curl -X POST https://win.oneshotagent.com/v1/tools/lookup/record-vulnerability \
-H "Content-Type: application/json" \
-H "payment-signature: <base64 x402 payment>" \
-d '{
"cve_id": "CVE-2021-44228"
}'
const response = await fetch("https://win.oneshotagent.com/v1/tools/lookup/record-vulnerability", {
method: "POST",
headers: {
"Content-Type": "application/json",
"payment-signature": paymentProof,
},
body: JSON.stringify({
"cve_id": "CVE-2021-44228"
}),
});
const result = await agent.tool('lookup/record-vulnerability', {
cve_id: 'CVE-2021-44228'
});
console.log(result.data.result);
console.log(result.data.evidence);
{
"success": true,
"data": {
"request_id": "uuid",
"receipt_id": "rcpt_...",
"status": "completed",
"tool": "record_vulnerability",
"result": {
"total": 1,
"vulnerabilities": [
{
"id": "CVE-2021-44228",
"description": "Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints.",
"published_at": "2021-12-10T10:15:09.143Z",
"last_modified_at": "2026-08-11T19:33:44.513Z",
"status": "Analyzed",
"severity": {
"version": "3.1",
"score": 10,
"rating": "CRITICAL",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
},
"weaknesses": [
"CWE-20",
"CWE-400",
"CWE-502",
"CWE-917"
],
"known_exploited": {
"added_on": "2021-12-10",
"action_due": "2021-12-24",
"required_action": "Apply updates, or remove affected assets from agency networks.",
"name": "Apache Log4j2 Remote Code Execution Vulnerability"
},
"references": [
{
"url": "https://example.com/advisory",
"tags": [
"Vendor Advisory"
]
}
],
"references_total": 103,
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
}
]
},
"evidence": {
"source": "US National Institute of Standards and Technology",
"source_kind": "public",
"retrieved_at": "2026-10-13T12:00:00.000Z",
"as_of": "2026-10-13T11:58:00.000Z"
}
}
}
Lookups
Vulnerability
Look up the published record of a software vulnerability by its CVE identifier.
POST
/
v1
/
tools
/
lookup
/
record-vulnerability
curl -X POST https://win.oneshotagent.com/v1/tools/lookup/record-vulnerability \
-H "Content-Type: application/json" \
-H "payment-signature: <base64 x402 payment>" \
-d '{
"cve_id": "CVE-2021-44228"
}'
const response = await fetch("https://win.oneshotagent.com/v1/tools/lookup/record-vulnerability", {
method: "POST",
headers: {
"Content-Type": "application/json",
"payment-signature": paymentProof,
},
body: JSON.stringify({
"cve_id": "CVE-2021-44228"
}),
});
const result = await agent.tool('lookup/record-vulnerability', {
cve_id: 'CVE-2021-44228'
});
console.log(result.data.result);
console.log(result.data.evidence);
{
"success": true,
"data": {
"request_id": "uuid",
"receipt_id": "rcpt_...",
"status": "completed",
"tool": "record_vulnerability",
"result": {
"total": 1,
"vulnerabilities": [
{
"id": "CVE-2021-44228",
"description": "Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints.",
"published_at": "2021-12-10T10:15:09.143Z",
"last_modified_at": "2026-08-11T19:33:44.513Z",
"status": "Analyzed",
"severity": {
"version": "3.1",
"score": 10,
"rating": "CRITICAL",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
},
"weaknesses": [
"CWE-20",
"CWE-400",
"CWE-502",
"CWE-917"
],
"known_exploited": {
"added_on": "2021-12-10",
"action_due": "2021-12-24",
"required_action": "Apply updates, or remove affected assets from agency networks.",
"name": "Apache Log4j2 Remote Code Execution Vulnerability"
},
"references": [
{
"url": "https://example.com/advisory",
"tags": [
"Vendor Advisory"
]
}
],
"references_total": 103,
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
}
]
},
"evidence": {
"source": "US National Institute of Standards and Technology",
"source_kind": "public",
"retrieved_at": "2026-10-13T12:00:00.000Z",
"as_of": "2026-10-13T11:58:00.000Z"
}
}
}
Look up a software vulnerability by its CVE identifier in the US National Vulnerability Database. The record gives a description in English, when it was published and last modified, its analysis status, its severity (the newest CVSS version that has a primary score, with the score, the rating word and the vector), the weakness types, whether it is on the US list of known exploited vulnerabilities (with the date added, the date action is due and the required action), the first 10 references with their tags and a link to the record. The lists of affected product versions are not returned. A record is what the database publishes, not a measure of the risk to any one system.
total is 1, or 0 when the database has no such identifier. Times are UTC. This product uses the NVD API but is not endorsed or certified by the NVD.
