28** `fdfc94d2a802`: 1 breaking
  - api path removed without deprecation
- **2026-10-16** `6413f8fdb398`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api/changes/stats/vulnerability/sources/get.md)

---

[API](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api.md) - [All operations](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api/llms.txt) - [OpenAPI document](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api/revisions/b4dedf027493?raw)