GET /api/v1
List the endpoints in this version. No token is required.
Public.
Operator
API
Operator accounts can read the merged catalog. Responses are metadata and outbound links. Exploit code and proof-of-concept payloads are not included.
Create up to three keys on the API tab. Each key has a name and an expiration date, at most one year ahead. The key stays on that tab. An expired key returns 401. A Community account receives 403.
Authentication
Send the token on every data request. Either header is accepted.
Authorization: Bearer <token> X-Api-Key: <token>
A missing key, an unknown key, and an expired key each return 401. The message says which one it was.
curl -H "Authorization: Bearer $ZERODAY_TOKEN" \ "https://zerodayfindings.com/api/v1/findings?stack=odoo&severity=high&limit=25"
GET /api/v1/findings
List findings in the merged catalog.
Requires an Operator token.
| Parameter | Meaning |
|---|---|
| q | Text matched against the id, title, summary, vendor, and product. |
| severity | critical, high, medium, low, none, or unknown. |
| source | Source id, such as nvd, cisa_kev, osv, or github. |
| stack | Stack id, such as odoo, postgres, nginx, or linux. |
| cwe | Weakness id, such as CWE-79. |
| kev | Pass 1 to keep records in the CISA Known Exploited Vulnerabilities catalog. |
| sort | published (default), severity, epss, or modified. |
| updated_since | ISO-8601 time. Returns records the catalog updated at or after that time. |
| page | Page number, starting at 1. |
| limit | Page size from 1 to 100. The default is 25. |
GET /api/v1/findings/{id}
Read one finding, including scores, sources, affected packages, references, and the timeline.
Requires an Operator token.
GET /api/v1/stacks
List stack ids you can pass to the findings filter, with the number of matching records.
Requires an Operator token.
GET /api/v1/sources
List catalog sources and the result of the latest ingest for each one.
Requires an Operator token.
GET /api/v1/catalog
Counts for the catalog: records, Known Exploited Vulnerabilities, critical, high, and live sources.
Requires an Operator token.
What a finding contains
A list item includes the id, title, summary, published and modified times, CVSS score, severity, EPSS, the Known Exploited flag, vendor, product, source ids, stack ids, and CWE ids.
GET /api/v1/findings/{id} adds the CVSS vector, EPSS percentile, KEV dates, ransomware note, required action, each source record, affected packages, reference links, and the timeline.
List responses include total, page, pages, and limit. Pass updated_since with the time of your previous poll to fetch records changed since then.