This parameter is part of the URL query.

cves By default, the response returns all CPE that meet the search criteria. Including addOns=cves adds the vulnerabilities associated with the CPE.

The API Key provided to the user. Including apiKey={key value}, (without brackets or spaces) allows users to make a greater number of requests in a given time than they could otherwise.

Beginning in September 2022, API keys may also be passed to the 1.0 APIs in the request header. This approach is required with the 2.0 APIs. The exact method of passing header information with a GET request varies based on the user agent.

This parameter is used to filter products based on the CPE match criteria. The value of cpeMatchString is compared it against the CPE Match Criteria present on all CVE applicability statements. For more information on Common Platform Enumeration (CPE) please visit NIST's Computer Security Resource Center. Examples of CPE match strings are provided below for illustration.

To find CPE names for Microsoft Windows 10, use:

cpes/1.0?cpeMatchString=cpe:2.3:o:microsoft:windows_10

To find CPE names for Microsoft Windows 10, version 1511 use:

cpes/1.0?cpeMatchString=cpe:2.3:o:microsoft:windows_10:1511

To find all CPE names for Microsoft, use:

cpes/1.0?cpeMatchString=cpe:2.3:*:microsoft

true A deprecated CPE is one that previously appeared in the Official CPE Dictionary but has since been replaced by one or more other CPE. CPE are deprecated for various reasons, such as when the original CPE name is discovered to be incorrect, when a more specific CPE name is added, and when a vendor name or product name evolves. By default, deprecated CPE names are not returned by the web service. includeDeprecated=true adds deprecated CPE to the request.

This parameter is used to retrieve records where a word or phrase is found in the CPE title or reference links.

These parameters specify a collection of CPE that were last modified during the period. If a CPE has been modified more recently than the specified period it will not be included in the response. If filtering by the modification date, both modStartDate and modEndDate are REQUIRED. Filtering with only one parameter will return a successful response without data. The maximum allowable range when using the date range parameters is 120 consecutive days. Date range parameters are in the form:

yyyy-MM-ddTHH:mm:ss:SSS Z

The T is a literal to separate the date from the time. The Z indicates an offset-from-UTC. If a positive Z value is used (such as +01:00 for Central European Time) then the "+" should be encoded in the request as "%2B". This may be handled automatically by the user agent. An example is provided below showing a +01:00 offset-from-UTC.

https://services.nvd.nist.gov/rest/json/cpes/1.0/?modStartDate=2021-08-04T13:00:00:000 UTC%2B01:00&modEndDate=2021-10-22T13:36:00:000 UTC%2B01:00

This parameter specifies the maximum number of results that are returned based on the request parameters. The default value is 20. For network considerations, maximum allowable limit is 2,000.

The response content totalResults indicates the number of CPE results that match request parameters. If the value of totalResults is greater than the value of resultsPerPage, the parameter startIndex may be used in subsequent requests to identify the starting point for the request.

This parameter determines the first CPE in the collection returned by the response. The index is zero-based, meaning the first CPE is at index zero. The response element totalResults indicates the number of CPE results that match request parameters. If the value of totalResults is greater than the value of resultsPerPage, the parameter startIndex may be used in subsequent requests to identify the first CPE for the request.

The best, most efficient, practice for keeping up to date with the NVD is to use the date range parameters in order to request only those CPE that have been published or modified since the last request.

Presently NVD contains more than 325,000 products relating to thousands of vendors and vulnerabilities. Multiple consecutive requests are required to return all available records. Requesting an API key significantly raises the number of requests that can be made in a given time frame. However, NIST firewall rules put in place to prevent denial of service attacks on NVD can thwart your application. To avoid this, it is recommended that your application sleeps for several seconds between requests so that legitimate requests are not denied.

This element identifies a CPE by the CPE 2.3 Naming specification. The CPE 2.3 Naming specification requires that special charters are preceded by a backslash. When backlashes appear in the JSON syntax of the response they are represented as \\. While the schema requires only the cpe23Uri element to be present, in practice each CPE always contains a lastModifiedDate.

This element specifies when the CPE was last modified.

This element identifies whether the CPE is deprecated. By default, deprecated CPE are not included in the response. The value of this element is either true or false. When deprecated=true, the deprecatedBy element shows one or more other CPE that replace this CPE.

This element contains the human-readable, English title for the CPE.

This element contains one or more Internet links associated with the CPE. NIST categorizes links using the type elements, e.g., Advisory.

This element identifies the vulnerabilities associated with the CPE. By default, vulnerabilities are not included in the response. Including the optional query parameter addOns=cves adds the vulnerabilities associated with the CPE.