Automating Submissions via API
Use POST /api/v1/vulnerabilities to send reports from your own tools, for example a scanner or a bug bounty platform. The API needs the Enterprise plan and an API key with the submissions:write scope.
Request body
Send a JSON object. Only description is required.
| Field | Description |
|---|---|
description | The report text. Required. |
productName | The affected product |
vulnerabilityType | One of the vulnerability type values. The API rejects other values and returns the list of permitted values. |
stepsToReproduce | Steps to reproduce |
impact | Security impact |
contactEmail | The reporter email |
pgpKey | The reporter PGP key |
The API does not accept file attachments.
Result
The API creates a report with status NEW and returns HTTP 201. The report goes into Submissions like a report from the public form. CVD Portal sends the submission.created event to your webhooks for that event.
Limits
- 10 requests per minute for each IP address.
- To send one report to many vendor portals, see Bulk Submission API.
- To send scan findings in SARIF format, use
POST /api/v1/scan/sarif. See Pipeline Connectors.