Vulnerability Finder API
From One URL to the Vulnerabilities in Its Stack.
The Vulnerability Finder API takes a URL, hostname or IP address. It connects to the target, detects the technologies it runs and returns the vulnerabilities that affect them, with the connection result and the redirects it followed.
requesturl=https://staging.acme.example
-
Connected
the outcome in
connection_· redirects instatus redirection_history -
Apache httpd 2.4.49
in
technologies· cpe:2.3:a:apache:http_server:2.4.49 -
CVE-2021-41773
affects 2.4.49 · counted in
vulnerability_stats -
One answer (done)
stamped with
check_date
Send a Target and Read Its Stack.
One parameter, url. The response fields are listed with their types in the next section.
| Parameter | Type | Description | |
|---|---|---|---|
url | string | Required | The target: a URL, an FQDN or an IP address, for example https:/. |
Request
curl "https://api.deepinfo.com/v1/discovery/vulnerability-finder?url=https://www.acme.example" \
-H "apikey: YOUR_API_KEY"import requests
r = requests.get(
"https://api.deepinfo.com/v1/discovery/vulnerability-finder",
params={"url": "https://www.acme.example"},
headers={"apikey": "YOUR_API_KEY"},
)
result = r.json()
print(result["connection_status"], result["vulnerability_stats"])const q = new URLSearchParams({ url: 'https://www.acme.example' })
const r = await fetch(
'https://api.deepinfo.com/v1/discovery/vulnerability-finder?' + q,
{ headers: { apikey: 'YOUR_API_KEY' } }
)
const result = await r.json()
console.log(result.connection_status, result.vulnerability_stats)Which endpoints a key can call depends on the plan: a key without this one gets a 403, You cannot consume this service. A request without url returns a 400 that names it. Plan-dependent rate limits apply, one request per second by default.
What One Answer Holds.
| Field | Type | What it holds |
|---|---|---|
url | string | The target you passed. |
check_ | date-time | When the check ran, in ISO 8601 UTC. |
connection_ | string | The outcome of connecting to the target. |
redirection_ | array of objects | The redirects followed on the way to the page that was analyzed. |
technologies | array of objects | The technologies detected on the target. |
vulnerability_ | object | Statistics on the vulnerabilities that affect the detected technologies. |
Field list from the reference, which carries the full schema.
A Request Connects, Fingerprints and Matches.
-
01
Connect
The API reaches the target, follows its redirects and records the connection result.
-
02
Fingerprint
It detects the technologies the target runs, each identified by a CPE name.
-
03
Match
CPE names are matched against the affected-product ranges in Deepinfo’s CVE database.
-
04
Return
Technologies and vulnerability statistics come back in one response, stamped with
check_.date
What a Match Does and Doesn’t Mean.
Signal
Exposure to Verify
A match means a detected technology falls in a vulnerable range. Confirming that a specific CVE is exploitable on that host is a separate step.
Precision
Only as Exact as the Version
When a site hides its version numbers, the match can only be as specific as what the site reveals.
Next step
The Full Record per CVE
For the EPSS score, CISA KEV status and affected versions behind any CVE, call the Vulnerability Detail API.
At scale
All Assets, on a Schedule
External Attack Surface Management scans each asset you own and ranks CVEs by CVSS, EPSS and CISA KEV together.
Workflows This Call Plugs Into.
Attack Surface Management
Add the vulnerable-technology view to any host you discover, one request per target.
Vulnerability Management
Check an internet-facing site for known vulnerabilities in its stack between scheduled scans.
Third-Party Risk Management
Read a vendor’s public web stack for known vulnerabilities, alongside what its questionnaire says.
Cyber Insurance Assessment
Give underwriting an outside-in read of an applicant’s web stack.
Questions About Vulnerability Finder API
How is the Finder different from Vulnerability Search?
Vulnerability Search starts from conditions you write, such as a vendor or an EPSS threshold. The Finder starts from a live target and works out which products to match from what the target runs.
Can we run the chain ourselves?
Yes, in two steps. Technology Lookup returns each detected technology with its version and CPE name. Vulnerability Search then filters CVEs on enrichment.cpe.vendor and enrichment.cpe.product, and the enrichment.cpe.version_ fields hold each affected range to check the version against.
How is the Vulnerability Finder priced?
As part of an API services plan, priced by volume and frequency, separately from the platform. See Data & API pricing.
Can we check many sites at once?
Each call takes one target, so a list of sites means one call per site within your plan’s rate limits.
Point It at a Site You Run.
Tell us which sites you want to check. We confirm the Finder is on your plan and set up access on a short call.