--- title: "Get the timeline of a vulnerability" method: GET path: "/vulnerability/{vulnerability_id}/timeline" tags: ["vulnerability"] --- # Get the timeline of a vulnerability `GET /vulnerability/{vulnerability_id}/timeline` ## Request - Base URL: `/api` (relative, and the document was published on a file host, not at the API’s origin) - URL: `/api/vulnerability/{vulnerability_id}/timeline` - Auth: API key in header `X-API-KEY` Every dated event of a vulnerability, oldest first: the dates of its record and of every related record (publication, updates, advisory revisions, SSVC decisions, disclosure events...), its sightings and its KEV catalog entries. Sightings and KEV entries filed under the GCVE-0 spelling of a CVE, or listing it in altId, are included. The Timeline tab of the vulnerability page shows the same events and duration calculations, including evidence, approximations and missing dates. ## Response `200` Success. - Timeline - `data` TimelineEvent[]: The events, oldest first. - `added_in_revision` boolean: A disclosure date taken from the revision that added this vulnerability to an advisory about several, which replaces the advisory's initial release date. - `batch_listing` boolean: KEV exploitation inputs: dated on a day the catalog listed a batch of vulnerabilities (a backlog, not new activity). - `content` string: Sightings: their content, when any. - `date_only` boolean: The source gave a day without a time. - `field` string: The date's path within that record. - `kind` 'milestone' | 'sighting' | 'kev' | 'other' - `label` string - `linked_record` boolean: The date comes from a related record (a CSAF advisory, a national database entry...), not from the vulnerability's own record. - `metric_basis` string: Optional evidence basis: recorded_event, kev_first_seen, kev_report or sighting_report. - `metric_role` string: Optional calculation input: discovery, report, acknowledgement, disclosure, exploit_publication, exploitation, exploitation_report, patch or patch_observed. - `publication_copy` boolean: KEV dates: the vulnerability's publication instant copied into the entry, not a listing date; shown, but not a calculation input. - `record` string: The record holding the date. - `source` string: Where the date comes from. - `status` object: KEV entries: {status_reason, exploited}. - `timestamp` string: RFC 3339, UTC, millisecond precision. - `url` string: Sightings: their source, when it is an HTTP(S) URL. - `uuid` string: Sightings and KEV entries: their UUID. - `value` string: The date as the source wrote it. - `metadata` object: vulnerability: the id served; count: the number of events; kinds: the count per kind. - `metrics` TimelineMetrics - `anchors` object: Selected origin, discovery, report, acknowledgement, disclosure, exploit_publication, exploitation and patch events; missing anchors are null. - `as_of` string: UTC calculation time. Future events are excluded from metrics. - `disclosure_to_exploit` TimelineDuration - `approximate` boolean: At least one endpoint has day precision: a bare date, or a timestamp at exactly midnight UTC. - `available` boolean: False when a required endpoint has no dated evidence. - `batch_listing` boolean: An endpoint is a KEV batch listing: the exploitation began earlier than that date. - `days` number: Elapsed seconds / 86400, without rounding. - `discovery_after_disclosure` boolean: total_time_to_patch: the discovery date is certainly later than public disclosure, so it most likely records when a publisher learned of the vulnerability. - `end` TimelineEvent - `added_in_revision` boolean: A disclosure date taken from the revision that added this vulnerability to an advisory about several, which replaces the advisory's initial release date. - `batch_listing` boolean: KEV exploitation inputs: dated on a day the catalog listed a batch of vulnerabilities (a backlog, not new activity). - `content` string: Sightings: their content, when any. - `date_only` boolean: The source gave a day without a time. - `field` string: The date's path within that record. - `kind` 'milestone' | 'sighting' | 'kev' | 'other' - `label` string - `linked_record` boolean: The date comes from a related record (a CSAF advisory, a national database entry...), not from the vulnerability's own record. - `metric_basis` string: Optional evidence basis: recorded_event, kev_first_seen, kev_report or sighting_report. - `metric_role` string: Optional calculation input: discovery, report, acknowledgement, disclosure, exploit_publication, exploitation, exploitation_report, patch or patch_observed. - `publication_copy` boolean: KEV dates: the vulnerability's publication instant copied into the entry, not a listing date; shown, but not a calculation input. - `record` string: The record holding the date. - `source` string: Where the date comes from. - `status` object: KEV entries: {status_reason, exploited}. - `timestamp` string: RFC 3339, UTC, millisecond precision. - `url` string: Sightings: their source, when it is an HTTP(S) URL. - `uuid` string: Sightings and KEV entries: their UUID. - `value` string: The date as the source wrote it. - `end_before_start` boolean: The end event certainly preceded the start event; false when the order is unknown. - `hours` number: Elapsed seconds / 3600, without rounding. - `max_seconds` number: Largest interval the endpoints' precision allows (a bare date spans its whole UTC day). - `min_seconds` number: Smallest interval the endpoints' precision allows; equals seconds when both are exact. - `missing` string[]: Unavailable duration: missing start and/or end. - `ongoing` boolean: No patch recorded: the endpoint is the calculation clock, not proof of an unpatched system. - `order_known` boolean: False when date-only precision does not establish which endpoint came first. - `seconds` number: Nominal elapsed seconds (a bare date read as midnight UTC); signed except for time_unpatched, which is clamped at zero. - `start` TimelineEvent - `added_in_revision` boolean: A disclosure date taken from the revision that added this vulnerability to an advisory about several, which replaces the advisory's initial release