Authentication
Requires x402 payment in thepayment-signature header.
Request Body
string
required
The CVE identifier, for example CVE-2021-44228. Lower case is accepted. A CVE identifier is CVE-, a four-digit year, a dash and four or more digits.
Response (200 OK)
Top-level envelope:success (boolean) and data (object). All fields below are nested under data.
string
Durable job ID for audit and lookup
string
Job status:
completedstring
Always
record_vulnerabilityobject
The answer, described under Result below
object
Where the answer came from and when
string
The public body the data comes from. Always
US National Institute of Standards and Technology.string
public when the data comes from a public body, commercial otherwisestring
When the lookup was made, as an ISO 8601 UTC time
string
When the source says the fact was last updated, or
null when the source gives no dateResult
Nested underdata.result.
number
1 when the database has the record, 0 when it has none.
object[]
The record, or an empty list when the database has none.
string
The CVE identifier, in upper case.
string
The description in English.
null when the source gives no value.string
When the record was published, ISO 8601 UTC.
null when the source gives no value.string
When the record was last modified, ISO 8601 UTC.
null when the source gives no value.string
Where the record stands in analysis, for example Analyzed.
null when the source gives no value.object
The primary score of the newest CVSS version that has one.
null when none is published.string
The CVSS version of the score: 4.0, 3.1, 3.0 or 2.0.
number
The base score, 0 to 10.
string
The rating word the source gives the score, for example CRITICAL.
null when the source gives no value.string
The CVSS vector string.
null when the source gives no value.string[]
The weakness identifiers, for example CWE-502, each once.
object
Set when the vulnerability is on the US list of known exploited vulnerabilities.
null when it is not.string
When it was added to the US list of known exploited vulnerabilities, YYYY-MM-DD.
null when the source gives no value.string
The date federal agencies must act by, YYYY-MM-DD.
null when the source gives no value.string
The action the list requires.
null when the source gives no value.string
The name the list gives the vulnerability.
null when the source gives no value.object[]
The first 10 references.
string
The address of the reference.
string[]
What kind of reference it is, for example Vendor Advisory.
number
How many references the record has, including any beyond the first 10.
string
The record on nvd.nist.gov.
curl -X POST https://win.oneshotagent.com/v1/tools/lookup/record-vulnerability \
-H "Content-Type: application/json" \
-H "payment-signature: <base64 x402 payment>" \
-d '{
"cve_id": "CVE-2021-44228"
}'
const response = await fetch("https://win.oneshotagent.com/v1/tools/lookup/record-vulnerability", {
method: "POST",
headers: {
"Content-Type": "application/json",
"payment-signature": paymentProof,
},
body: JSON.stringify({
"cve_id": "CVE-2021-44228"
}),
});
const result = await agent.tool('lookup/record-vulnerability', {
cve_id: 'CVE-2021-44228'
});
console.log(result.data.result);
console.log(result.data.evidence);
{
"success": true,
"data": {
"request_id": "uuid",
"receipt_id": "rcpt_...",
"status": "completed",
"tool": "record_vulnerability",
"result": {
"total": 1,
"vulnerabilities": [
{
"id": "CVE-2021-44228",
"description": "Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints.",
"published_at": "2021-12-10T10:15:09.143Z",
"last_modified_at": "2026-08-11T19:33:44.513Z",
"status": "Analyzed",
"severity": {
"version": "3.1",
"score": 10,
"rating": "CRITICAL",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
},
"weaknesses": [
"CWE-20",
"CWE-400",
"CWE-502",
"CWE-917"
],
"known_exploited": {
"added_on": "2021-12-10",
"action_due": "2021-12-24",
"required_action": "Apply updates, or remove affected assets from agency networks.",
"name": "Apache Log4j2 Remote Code Execution Vulnerability"
},
"references": [
{
"url": "https://example.com/advisory",
"tags": [
"Vendor Advisory"
]
}
],
"references_total": 103,
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
}
]
},
"evidence": {
"source": "US National Institute of Standards and Technology",
"source_kind": "public",
"retrieved_at": "2026-10-13T12:00:00.000Z",
"as_of": "2026-10-13T11:58:00.000Z"
}
}
}
Price: $0.005 per lookup. See Pricing for every tool.
Notes
- Results return inline. The finished job stays available at
/v1/requests/{request_id}