apipick
[ search · endpoint ]Search API · Cybersecurity

Cybersecurity & Vulnerability Search API

Query NVD CVE records, CISA Known Exploited Vulnerabilities, EPSS exploit-probability scores, and MITRE ATT&CK techniques from one endpoint. Pre-shaped JSON for AI-driven vulnerability triage, threat intelligence, and security operations.

●10 credits / call●60 req / minPOST /api/search/cybersecurity
[ 01 · live ]

Try Cybersecurity Search Live

Enter your API key and run a real query against the live endpoint.

auth · x-api-key

Don't have an API key?

Sign in to your account to create and manage your API keys.

Sign InManage API Keys
5 sample queries — click to load
[ 02 · integrate ]

Integration guide

Copy a snippet, replace your API key, run. Works in any HTTP client — examples below in cURL, JavaScript, and Python.

spec
POST/api/search/cybersecurity
base
https://www.apipick.com

Semantic search across NVD CVEs, CISA KEV, EPSS scores, and MITRE ATT&CK. Returns ranked passages with source URLs ready for downstream LLMs.

parameters
querystringrequired

Natural-language search query

max_num_resultsintegeroptional

1–5, default 5

relevance_thresholdnumberoptional

0.0–1.0 quality filter

country_codestringoptional

ISO country code (e.g. US, GB)

start_datestringoptional

ISO date YYYY-MM-DD

end_datestringoptional

ISO date YYYY-MM-DD

curl -X POST "https://www.apipick.com/api/search/cybersecurity" \
  -H "Content-Type: application/json" \
  -H "x-api-key: YOUR_API_KEY" \
  -d '{
  "query": "Actively exploited vulnerabilities in Apache Struts",
  "max_num_results": 5,
  "country_code": "US",
  "start_date": "2026-01-01"
}'
● 200 · response
{
  "query": "Actively exploited vulnerabilities in Apache Struts",
  "results": [
    {
      "title": "Example result",
      "url": "https://example.com/article",
      "snippet": "Short excerpt of the page content…",
      "source_type": "web",
      "published_at": "2026-04-15",
      "score": 0.92
    }
  ],
  "result_count": 1,
  "credits_used": 10,
  "remaining_credits": 99
}
[ 03 · limits ]

Rate limits

Throttling is per API key, sliding 60-second window. Hit the limit and you get a clean 429 with a Retry-After header.

request rate

60req/min

Per API key, per endpoint. Sliding 60-second window.

concurrency

3concurrent

Max simultaneous in-flight requests per API key.

response headers
X-RateLimit-LimitMaximum requests allowed per minute
X-RateLimit-RemainingRequests remaining in the current window
X-RateLimit-ResetSeconds until the current window resets
Retry-AfterSeconds to wait before retrying (only on 429)
● 429 · too many requests
HTTP/1.1 429 Too Many Requests
Retry-After: 12
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 12

{
  "error": "rate_limit_exceeded",
  "message": "Rate limit exceeded: 60 requests/minute per API key. Retry after 12s.",
  "retry_after": 12
}
[ faq ]

Frequently Asked Questions

01

Why is this only 10 credits per call?

These four sources — NVD CVE, CISA KEV, EPSS, and MITRE ATT&CK — are public, low-cost datasets, so the endpoint is priced at 10 credits (≈ $0.01 per call). It is the cheapest of our specialized search endpoints.

02

Which sources are covered?

NVD CVE records (with CVSS severity), CISA Known Exploited Vulnerabilities, EPSS exploit-probability scores, and MITRE ATT&CK tactics and techniques. All four are queried in parallel.

03

Can I look up a specific CVE?

Yes. Pass a CVE ID (e.g. CVE-2024-3094) or a natural-language query like 'actively exploited Apache vulnerabilities' and the endpoint ranks the most relevant records.

04

Date filtering?

Yes. Pass start_date and end_date in YYYY-MM-DD to scope to a publication or KEV-addition window.

05

Tool schema for OpenAI / Claude?

GET /api/search/cybersecurity/tool-schema returns ready-to-paste OpenAI function and Claude tool-use definitions.