date. - `batch_listing` boolean: KEV exploitation inputs: dated on a day the catalog listed a batch of vulnerabilities (a backlog, not new activity). - `content` string: Sightings: their content, when any. - `date_only` boolean: The source gave a day without a time. - `field` string: The date's path within that record. - `kind` 'milestone' | 'sighting' | 'kev' | 'other' - `label` string - `linked_record` boolean: The date comes from a related record (a CSAF advisory, a national database entry...), not from the vulnerability's own record. - `metric_basis` string: Optional evidence basis: recorded_event, kev_first_seen, kev_report or sighting_report. - `metric_role` string: Optional calculation input: discovery, report, acknowledgement, disclosure, exploit_publication, exploitation, exploitation_report, patch or patch_observed. - `publication_copy` boolean: KEV dates: the vulnerability's publication instant copied into the entry, not a listing date; shown, but not a calculation input. - `record` string: The record holding the date. - `source` string: Where the date comes from. - `status` object: KEV entries: {status_reason, exploited}. - `timestamp` string: RFC 3339, UTC, millisecond precision. - `url` string: Sightings: their source, when it is an HTTP(S) URL. - `uuid` string: Sightings and KEV entries: their UUID. - `value` string: The date as the source wrote it. - `disclosure_to_exploit_publication` TimelineDuration - `approximate` boolean: At least one endpoint has day precision: a bare date, or a timestamp at exactly midnight UTC. - `available` boolean: False when a required endpoint has no dated evidence. - `batch_listing` boolean: An endpoint is a KEV batch listing: the exploitation began earlier than that date. - `days` number: Elapsed seconds / 86400, without rounding. - `discovery_after_disclosure` boolean: total_time_to_patch: the discovery date is certainly later than public disclosure, so it most likely records when a publisher learned of the vulnerability. - `end` TimelineEvent - `added_in_revision` boolean: A disclosure date taken from the revision that added this vulnerability to an advisory about several, which replaces the advisory's initial release date. - `batch_listing` boolean: KEV exploitation inputs: dated on a day the catalog listed a batch of vulnerabilities (a backlog, not new activity). - `content` string: Sightings: their content, when any. - `date_only` boolean: The source gave a day without a time. - `field` string: The date's path within that record. - `kind` 'milestone' | 'sighting' | 'kev' | 'other' - `label` string - `linked_record` boolean: The date comes from a related record (a CSAF advisory, a national database entry...), not from the vulnerability's own record. - `metric_basis` string: Optional evidence basis: recorded_event, kev_first_seen, kev_report or sighting_report. - `metric_role` string: Optional calculation input: discovery, report, acknowledgement, disclosure, exploit_publication, exploitation, exploitation_report, patch or patch_observed. - `publication_copy` boolean: KEV dates: the vulnerability's publication instant copied into the entry, not a listing date; shown, but not a calculation input. - `record` string: The record holding the date. - `source` string: Where the date comes from. - `status` object: KEV entries: {status_reason, exploited}. - `timestamp` string: RFC 3339, UTC, millisecond precision. - `url` string: Sightings: their source, when it is an HTTP(S) URL. - `uuid` string: Sightings and KEV entries: their UUID. - `value` string: The date as the source wrote it. - `end_before_start` boolean: The end event certainly preceded the start event; false when the order is unknown. - `hours` number: Elapsed seconds / 3600, without rounding. - `max_seconds` number: Largest interval the endpoints' precision allows (a bare date spans its whole UTC day). - `min_seconds` number: Smallest interval the endpoints' precision allows; equals seconds when both are exact. - `missing` string[]: Unavailable duration: missing start and/or end. - `ongoing` boolean: No patch recorded: the endpoint is the calculation clock, not proof of an unpatched system. - `order_known` boolean: False when date-only precision does not establish which endpoint came first. - `seconds` number: Nominal elapsed seconds (a bare date read as midnight UTC); signed except for time_unpatched, which is clamped at zero. - `start` TimelineEvent - `added_in_revision` boolean: A disclosure date taken from the revision that added this vulnerability to an advisory about several, which replaces the advisory's initial release date. - `batch_listing` boolean: KEV exploitation inputs: dated on a day the catalog listed a batch of vulnerabilities (a backlog, not new activity). - `content` string: Sightings: their content, when any. - `date_only` boolean: The source gave a day without a time. - `field` string: The date's path within that record. - `kind` 'milestone' | 'sighting' | 'kev' | 'other' - `label` string - `linked_record` boolean: The date comes from a related record (a CSAF advisory, a national database entry...), not from the vulnerability's own record. - `metric_basis` string: Optional evidence basis: recorded_event, kev_first_seen, kev_report or sighting_report. - `metric_role` string: Optional calculation input: discovery, report, acknowledgement, disclosure, exploit_publication, exploitation, exploitation_report, patch or patch_observed. - `publication_copy` boolean: KEV dates: the vulnerability's publication instant copied into the entry, not a listing date; shown, but not a calculation input. - `record` string: The record holding the date. - `source` string: Where the date comes from. - `status` object: KEV entries: {status_reason, exploited}. - `timestamp` string: RFC 3339, UTC, millisecond precision. - `url` string: Sightings: their source, when it is an HTTP(S) URL. - `uuid` string: Sightings and KEV entries: their UUID. - `value` string: The date as the source wrote it. - `disclosure_to_patch` TimelineDuration - `approximate` boolean: At least one endpoint has day precision: a bare date, or a timestamp at exactly midnight UTC. - `available` boolean: False when