# Vulnerability Finder API

URL: https://www.deepinfo.com/data-api/apis/vulnerability-finder/

## From One URL to the Vulnerabilities in Its Stack.

The Vulnerability Finder API takes a URL, hostname or IP address. It connects to the target, detects the technologies it runs and returns the vulnerabilities that affect them, with the connection result and the redirects it followed.

[Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [Vulnerability Finder reference](https://docs.deepinfo.com/reference/vulnerability/finder/)

### Send a Target and Read Its Stack.

One parameter, `url`. The response fields are listed with their types in the next section.

GET `https://api.deepinfo.com/v1/discovery/vulnerability-finder` [Reference](https://docs.deepinfo.com/reference/vulnerability/finder/)

| Parameter | Type |  | Description |
| --- | --- | --- | --- |
| `url` | string | Required | The target: a URL, an FQDN or an IP address, for example `https://www.acme.example`. |

Request

curl:

```bash
curl "https://api.deepinfo.com/v1/discovery/vulnerability-finder?url=https://www.acme.example" \
  -H "apikey: YOUR_API_KEY"
```

Python:

```python
import requests

r = requests.get(
    "https://api.deepinfo.com/v1/discovery/vulnerability-finder",
    params={"url": "https://www.acme.example"},
    headers={"apikey": "YOUR_API_KEY"},
)
result = r.json()
print(result["connection_status"], result["vulnerability_stats"])
```

JavaScript:

```javascript
const q = new URLSearchParams({ url: 'https://www.acme.example' })
const r = await fetch(
  'https://api.deepinfo.com/v1/discovery/vulnerability-finder?' + q,
  { headers: { apikey: 'YOUR_API_KEY' } }
)
const result = await r.json()
console.log(result.connection_status, result.vulnerability_stats)
```

Which endpoints a key can call depends on the plan: a key without this one gets a 403, `You cannot consume this service`. A request without `url` returns a 400 that names it. Plan-dependent [rate limits](https://docs.deepinfo.com/getting-started/rate-limits/) apply, one request per second by default.

### What One Answer Holds.

| Field | Type | What it holds |
| --- | --- | --- |
| `url` | string | The target you passed. |
| `check_date` | date-time | When the check ran, in ISO 8601 UTC. |
| `connection_status` | string | The outcome of connecting to the target. |
| `redirection_history` | array of objects | The redirects followed on the way to the page that was analyzed. |
| `technologies` | array of objects | The technologies detected on the target. |
| `vulnerability_stats` | object | Statistics on the vulnerabilities that affect the detected technologies. |

Field list from the [reference](https://docs.deepinfo.com/reference/vulnerability/finder/#ref-response-fields), which carries the full schema.

### A Request Connects, Fingerprints and Matches.

1. **Connect**

   The API reaches the target, follows its redirects and records the connection result.
2. **Fingerprint**

   It detects the technologies the target runs, each identified by a CPE name.
3. **Match**

   CPE names are matched against the affected-product ranges in Deepinfo’s CVE database.
4. **Return**

   Technologies and vulnerability statistics come back in one response, stamped with `check_date`.

### What a Match Does and Doesn’t Mean.

Signal

#### Exposure to Verify

A match means a detected technology falls in a vulnerable range. Confirming that a specific CVE is exploitable on that host is a separate step.

Precision

#### Only as Exact as the Version

When a site hides its version numbers, the match can only be as specific as what the site reveals.

Next step

#### The Full Record per CVE

For the EPSS score, CISA KEV status and affected versions behind any CVE, call the [Vulnerability Detail API](https://www.deepinfo.com/data-api/apis/vulnerability-detail/).

At scale

#### All Assets, on a Schedule

[External Attack Surface Management](https://www.deepinfo.com/platform/easm/) scans each asset you own and ranks CVEs by CVSS, EPSS and CISA KEV together.

### Workflows This Call Plugs Into.

#### [Attack Surface Management](https://www.deepinfo.com/solutions/use-cases/attack-surface-management/)

Add the vulnerable-technology view to any host you discover, one request per target.

#### [Vulnerability Management](https://www.deepinfo.com/solutions/use-cases/vulnerability-management/)

Check an internet-facing site for known vulnerabilities in its stack between scheduled scans.

#### [Third-Party Risk Management](https://www.deepinfo.com/solutions/use-cases/third-party-risk-management/)

Read a vendor’s public web stack for known vulnerabilities, alongside what its questionnaire says.

#### [Cyber Insurance Assessment](https://www.deepinfo.com/solutions/use-cases/cyber-insurance-assessment/)

Give underwriting an outside-in read of an applicant’s web stack.

### Follow the Chain One Link at a Time.

- [Vulnerability Detail](https://www.deepinfo.com/data-api/apis/vulnerability-detail/): The full record behind one CVE ID, in one call.
- [Vulnerability Search](https://www.deepinfo.com/data-api/apis/vulnerability-search/): Filter the CVE database by CVSS, EPSS, CISA KEV, weakness and affected product.
- [Technology Lookup](https://www.deepinfo.com/data-api/apis/technology-lookup/): The technologies detected on a site, each with its CPE name.

### Questions About Vulnerability Finder API

**How is the Finder different from Vulnerability Search?**

Vulnerability Search starts from conditions you write, such as a vendor or an EPSS threshold. The Finder starts from a live target and works out which products to match from what the target runs.

**Can we run the chain ourselves?**

Yes, in two steps. [Technology Lookup](https://www.deepinfo.com/data-api/apis/technology-lookup/) returns each detected technology with its version and CPE name. [Vulnerability Search](https://www.deepinfo.com/data-api/apis/vulnerability-search/) then filters CVEs on `enrichment.cpe.vendor` and `enrichment.cpe.product`, and the `enrichment.cpe.version_*` fields hold each affected range to check the version against.

**How is the Vulnerability Finder priced?**

As part of an API services plan, priced by volume and frequency, separately from the platform. See [Data & API pricing](https://www.deepinfo.com/pricing/#data-pricing).

**Can we check many sites at once?**

Each call takes one target, so a list of sites means one call per site within your plan’s [rate limits](https://docs.deepinfo.com/getting-started/rate-limits/).

### Point It at a Site You Run.

Tell us which sites you want to check. We confirm the Finder is on your plan and set up access on a short call.

[Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [All API services](https://www.deepinfo.com/data-api/apis/)