{"service":"vti-mirror","version":"0.11.130-dev","upstream":"Securin VI — mirrored, not modified","endpoints":[{"method":"POST","path":"/v1/match","loadBearing":true,"purpose":"match by CPE vendor/product/version; when advisory enrichment is enabled, the top-level vendorRemediations map carries each matched CVE's data once, and each match carries hasVendorRemediations"},{"method":"POST","path":"/v1/match/package","loadBearing":true,"purpose":"match by purl; gate on /v1/coverage first; when advisory enrichment is enabled, the top-level vendorRemediations map carries each matched CVE's data once, and each match carries hasVendorRemediations"},{"method":"GET","path":"/v1/coverage","loadBearing":true,"purpose":"which package ecosystems are held — decides whether packageKnown=false means clean or means no data"},{"method":"GET","path":"/v1/sync/status","loadBearing":true,"purpose":"readiness and freshness; a match answered while degraded is stale without being an error"},{"method":"GET","path":"/v1/changes","loadBearing":false,"purpose":"delta feed; load-bearing if you enrich incrementally"},{"method":"GET","path":"/v1/graph/aggregates/{name}","loadBearing":false,"purpose":"named whole-graph aggregations (kev-by-vendor, ransomware-reach); cached, not a live query"},{"method":"POST","path":"/v1/match/batch","loadBearing":false,"purpose":"same semantics as /v1/match, fewer round trips, one rate-limit token PER ITEM"},{"method":"POST","path":"/v1/match/package/batch","loadBearing":false,"purpose":"as above, for purls; vendorRemediations still costs one batched advisory lookup per request, not one per item, and the top-level map covers every item in the batch"},{"method":"POST","path":"/v1/product/vendors","loadBearing":false,"purpose":"resolve ambiguous_vendor — a list to CHOOSE from, never to union"},{"method":"GET","path":"/v1/cve/{id}","loadBearing":false,"purpose":"the complete upstream record, verbatim, including every CVSS scheme with its source; carries vendorRemediations when advisory enrichment is enabled, data exists, and the bounded lookup succeeded"},{"method":"GET","path":"/v1/cve/{id}/remediation","loadBearing":false,"purpose":"Phase 1 remediation guidance for one CVE: the bare union of Securin's own fixes[]/advisories[] and vendorRemediations, reshaped into one tagged-by-source list — no resolution context yet"},{"method":"GET","path":"/v1/kev/securin","loadBearing":false,"purpose":"page Securin's own known-exploited-vulnerability list (securinKEV, distinct from CISA's own kev); each row is the same full record GET /v1/cve/{id} renders"},{"method":"GET","path":"/v1/advisories","loadBearing":false,"purpose":"page vendor advisories (source, cve, product, since filters); product= is time-bounded (422 product_filter_timeout) and concurrency-capped (429); list rows carry no remediation/product bodies -- fetch one via GET /v1/advisories/{source}/{id}"},{"method":"GET","path":"/v1/advisories/{source}/{id}","loadBearing":false,"purpose":"one vendor advisory's full remediations/products/cves"},{"method":"GET","path":"/v1/metrics","loadBearing":false,"purpose":"counters and per-loop sync state"},{"method":"GET","path":"/metrics","loadBearing":false,"purpose":"Prometheus text exposition of the same counters and per-route latency histograms as /v1/metrics"},{"method":"GET","path":"/v1/advisories/status","loadBearing":false,"purpose":"vendor advisory tracking (opt-in); {\"enabled\":false} when VTI_ADVISORIES_ENABLED is unset"},{"method":"GET","path":"/healthz","loadBearing":false,"purpose":"liveness only; says nothing about freshness"},{"method":"GET","path":"/openapi.yaml","loadBearing":false,"purpose":"the pinned OpenAPI 3.1 spec for this API"},{"method":"GET","path":"/cli/install.sh","loadBearing":false,"purpose":"curl | bash installer for the vti-mirror-query CLI kit"},{"method":"GET","path":"/cli/vti-mirror-query","loadBearing":false,"purpose":"the CLI tool itself, verbatim"},{"method":"GET","path":"/cli/config.example","loadBearing":false,"purpose":"CLI config template; the installer writes it only when none exists"},{"method":"GET","path":"/cli/README.md","loadBearing":false,"purpose":"CLI setup, everyday commands, and troubleshooting"},{"method":"GET","path":"/docs/","loadBearing":false,"purpose":"Documentation: \u003cthis mirror\u003e/docs/."},{"method":"POST","path":"/mcp","loadBearing":false,"purpose":"read-only MCP access to the REST API; authenticated with the same bearer token, or with an MCP OAuth bearer minted via /oauth/* when VTI_MCP_OAUTH is enabled"}],"readThisFirst":{"asOf":"the EARLIER of the riskindex and viupdated loops' last success, and it is each sweep's START time. A rewalk does not move it.","cpe23Uri":"the CPE of the range that matched, verbatim. Read target_sw before vouching — a record scoped to host software is about that software, not the product alone. It is also the only field that reveals a name collision. ABSENT means the graph predates the field, never that a component is a wildcard.","cvssScore":"upstream's leading score, scheme unstated. cvssV2Score/cvssV3BaseScore/cvssV4Score carry each scheme separately with its own source.","exploitation.*":"null means upstream stated nothing; false means upstream stated false. Never read null as a negative.","hardwareScopeUnverified":"true means the record names specific hardware and you sent no platform.hardware to check it against — tier the match BELOW cpe23Uri_exact rather than treating it as a plain hit. Absent/false means either no hardware condition exists on the edge or it was actually checked one way or the other.","kev":"CISA's catalogue ONLY. Far more records are flagged weaponized than appear in it. Read exploitation.* before prioritising.","matchedVia":"your precision gate. product_only_unbounded means the record names the product with no version bound — treat it as unverified, not as a hit.","packageKnown":"NULLABLE. null means WE DID NOT LOOK — the request never reached the store, so read error and never read it as clean. false means CLEAN only for an ecosystem listed in /v1/coverage. For any other ecosystem it means NO DATA and the row is unassessed.","severity":"the riskIndex band — Securin's model, NOT CVSS. The two disagree on most High/Critical records. cvssSeverity is the CVSS one.","ssvc.source":"read it rather than assuming. SSVC is a CISA-adopted framework, but every assessment in this corpus is sourced Securin."},"docs":"docs/vti-mirror-api.md in the vti-mirror repository"}