a required endpoint has no dated evidence. - `batch_listing` boolean: An endpoint is a KEV batch listing: the exploitation began earlier than that date. - `days` number: Elapsed seconds / 86400, without rounding. - `discovery_after_disclosure` boolean: total_time_to_patch: the discovery date is certainly later than public disclosure, so it most likely records when a publisher learned of the vulnerability. - `end` TimelineEvent - `added_in_revision` boolean: A disclosure date taken from the revision that added this vulnerability to an advisory about several, which replaces the advisory's initial release date. - `batch_listing` boolean: KEV exploitation inputs: dated on a day the catalog listed a batch of vulnerabilities (a backlog, not new activity). - `content` string: Sightings: their content, when any. - `date_only` boolean: The source gave a day without a time. - `field` string: The date's path within that record. - `kind` 'milestone' | 'sighting' | 'kev' | 'other' - `label` string - `linked_record` boolean: The date comes from a related record (a CSAF advisory, a national database entry...), not from the vulnerability's own record. - `metric_basis` string: Optional evidence basis: recorded_event, kev_first_seen, kev_report or sighting_report. - `metric_role` string: Optional calculation input: discovery, report, acknowledgement, disclosure, exploit_publication, exploitation, exploitation_report, patch or patch_observed. - `publication_copy` boolean: KEV dates: the vulnerability's publication instant copied into the entry, not a listing date; shown, but not a calculation input. - `record` string: The record holding the date. - `source` string: Where the date comes from. - `status` object: KEV entries: {status_reason, exploited}. - `timestamp` string: RFC 3339, UTC, millisecond precision. - `url` string: Sightings: their source, when it is an HTTP(S) URL. - `uuid` string: Sightings and KEV entries: their UUID. - `value` string: The date as the source wrote it. - `end_before_start` boolean: The end event certainly preceded the start event; false when the order is unknown. - `hours` number: Elapsed seconds / 3600, without rounding. - `max_seconds` number: Largest interval the endpoints' precision allows (a bare date spans its whole UTC day). - `min_seconds` number: Smallest interval the endpoints' precision allows; equals seconds when both are exact. - `missing` string[]: Unavailable duration: missing start and/or end. - `ongoing` boolean: No patch recorded: the endpoint is the calculation clock, not proof of an unpatched system. - `order_known` boolean: False when date-only precision does not establish which endpoint came first. - `seconds` number: Nominal elapsed seconds (a bare date read as midnight UTC); signed except for time_unpatched, which is clamped at zero. - `start` TimelineEvent - `added_in_revision` boolean: A disclosure date taken from the revision that added this vulnerability to an advisory about several, which replaces the advisory's initial release date. - `batch_listing` boolean: KEV exploitation inputs: dated on a day the catalog listed a batch of vulnerabilities (a backlog, not new activity). - `content` string: Sightings: their content, when any. - `date_only` boolean: The source gave a day without a time. - `field` string: The date's path within that record. - `kind` 'milestone' | 'sighting' | 'kev' | 'other' - `label` string - `linked_record` boolean: The date comes from a related record (a CSAF advisory, a national database entry...), not from the vulnerability's own record. - `metric_basis` string: Optional evidence basis: recorded_event, kev_first_seen, kev_report or sighting_report. - `metric_role` string: Optional calculation input: discovery, report, acknowledgement, disclosure, exploit_publication, exploitation, exploitation_report, patch or patch_observed. - `publication_copy` boolean: KEV dates: the vulnerability's publication instant copied into the entry, not a listing date; shown, but not a calculation input. - `record` string: The record holding the date. - `source` string: Where the date comes from. - `status` object: KEV entries: {status_reason, exploited}. - `timestamp` string: RFC 3339, UTC, millisecond precision. - `url` string: Sightings: their source, when it is an HTTP(S) URL. - `uuid` string: Sightings and KEV entries: their UUID. - `value` string: The date as the source wrote it. - `exploit_publication_to_patch` TimelineDuration - `approximate` boolean: At least one endpoint has day precision: a bare date, or a timestamp at exactly midnight UTC. - `available` boolean: False when a required endpoint has no dated evidence. - `batch_listing` boolean: An endpoint is a KEV batch listing: the exploitation began earlier than that date. - `days` number: Elapsed seconds / 86400, without rounding. - `discovery_after_disclosure` boolean: total_time_to_patch: the discovery date is certainly later than public disclosure, so it most likely records when a publisher learned of the vulnerability. - `end` TimelineEvent - `added_in_revision` boolean: A disclosure date taken from the revision that added this vulnerability to an advisory about several, which replaces the advisory's initial release date. - `batch_listing` boolean: KEV exploitation inputs: dated on a day the catalog listed a batch of vulnerabilities (a backlog, not new activity). - `content` string: Sightings: their content, when any. - `date_only` boolean: The source gave a day without a time. - `field` string: The date's path within that record. - `kind` 'milestone' | 'sighting' | 'kev' | 'other' - `label` string - `linked_record` boolean: The date comes from a related record (a CSAF advisory, a national database entry...), not from the vulnerability's own record. - `metric_basis` string: Optional evidence basis: recorded_event, kev_first_seen, kev_report or sighting_report. - `metric_role` string: Optional calculation input: discovery, report, acknowledgement, disclosure, exploit_publication, exploitation, exploitation_report, patch or patch_observed. - `publication_copy` boolean: KEV dates: the vulnerability's publication instant copied into the entry, not a listing