{"uid":"cap_1uWP1Ui8Qk-vsOQIldaNw","slug":"stack-facts-kev-changes-feed-bc6799d1","name":"Stack Facts KEV Changes Feed","description":"Check a package before install: malware, known vulnerabilities (OSV), exploited CVEs (CISA KEV) and end-of-life, plus LLM prices; signed answers, pay per call in USDC, no account or API key.","url":"https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/kev/changes?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$defs":{"meta":{"type":"object","required":["dataset","snapshot_id","as_of","retrieved_at","source","licence","attribution","sha256","signature","key_id","manifest_url","stale","notice"],"properties":{"as_of":{"type":"string"},"stale":{"type":"boolean"},"key_id":{"type":"string"},"notice":{"type":"string"},"sha256":{"type":"string"},"source":{"type":"string"},"dataset":{"type":"string"},"licence":{"type":"string"},"signature":{"type":"string"},"attribution":{"type":"string"},"snapshot_id":{"type":"string"},"manifest_url":{"type":"string"},"retrieved_at":{"type":"string"}}}},"$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"type":"string","const":"GET"},"queryParams":{"type":"object","required":["since"],"properties":{"since":{"type":"string","pattern":"^kev-\\d{8}T\\d{6}Z-[0-9a-f]{8}$","maxLength":64}},"additionalProperties":false}}},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string","const":"json"},"example":{"type":"object","required":["data","meta"],"properties":{"data":{"type":"object"},"meta":{"$ref":"#/$defs/meta"}}}}}}},"responseSchema":{"type":"json","example":{"data":{"to":"kev-20261009T060000Z-f4586cc5","added":[],"since":"kev-20261009T040000Z-7bd60fe8","counts":{"added":2,"removed":1,"modified":3},"removed":["CVE-2009-3459"],"modified":[{"cve":"CVE-2023-34362","name":"Progress MOVEit Transfer SQL In…","in_kev":true,"vendor":"Progress","product":"MOVEit Transfer","due_date":"2023-06-30","date_added":"2023-06-02","notes_urls":["https://www.cisa.gov/news-event…"],"required_action":"Apply updates per vendor instru…","known_ransomware":true}],"snapshots_merged":2},"meta":{"as_of":"2026-10-09T06:00:00Z","stale":false,"key_id":"sf-test-1","notice":"Normalised (modified) from the …","sha256":"f4586cc54bee30640f4364100eb70b7…","source":"https://www.cisa.gov/sites/defa…","dataset":"kev","licence":"CC0-1.0","signature":"Tne7KlsSRbohZK45rjItkYBKFOd8sEd…","attribution":"Source: CISA Known Exploited Vu…","snapshot_id":"kev-20261009T060000Z-f4586cc5","manifest_url":"/v1/kev/manifest","retrieved_at":"2026-10-09T06:00:00.000Z"}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_AoFSOT99jb7Ud-XtHSoYA","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns incremental changes (added, removed, modified entries) to the CISA Known Exploited Vulnerabilities (KEV) catalog since a given snapshot ID, with cryptographic signatures and pay-per-call USDC billing.","exampleAgentPrompt":"What changed in the CISA Known Exploited Vulnerabilities catalog since snapshot kev-20261009T040000Z-7bd60fe8? Show me anything added, removed, or modified.","exampleUseCases":[{"title":"Security pipeline KEV delta polling","prompt":"Pull all the KEV changes since snapshot kev-20261009T040000Z-7bd60fe8 so I can update my internal vulnerability database with the latest additions, removals, and modifications from CISA."},{"title":"Ransomware CVE alert monitoring","prompt":"Check the CISA KEV changelog since kev-20261009T040000Z-7bd60fe8 and flag any newly added CVEs that are associated with known ransomware campaigns."},{"title":"Compliance patch deadline tracking","prompt":"Get me the KEV diff since kev-20261009T040000Z-7bd60fe8 and list any newly added entries along with their remediation due dates so I can prioritize our patching schedule."}],"resultDescription":"A JSON object containing: a 'data' field with lists of added, removed, and modified KEV entries (each with CVE ID, vendor, product, due date, date added, ransomware association flag, required action, and notes URLs), change counts, and snapshot cursor IDs (since/to); plus a 'meta' field with source attribution, dataset info, CC0 licence, SHA-256 hash, cryptographic signature, key ID, staleness flag, and retrieval timestamp.","failureModes":["Invalid 'since' snapshot ID format (must match pattern kev-YYYYMMDDTHHMMSSZ-8hexchars) returns 400 error","Snapshot ID too old or not found returns 404 or empty diff","Payment not included or insufficient USDC causes 402 Payment Required response","Network timeout or server unavailability returns 5xx","Stale data flag in meta indicates cached/outdated snapshot"],"whenToPreferThis":"Use this endpoint when you need incremental, cryptographically verifiable updates to the CISA KEV catalog without maintaining a full subscription or API key. It is ideal for lightweight polling in security automation pipelines, compliance workflows, or AI agents that need to detect newly exploited CVEs since a known checkpoint. Prefer this over scraping the CISA website or using the full KEV snapshot endpoint when you already have a prior snapshot ID and only need the delta.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-13T12:41:42.001Z","isFirstParty":false,"canonicalSlug":"stack-facts-kev-changes-feed-bc6799d1"}