API Reference · Your Data

CVE Exposure

"Am I exposed to this CVE?" as one self-contained resource. A new KEV entry lands, you ask this once, and the answer combines everything the platform knows: confirmed findings on your scanned attack surface, your watchlist and triage state, best-effort asset matches, the public severity picture, and whether the CVE is being exploited in the wild right now.

This is the SOAR-shaped endpoint: one call per CVE, one field to branch on.

GET

/v1/my/exposure/{cve_id}

Cost: 1 credit per successful call · Scope: api:org

Path parameters

cve_idstringrequired

A CVE identifier (CVE-YYYY-NNNNN). Case-insensitive; normalised server-side.

Request

curl "https://api.edgeprotect.io/functions/v1/my/exposure/CVE-2026-21762" \
  -H "Authorization: Bearer $EDGEPROTECT_API_KEY"

Response

{
  "data": {
    "cve_id": "CVE-2026-21762",
    "exposure": "confirmed",
    "public_summary": {
      "id": "CVE-2026-21762",
      "severity": { "cvss_score": 9.8, "cvss_level": "CRITICAL" },
      "epss": { "score": 0.94321, "percentile": 0.99912 },
      "cisa_kev": { "listed": true }
    },
    "my_findings": {
      "count": 1,
      "instances": 2,
      "items": [
        {
          "id": "3f0a1c9e-8f2b-4a67-9c31-5d7e2b8a4f10",
          "title": "FortiOS out-of-bounds write (SSL-VPN)",
          "severity": "critical",
          "cvss": null,
          "kev": false,
          "status": "open",
          "scan_id": "f63285e2-9c78-4020-b2bb-5c8bd2ca51ed"
        }
      ]
    },
    "my_watchlist": {
      "in_relevant_cves": true,
      "in_alerts": true,
      "triage_hits": 1
    },
    "matching_assets": {
      "confidence": "best_effort",
      "basis": "shadowserver_vendor_to_discovered_cpe",
      "count": 1,
      "items": [
        {
          "vendor": "fortinet",
          "product": "fortios",
          "version": "7.4.2",
          "cpe": "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*"
        }
      ]
    },
    "exploitation_recent": {
      "window_days": 30,
      "last_observed": "2026-08-17",
      "connections": 18244,
      "cisa_kev": true
    },
    "generated_at": "2026-08-19T09:30:00+00:00"
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "api_version": "1.3.0",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.exposurestringoptional

The one field to branch on: confirmed (a scan found this CVE on your attack surface), inferred (no finding, but your discovered software matches the CVE's affected vendors), or none (neither, which includes "unknown", see the callout below).

data.public_summaryobjectoptional

The public severity picture: CVSS score and level, EPSS score and percentile, CISA KEV listing.

data.my_findingsobjectoptional

Confirmed EdgeProtect findings for this CVE across the latest scan of each of your targets, with the total instance count.

data.my_watchlistobjectoptional

Whether the CVE appears in your relevant CVEs, your alert feed, and how many triage findings reference it.

data.exploitation_recentobjectoptional

Shadowserver honeypot activity for this CVE over the last 30 days: last observation date, connection count, and whether any observation was KEV-flagged.

matching_assets is inference, not fact

The asset match derives the CVE's affected vendors from Shadowserver honeypot observations, then matches them against vendors parsed from your discovered CPE strings, and it labels itself confidence: "best_effort". An empty items array means unknown, not not affected: a CVE with no Shadowserver linkage can never produce a match. Branch on exposure, and treat inferred as a prompt to investigate, never as a verdict.

Errors

Status	`error`	When
400	`invalid_cve_id`	The path segment is not a valid CVE identifier. Free: rejected before billing.
401	`invalid_authorization`	Missing or malformed `Authorization` header.
401	`unauthorized`	Invalid/revoked key, IP not allowlisted, or the key lacks the `api:org` scope.
402	`insufficient_credits`	Organisation credit balance is below 1.
405	`method_not_allowed`	Only `GET` and `OPTIONS` are accepted.
500	`internal`	Unexpected server error (credit auto-refunded).

See Errors for the full error reference.