date; shown, but not a calculation input. - `record` string: The record holding the date. - `source` string: Where the date comes from. - `status` object: KEV entries: {status_reason, exploited}. - `timestamp` string: RFC 3339, UTC, millisecond precision. - `url` string: Sightings: their source, when it is an HTTP(S) URL. - `uuid` string: Sightings and KEV entries: their UUID. - `value` string: The date as the source wrote it. - `end_before_start` boolean: The end event certainly preceded the start event; false when the order is unknown. - `hours` number: Elapsed seconds / 3600, without rounding. - `max_seconds` number: Largest interval the endpoints' precision allows (a bare date spans its whole UTC day). - `min_seconds` number: Smallest interval the endpoints' precision allows; equals seconds when both are exact. - `missing` string[]: Unavailable duration: missing start and/or end. - `ongoing` boolean: No patch recorded: the endpoint is the calculation clock, not proof of an unpatched system. - `order_known` boolean: False when date-only precision does not establish which endpoint came first. - `seconds` number: Nominal elapsed seconds (a bare date read as midnight UTC); signed except for time_unpatched, which is clamped at zero. - `start` TimelineEvent - `added_in_revision` boolean: A disclosure date taken from the revision that added this vulnerability to an advisory about several, which replaces the advisory's initial release date. - `batch_listing` boolean: KEV exploitation inputs: dated on a day the catalog listed a batch of vulnerabilities (a backlog, not new activity). - `content` string: Sightings: their content, when any. - `date_only` boolean: The source gave a day without a time. - `field` string: The date's path within that record. - `kind` 'milestone' | 'sighting' | 'kev' | 'other' - `label` string - `linked_record` boolean: The date comes from a related record (a CSAF advisory, a national database entry...), not from the vulnerability's own record. - `metric_basis` string: Optional evidence basis: recorded_event, kev_first_seen, kev_report or sighting_report. - `metric_role` string: Optional calculation input: discovery, report, acknowledgement, disclosure, exploit_publication, exploitation, exploitation_report, patch or patch_observed. - `publication_copy` boolean: KEV dates: the vulnerability's publication instant copied into the entry, not a listing date; shown, but not a calculation input. - `record` string: The record holding the date. - `source` string: Where the date comes from. - `status` object: KEV entries: {status_reason, exploited}. - `timestamp` string: RFC 3339, UTC, millisecond precision. - `url` string: Sightings: their source, when it is an HTTP(S) URL. - `uuid` string: Sightings and KEV entries: their UUID. - `value` string: The date as the source wrote it. - `exploitation_to_patch` TimelineDuration - `approximate` boolean: At least one endpoint has day precision: a bare date, or a timestamp at exactly midnight UTC. - `available` boolean: False when a required endpoint has no dated evidence. - `batch_listing` boolean: An endpoint is a KEV batch listing: the exploitation began earlier than that date. - `days` number: Elapsed seconds / 86400, without rounding. - `discovery_after_disclosure` boolean: total_time_to_patch: the discovery date is certainly later than public disclosure, so it most likely records when a publisher learned of the vulnerability. - `end` TimelineEvent - `added_in_revision` boolean: A disclosure date taken from the revision that added this vulnerability to an advisory about several, which replaces the advisory's initial release date. - `batch_listing` boolean: KEV exploitation inputs: dated on a day the catalog listed a batch of vulnerabilities (a backlog, not new activity). - `content` string: Sightings: their content, when any. - `date_only` boolean: The source gave a day without a time. - `field` string: The date's path within that record. - `kind` 'milestone' | 'sighting' | 'kev' | 'other' - `label` string - `linked_record` boolean: The date comes from a related record (a CSAF advisory, a national database entry...), not from the vulnerability's own record. - `metric_basis` string: Optional evidence basis: recorded_event, kev_first_seen, kev_report or sighting_report. - `metric_role` string: Optional calculation input: discovery, report, acknowledgement, disclosure, exploit_publication, exploitation, exploitation_report, patch or patch_observed. - `publication_copy` boolean: KEV dates: the vulnerability's publication instant copied into the entry, not a listing date; shown, but not a calculation input. - `record` string: The record holding the date. - `source` string: Where the date comes from. - `status` object: KEV entries: {status_reason, exploited}. - `timestamp` string: RFC 3339, UTC, millisecond precision. - `url` string: Sightings: their source, when it is an HTTP(S) URL. - `uuid` string: Sightings and KEV entries: their UUID. - `value` string: The date as the source wrote it. - `end_before_start` boolean: The end event certainly preceded the start event; false when the order is unknown. - `hours` number: Elapsed seconds / 3600, without rounding. - `max_seconds` number: Largest interval the endpoints' precision allows (a bare date spans its whole UTC day). - `min_seconds` number: Smallest interval the endpoints' precision allows; equals seconds when both are exact. - `missing` string[]: Unavailable duration: missing start and/or end. - `ongoing` boolean: No patch recorded: the endpoint is the calculation clock, not proof of an unpatched system. - `order_known` boolean: False when date-only precision does not establish which endpoint came first. - `seconds` number: Nominal elapsed seconds (a bare date read as midnight UTC); signed except for time_unpatched, which is clamped at zero. - `start` TimelineEvent - `added_in_revision` boolean: A disclosure date taken from the revision that added this vulnerability to an advisory about several, which replaces the advisory's initial release date. - `batch_listing` boolean: KEV exploitation inputs: dated on a day the catalog listed a batch of vulnerabilities (a