---
name: 1stauthor-cve
description: The 1stAuthor cve domain.
---

# 1stAuthor CVE

384k public vulnerabilities (NVD) plus CISA KEV exploited-in-the-wild flags and FIRST EPSS exploitation probability. Vulnerability class (closed set of 17), attacker prerequisites, affected scope, impact and one-line summaries are model-extracted. No vectors: structured filters plus bilingual full-text search in Postgres.

Base URL `https://api.1stauthor.com`. Every call takes `Authorization: Bearer $FA_API_KEY`; the free samples named below work without a key. Free sample id: `CVE-2024-3400`, free sample query: `log4j`.

## Three verbs, every domain

```
POST /v1/{domain}/search  {query, filters?, top_k?}      → hits[].id + a card each
GET  /v1/{domain}/read/{id}?level=brief|detail|full      → read as deep as you need
POST /v1/{domain}/ask     {query, effort: low|medium|high} → an answer with real citations
```

`read` also takes `extra=<side>` for another side of the same document and `format=json|md|html`.
At `level=full`, `section=<name>` reads one section and `characters=N` the first N characters.

## Start here

- **Vulnerabilities in a product** — `POST /v1/cve/search {"query": "palo alto globalprotect rce"}`
- **Exploited in the wild, ranked by EPSS** — `POST /v1/cve/search {"query": "", "filters": {"kev": true, "severity": ["critical","high"]}, "sort": "epss"}`
- **Read one** — `GET /v1/cve/read/CVE-2024-3400`

## Search filters

| field | type | meaning |
|---|---|---|
| `cvss_score` | number · range | CVSS score, range |
| `epss` | number · range | EPSS 30-day exploitation probability (0–1), range |
| `kev` | bool · eq | Listed in CISA KEV (known exploited in the wild) |
| `published` | datetime · range | Publication date range |
| `severity` | keyword · eq any | CVSS severity (derived from the score) |
| `vuln_class` | keyword · eq any | Vulnerability class (closed set of 17, model-assigned) |

Rarely needed, but valid: `affected`, `cwe`, `kev_added`.

Filters combine with AND; `_or` / `_not` are available. Ranges are `{"gte": n}` / `{"lte": n}`, full text is `{"text": "…"}`.

## Read

| level | credits | returns |
|---|---|---|
| `brief` | 1 | Card: affected, cvss_score, doc_id, epss, kev, one_liner, one_liner_zh, published… |
| `detail` (default) | 2 | Every structured field (card plus the source abstract and detail fields) |

## Ask

`POST /v1/cve/ask {query, effort}` — Agentic Q&A over this domain: with no vector layer, the model turns the question into structured filters plus bilingual full-text search, reads the hits and answers with [cve:<doc_id> <title>] citations; /stream is NDJSON with real token deltas. Costs 50 / 100 / 200 credits by effort. Append `/stream` for NDJSON; the first event is always `billing`.

`sources` is the retrieval set, not the citation list — filter it by the ids that appear in `answer`. `answer_truncated` means the answer is incomplete; say so.

## Also here



## Facets

`GET /v1/cve/facets?field=<field>` lists the legal values for `severity`, `vuln_class` — free, no key. Use it instead of guessing a spelling.

## Working rules

- **Search first, read second.** A search hit is a card; decide from the card which ids deserve a read.
- **Read in layers.** `detail` answers most questions; go to `full` only when the answer is not in it.
- **Filters are declared.** An undeclared filter field is a 400, never a silent no-op. `GET /v1/{domain}` lists what exists.
- **Cite what you read.** Use the citation format below, and say plainly when the corpus has nothing.
- **Failures are not charged.** A 404 costs nothing; an upstream error is refunded. Quote `meta.request_id` when reporting one.

Citation format: `[CVE-2024-3400]`.

## What this corpus will and will not tell you

- NVD data is used under its terms: any display must carry the not-endorsed notice (see the attribution field).
- kev=true means CISA confirmed exploitation in the wild; epss is FIRST's probability estimate — different things.
- severity is derived from cvss_score; the 3,347 CVEs without a score have neither.
- Rank by exploitation risk with sort=epss, by time with sort=date.
- vuln_class / attacker_needs / impact / one_liner* are model-written — fine as a summary, not as a quote; the original text is description, in level=detail.
- Model-written fields (summarise, do not quote): affected, attacker_needs, impact, one_liner, one_liner_zh, vuln_class.
- The field table and enumerations are generated from the store's own self-description (search.field), not hand-written; enumeration counts are as of 2026-10-13.

---

Generated from https://api.1stauthor.com/v1/cve on 2026-10-14. Full reference: https://1stauthor.com/docs/cve/