A base URL, a key in one X-API-Key header, one call. ESIP has two APIs, free and
commercial, and they are separate services with separate hosts. Copy the snippet, paste your key,
run it.
The dated, sourced observation events for a CVE: what was seen, from which public source, and when. Plus the exposure class and ATT&CK techniques.
https://public.exposuresignal.io Free key, sent as X-API-Key.
ESIP's interpretation of those observations: the lifecycle, trend, velocity, and corroboration, the change feed, the lifecycle history, and the narrative of why.
https://api.exposuresignal.io Commercial key, sent as X-API-Key.
Your first observations, on the free host. A free key reaches /v1/cves.
curl -H "X-API-Key: YOUR_FREE_KEY" \ https://public.exposuresignal.io/v1/cves/CVE-2021-44228
You get the public observation events for that CVE, each dated and attributed to its source, plus its exposure class, and its ATT&CK techniques. Load your key from an environment variable or secrets manager; do not hardcode or commit it.
The verdict, on the commercial host. A commercial key reaches /v1/signals.
curl -H "X-API-Key: YOUR_COMMERCIAL_KEY" \ https://api.exposuresignal.io/v1/signals/CVE-2021-44228
You get the current verdict for that CVE: its lifecycle stage, severity band, confidence, and what changed, with the evidence behind it.
Most CVEs have no active signal at any given moment. A 404 means nothing has moved on that CVE, not that it is safe. Absence of a signal is not safety. A CVE with no signal today may have one tomorrow, so poll again.
public.exposuresignal.ioGET /v1/cves | Paginated CVE list from the latest daily snapshot |
GET /v1/cves/{cve_id} | Observations + ATT&CK techniques for one CVE |
api.exposuresignal.ioGET /v1/signals/{cve_id} | Current verdict + evidence + temporal context for one CVE |
GET /v1/signals | All active signals, paginated. Filter by stage, band, confidence, attack_technique |
GET /v1/signals/changes | Signals changed since a timestamp, for efficient incremental polling |
GET /v1/signals/{cve_id}/history | Full verdict audit trail: every version, with constraints applied |
GET /v1/signals/{cve_id}/evidence | Complete evidence chain with observation-level enrichment |
GET /v1/compound-risk | All active compound-risk signals (multi-source corroborated CVEs) |
GET /v1/schema | Current schema version + field definitions |
The free tier returns the observations and the change: enough to look up a CVE and see what changed. The full verdict, the change feed, and the lifecycle history are commercial.
See pricing →