backlog, not new activity). - `content` string: Sightings: their content, when any. - `date_only` boolean: The source gave a day without a time. - `field` string: The date's path within that record. - `kind` 'milestone' | 'sighting' | 'kev' | 'other' - `label` string - `linked_record` boolean: The date comes from a related record (a CSAF advisory, a national database entry...), not from the vulnerability's own record. - `metric_basis` string: Optional evidence basis: recorded_event, kev_first_seen, kev_report or sighting_report. - `metric_role` string: Optional calculation input: discovery, report, acknowledgement, disclosure, exploit_publication, exploitation, exploitation_report, patch or patch_observed. - `publication_copy` boolean: KEV dates: the vulnerability's publication instant copied into the entry, not a listing date; shown, but not a calculation input. - `record` string: The record holding the date. - `source` string: Where the date comes from. - `status` object: KEV entries: {status_reason, exploited}. - `timestamp` string: RFC 3339, UTC, millisecond precision. - `url` string: Sightings: their source, when it is an HTTP(S) URL. - `uuid` string: Sightings and KEV entries: their UUID. - `value` string: The date as the source wrote it. - `time_to_exploit` TimelineDuration - `approximate` boolean: At least one endpoint has day precision: a bare date, or a timestamp at exactly midnight UTC. - `available` boolean: False when a required endpoint has no dated evidence. - `batch_listing` boolean: An endpoint is a KEV batch listing: the exploitation began earlier than that date. - `days` number: Elapsed seconds / 86400, without rounding. - `discovery_after_disclosure` boolean: total_time_to_patch: the discovery date is certainly later than public disclosure, so it most likely records when a publisher learned of the vulnerability. - `end` TimelineEvent - `added_in_revision` boolean: A disclosure date taken from the revision that added this vulnerability to an advisory about several, which replaces the advisory's initial release date. - `batch_listing` boolean: KEV exploitation inputs: dated on a day the catalog listed a batch of vulnerabilities (a backlog, not new activity). - `content` string: Sightings: their content, when any. - `date_only` boolean: The source gave a day without a time. - `field` string: The date's path within that record. - `kind` 'milestone' | 'sighting' | 'kev' | 'other' - `label` string - `linked_record` boolean: The date comes from a related record (a CSAF advisory, a national database entry...), not from the vulnerability's own record. - `metric_basis` string: Optional evidence basis: recorded_event, kev_first_seen, kev_report or sighting_report. - `metric_role` string: Optional calculation input: discovery, report, acknowledgement, disclosure, exploit_publication, exploitation, exploitation_report, patch or patch_observed. - `publication_copy` boolean: KEV dates: the vulnerability's publication instant copied into the entry, not a listing date; shown, but not a calculation input. - `record` string: The record holding the date. - `source` string: Where the date comes from. - `status` object: KEV entries: {status_reason, exploited}. - `timestamp` string: RFC 3339, UTC, millisecond precision. - `url` string: Sightings: their source, when it is an HTTP(S) URL. - `uuid` string: Sightings and KEV entries: their UUID. - `value` string: The date as the source wrote it. - `end_before_start` boolean: The end event certainly preceded the start event; false when the order is unknown. - `hours` number: Elapsed seconds / 3600, without rounding. - `max_seconds` number: Largest interval the endpoints' precision allows (a bare date spans its whole UTC day). - `min_seconds` number: Smallest interval the endpoints' precision allows; equals seconds when both are exact. - `missing` string[]: Unavailable duration: missing start and/or end. - `ongoing` boolean: No patch recorded: the endpoint is the calculation clock, not proof of an unpatched system. - `order_known` boolean: False when date-only precision does not establish which endpoint came first. - `seconds` number: Nominal elapsed seconds (a bare date read as midnight UTC); signed except for time_unpatched, which is clamped at zero. - `start` TimelineEvent - `added_in_revision` boolean: A disclosure date taken from the revision that added this vulnerability to an advisory about several, which replaces the advisory's initial release date. - `batch_listing` boolean: KEV exploitation inputs: dated on a day the catalog listed a batch of vulnerabilities (a backlog, not new activity). - `content` string: Sightings: their content, when any. - `date_only` boolean: The source gave a day without a time. - `field` string: The date's path within that record. - `kind` 'milestone' | 'sighting' | 'kev' | 'other' - `label` string - `linked_record` boolean: The date comes from a related record (a CSAF advisory, a national database entry...), not from the vulnerability's own record. - `metric_basis` string: Optional evidence basis: recorded_event, kev_first_seen, kev_report or sighting_report. - `metric_role` string: Optional calculation input: discovery, report, acknowledgement, disclosure, exploit_publication, exploitation, exploitation_report, patch or patch_observed. - `publication_copy` boolean: KEV dates: the vulnerability's publication instant copied into the entry, not a listing date; shown, but not a calculation input. - `record` string: The record holding the date. - `source` string: Where the date comes from. - `status` object: KEV entries: {status_reason, exploited}. - `timestamp` string: RFC 3339, UTC, millisecond precision. - `url` string: Sightings: their source, when it is an HTTP(S) URL. - `uuid` string: Sightings and KEV entries: their UUID. - `value` string: The date as the source wrote it. - `time_to_patch` TimelineDuration - `approximate` boolean: At least one endpoint has day precision: a bare date, or a timestamp at exactly midnight UTC. - `available` boolean: False when a required endpoint has no dated evidence. - `batch_listing` boolean: An endpoint is a KEV batch listing: the exploitation began earlier than that date. - `days` number: Elapsed seconds / 86400, without rounding. - `discovery_after_disclosure` boolean: total_time_to_patch: the discovery date is certainly later than public disclosure, so it most likely records when a publisher learned of the vulnerability. - `end` TimelineEvent - `added_in_revision` boolean: A disclosure date taken from the revision that added this vulnerability to an advisory about several, which replaces the advisory's initial release date. - `batch_listing` boolean: KEV exploitation inputs: dated on a day the catalog listed a batch of vulnerabilities (a backlog, not new activity). - `content` string: Sightings: their content, when any. - `date_only` boolean: The source gave a day without a time. - `field` string: The date's path within that record. - `kind` 'milestone' | 'sighting' | 'kev' | 'other' - `label` string - `linked_record` boolean: The date comes from a related record (a CSAF advisory, a national database entry...), not from the vulnerability's own record. - `metric_basis` string: Optional evidence basis: recorded_event, kev_first_seen, kev_report or sighting_report. - `metric_role` string: Optional calculation input: discovery, report, acknowledgement, disclosure, exploit_publication, exploitation, exploitation_report, patch or patch_observed. - `publication_copy` boolean: KEV dates: the vulnerability's publication instant copied into the entry, not a listing date; shown, but not a calculation input. - `record` string: The record holding the date. - `source` string: Where the date comes from. - `status` object: KEV entries: {status_reason, exploited}. - `timestamp` string: RFC 3339, UTC, millisecond precision. - `url` string: Sightings: their source, when it is an HTTP(S) URL. - `uuid` string: Sightings and KEV entries: their UUID. - `value` string: The date as the source wrote it. - `end_before_start` boolean: The end event certainly preceded the start event; false when the order is unknown. - `hours` number: Elapsed seconds / 3600, without rounding. - `max_seconds` number: Largest interval the endpoints' precision allows (a bare date spans its whole UTC day). - `min_seconds` number: Smallest interval the endpoints' precision allows; equals seconds when both are exact. - `missing` string[]: Unavailable duration: missing start and/or end. - `ongoing` boolean: No patch recorded: the endpoint is the calculation clock, not proof of an unpatched system. - `order_known` boolean: False when date-only precision does not establish which endpoint came first. - `seconds` number: Nominal elapsed seconds (a bare date read as midnight UTC); signed except for time_unpatched, which is clamped at zero. - `start` TimelineEvent - `added_in_revision` boolean: A disclosure date taken from the revision that added this vulnerability to an advisory about several, which replaces the advisory's initial release date. - `batch_listing` boolean: KEV exploitation inputs: dated on a day the catalog listed a batch of vulnerabilities (a backlog, not new activity). - `content` string: Sightings: their content, when any. - `date_only` boolean: The source gave a day without a time. - `field` string: The date's path within that record. - `kind` 'milestone' | 'sighting' | 'kev' | 'other' - `label` string - `linked_record` boolean: The date comes from a related record (a CSAF advisory, a national database entry...), not from the vulnerability's own record. - `metric_basis` string: Optional evidence basis: recorded_event, kev_first_seen, kev_report or sighting_report. - `metric_role` string: Optional calculation input: discovery, report, acknowledgement, disclosure, exploit_publication, exploitation, exploitation_report, patch or patch_observed. - `publication_copy` boolean: KEV dates: the vulnerability's publication instant copied into the entry, not a listing date; shown, but not a calculation input. - `record` string: The record holding the date. - `source` string: Where the date comes from. - `status` object: KEV entries: {status_reason, exploited}. - `timestamp` string: RFC 3339, UTC, millisecond precision. - `url` string: Sightings: their source, when it is an HTTP(S) URL. - `uuid` string: Sightings and KEV entries: their UUID. - `value` string: The date as the source wrote it. - `time_unpatched` TimelineDuration - `approximate` boolean: At least one endpoint has day precision: a bare date, or a timestamp at exactly midnight UTC. - `available` boolean: False when a required endpoint has no dated evidence. - `batch_listing` boolean: An endpoint is a KEV batch listing: the exploitation began earlier than that date. - `days` number: Elapsed seconds / 86400, without rounding. - `discovery_after_disclosure` boolean: total_time_to_patch: the discovery date is certainly later than public disclosure, so it most likely records when a publisher learned of the vulnerability. - `end` TimelineEvent - `added_in_revision` boolean: A disclosure date taken from the revision that added this vulnerability to an advisory about several, which replaces the advisory's initial release date. - `batch_listing` boolean: KEV exploitation inputs: dated on a day the catalog listed a batch of vulnerabilities (a backlog, not new activity). - `content` string: Sightings: their content, when any. - `date_only` boolean: The source gave a day without a time. - `field` string: The date's path within that record. - `kind` 'milestone' | 'sighting' | 'kev' | 'other' - `label` string - `linked_record` boolean: The date comes from a related record (a CSAF advisory, a national database entry...), not from the vulnerability's own record. - `metric_basis` string: Optional evidence basis: recorded_event, kev_first_seen, kev_report or sighting_report. - `metric_role` string: Optional calculation input: discovery, report, acknowledgement, disclosure, exploit_publication, exploitation, exploitation_report, patch or patch_observed. - `publication_copy` boolean: KEV dates: the vulnerability's publication instant copied into the entry, not a listing date; shown, but not a calculation input. - `record` string: The record holding the date. - `source` string: Where the date comes from. - `status` object: KEV entries: {status_reason, exploited}. - `timestamp` string: RFC 3339, UTC, millisecond precision. - `url` string: Sightings: their source, when it is an HTTP(S) URL. - `uuid` string: Sightings and KEV entries: their UUID. - `value` string: The date as the source wrote it. - `end_before_start` boolean: The end event certainly preceded the start event; false when the order is unknown. - `hours` number: Elapsed seconds / 3600, without rounding. - `max_seconds` number: Largest interval the endpoints' precision allows (a bare date spans its whole UTC day). - `min_seconds` number: Smallest interval the endpoints' precision allows; equals seconds when both are exact. - `missing` string[]: Unavailable duration: missing start and/or end. - `ongoing` boolean: No patch recorded: the endpoint is the calculation clock, not proof of an unpatched system. - `order_known` boolean: False when date-only precision does not establish which endpoint came first. - `seconds` number: Nominal elapsed seconds (a bare date read as midnight UTC); signed except for time_unpatched, which is clamped at zero. - `start` TimelineEvent - `added_in_revision` boolean: A disclosure date taken from the revision that added this vulnerability to an advisory about several, which replaces the advisory's initial release date. - `batch_listing` boolean: KEV exploitation inputs: dated on a day the catalog listed a batch of vulnerabilities (a backlog, not new activity). - `content` string: Sightings: their content, when any. - `date_only` boolean: The source gave a day without a time. - `field` string: The date's path within that record. - `kind` 'milestone' | 'sighting' | 'kev' | 'other' - `label` string - `linked_record` boolean: The date comes from a related record (a CSAF advisory, a national database entry...), not from the vulnerability's own record. - `metric_basis` string: Optional evidence basis: recorded_event, kev_first_seen, kev_report or sighting_report. - `metric_role` string: Optional calculation input: discovery, report, acknowledgement, disclosure, exploit_publication, exploitation, exploitation_report, patch or patch_observed. - `publication_copy` boolean: KEV dates: the vulnerability's publication instant copied into the entry, not a listing date; shown, but not a calculation input. - `record` string: The record holding the date. - `source` string: Where the date comes from. - `status` object: KEV entries: {status_reason, exploited}. - `timestamp` string: RFC 3339, UTC, millisecond precision. - `url` string: Sightings: their source, when it is an HTTP(S) URL. - `uuid` string: Sightings and KEV entries: their UUID. - `value` string: The date as the source wrote it. - `total_time_to_patch` TimelineDuration - `approximate` boolean: At least one endpoint has day precision: a bare date, or a timestamp at exactly midnight UTC. - `available` boolean: False when a required endpoint has no dated evidence. - `batch_listing` boolean: An endpoint is a KEV batch listing: the exploitation began earlier than that date. - `days` number: Elapsed seconds / 86400, without rounding. - `discovery_after_disclosure` boolean: total_time_to_patch: the discovery date is certainly later than public disclosure, so it most likely records when a publisher learned of the vulnerability. - `end` TimelineEvent - `added_in_revision` boolean: A disclosure date taken from the revision that added this vulnerability to an advisory about several, which replaces the advisory's initial release date. - `batch_listing` boolean: KEV exploitation inputs: dated on a day the catalog listed a batch of vulnerabilities (a backlog, not new activity). - `content` string: Sightings: their content, when any. - `date_only` boolean: The source gave a day without a time. - `field` string: The date's path within that record. - `kind` 'milestone' | 'sighting' | 'kev' | 'other' - `label` string - `linked_record` boolean: The date comes from a related record (a CSAF advisory, a national database entry...), not from the vulnerability's own record. - `metric_basis` string: Optional evidence basis: recorded_event, kev_first_seen, kev_report or sighting_report. - `metric_role` string: Optional calculation input: discovery, report, acknowledgement, disclosure, exploit_publication, exploitation, exploitation_report, patch or patch_observed. - `publication_copy` boolean: KEV dates: the vulnerability's publication instant copied into the entry, not a listing date; shown, but not a calculation input. - `record` string: The record holding the date. - `source` string: Where the date comes from. - `status` object: KEV entries: {status_reason, exploited}. - `timestamp` string: RFC 3339, UTC, millisecond precision. - `url` string: Sightings: their source, when it is an HTTP(S) URL. - `uuid` string: Sightings and KEV entries: their UUID. - `value` string: The date as the source wrote it. - `end_before_start` boolean: The end event certainly preceded the start event; false when the order is unknown. - `hours` number: Elapsed seconds / 3600, without rounding. - `max_seconds` number: Largest interval the endpoints' precision allows (a bare date spans its whole UTC day). - `min_seconds` number: Smallest interval the endpoints' precision allows; equals seconds when both are exact. - `missing` string[]: Unavailable duration: missing start and/or end. - `ongoing` boolean: No patch recorded: the endpoint is the calculation clock, not proof of an unpatched system. - `order_known` boolean: False when date-only precision does not establish which endpoint came first. - `seconds` number: Nominal elapsed seconds (a bare date read as midnight UTC); signed except for time_unpatched, which is clamped at zero. - `start` TimelineEvent - `added_in_revision` boolean: A disclosure date taken from the revision that added this vulnerability to an advisory about several, which replaces the advisory's initial release date. - `batch_listing` boolean: KEV exploitation inputs: dated on a day the catalog listed a batch of vulnerabilities (a backlog, not new activity). - `content` string: Sightings: their content, when any. - `date_only` boolean: The source gave a day without a time. - `field` string: The date's path within that record. - `kind` 'milestone' | 'sighting' | 'kev' | 'other' - `label` string - `linked_record` boolean: The date comes from a related record (a CSAF advisory, a national database entry...), not from the vulnerability's own record. - `metric_basis` string: Optional evidence basis: recorded_event, kev_first_seen, kev_report or sighting_report. - `metric_role` string: Optional calculation input: discovery, report, acknowledgement, disclosure, exploit_publication, exploitation, exploitation_report, patch or patch_observed. - `publication_copy` boolean: KEV dates: the vulnerability's publication instant copied into the entry, not a listing date; shown, but not a calculation input. - `record` string: The record holding the date. - `source` string: Where the date comes from. - `status` object: KEV entries: {status_reason, exploited}. - `timestamp` string: RFC 3339, UTC, millisecond precision. - `url` string: Sightings: their source, when it is an HTTP(S) URL. - `uuid` string: Sightings and KEV entries: their UUID. - `value` string: The date as the source wrote it. - `vendor_response_time` TimelineDuration - `approximate` boolean: At least one endpoint has day precision: a bare date, or a timestamp at exactly midnight UTC. - `available` boolean: False when a required endpoint has no dated evidence. - `batch_listing` boolean: An endpoint is a KEV batch listing: the exploitation began earlier than that date. - `days` number: Elapsed seconds / 86400, without rounding. - `discovery_after_disclosure` boolean: total_time_to_patch: the discovery date is certainly later than public disclosure, so it most likely records when a publisher learned of the vulnerability. - `end` TimelineEvent - `added_in_revision` boolean: A disclosure date taken from the revision that added this vulnerability to an advisory about several, which replaces the advisory's initial release date. - `batch_listing` boolean: KEV exploitation inputs: dated on a day the catalog listed a batch of vulnerabilities (a backlog, not new activity). - `content` string: Sightings: their content, when any. - `date_only` boolean: The source gave a day without a time. - `field` string: The date's path within that record. - `kind` 'milestone' | 'sighting' | 'kev' | 'other' - `label` string - `linked_record` boolean: The date comes from a related record (a CSAF advisory, a national database entry...), not from the vulnerability's own record. - `metric_basis` string: Optional evidence basis: recorded_event, kev_first_seen, kev_report or sighting_report. - `metric_role` string: Optional calculation input: discovery, report, acknowledgement, disclosure, exploit_publication, exploitation, exploitation_report, patch or patch_observed. - `publication_copy` boolean: KEV dates: the vulnerability's publication instant copied into the entry, not a listing date; shown, but not a calculation input. - `record` string: The record holding the date. - `source` string: Where the date comes from. - `status` object: KEV entries: {status_reason, exploited}. - `timestamp` string: RFC 3339, UTC, millisecond precision. - `url` string: Sightings: their source, when it is an HTTP(S) URL. - `uuid` string: Sightings and KEV entries: their UUID. - `value` string: The date as the source wrote it. - `end_before_start` boolean: The end event certainly preceded the start event; false when the order is unknown. - `hours` number: Elapsed seconds / 3600, without rounding. - `max_seconds` number: Largest interval the endpoints' precision allows (a bare date spans its whole UTC day). - `min_seconds` number: Smallest interval the endpoints' precision allows; equals seconds when both are exact. - `missing` string[]: Unavailable duration: missing start and/or end. - `ongoing` boolean: No patch recorded: the endpoint is the calculation clock, not proof of an unpatched system. - `order_known` boolean: False when date-only precision does not establish which endpoint came first. - `seconds` number: Nominal elapsed seconds (a bare date read as midnight UTC); signed except for time_unpatched, which is clamped at zero. - `start` TimelineEvent - `added_in_revision` boolean: A disclosure date taken from the revision that added this vulnerability to an advisory about several, which replaces the advisory's initial release date. - `batch_listing` boolean: KEV exploitation inputs: dated on a day the catalog listed a batch of vulnerabilities (a backlog, not new activity). - `content` string: Sightings: their content, when any. - `date_only` boolean: The source gave a day without a time. - `field` string: The date's path within that record. - `kind` 'milestone' | 'sighting' | 'kev' | 'other' - `label` string - `linked_record` boolean: The date comes from a related record (a CSAF advisory, a national database entry...), not from the vulnerability's own record. - `metric_basis` string: Optional evidence basis: recorded_event, kev_first_seen, kev_report or sighting_report. - `metric_role` string: Optional calculation input: discovery, report, acknowledgement, disclosure, exploit_publication, exploitation, exploitation_report, patch or patch_observed. - `publication_copy` boolean: KEV dates: the vulnerability's publication instant copied into the entry, not a listing date; shown, but not a calculation input. - `record` string: The record holding the date. - `source` string: Where the date comes from. - `status` object: KEV entries: {status_reason, exploited}. - `timestamp` string: RFC 3339, UTC, millisecond precision. - `url` string: Sightings: their source, when it is an HTTP(S) URL. - `uuid` string: Sightings and KEV entries: their UUID. - `value` string: The date as the source wrote it. ## Changes - **2026-10-12** `f85f8413d67b`: 1 info - endpoint added [Operation history](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api/changes/vulnerability/:vulnerability_id/timeline/get.md) --- [API](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api.md) - [All operations](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api/llms.txt) - [OpenAPI document](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api/revisions/b4dedf027493?raw)