API documentation

Authentication

The public API (/v1/public), feeds, export and badges need no sign-in. The token API (/v1/api) expects an API token of your organisation as a bearer token; permissions are granted via scopes per token.

curl -H "Authorization: Bearer <API-Token>" \
  "https://api.intel.neosec.eu/v1/api/search?q=log4j&limit=10"

Scopes

• api:advisories.read
• api:misp.read
• api:misp.write
• api:tokens.read
• api:tokens.write
• api:tokens.revoke
• api:webhooks.read
• api:webhooks.write
• api:webhooks.revoke
• api:webhooks.rotate

Rate limits

Token API: 60 requests per second and 10,000 per hour per token (default, adjustable per token). When exceeded, the API responds with HTTP 429 and Retry-After.

Public endpoints: no fixed quota, but protection against abuse – some endpoints limit per IP, automated bulk retrieval is throttled (HTTP 429).

Webhooks

Create webhooks via the token API (/v1/api/webhooks). Each delivery is a POST with a JSON body and these headers:

POST <Ihre URL>
Content-Type: application/json
User-Agent: neosec-intel-webhooks/1.0
X-Neosec-Signature: t=<Unix-Zeit>,v1=<HMAC-SHA256 hex>
X-Idempotency-Key: <Schlüssel>
X-Event-Kind: vulnerability.kev_listed

Example payload

{
  "event": "vulnerability.kev_listed",
  "cve_id": "CVE-2024-4577",
  "kev_added_at": "2024-06-12",
  "source": "cisa_kev"
}

Verify the signature

The signature is HMAC-SHA256 with your webhook secret over “t=<timestamp>.” plus the unmodified body. Discard deliveries older than five minutes and detect repeats via X-Idempotency-Key.

import hashlib, hmac, time

def verify(secret: str, header: str, body: bytes) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    ts, sig = int(parts["t"]), parts["v1"]
    if abs(time.time() - ts) > 300:  # älter als 5 Minuten: verwerfen
        return False
    mac = hmac.new(secret.encode(), f"t={ts}.".encode() + body, hashlib.sha256)
    return hmac.compare_digest(mac.hexdigest(), sig)

Events

• vulnerability.kev_listed
• vulnerability.ransomware_confirmed
• advisory.critical_published
• editorial.published
• editorial.updated
• editorial.deleted
• editorial.restored

Deliveries of a time range can be triggered again via POST /v1/api/webhooks/{id}/replay.

MISP export

Pull: in your MISP instance, add this URL under “Sync Actions”, “List Feeds”, “Add Feed” as a feed in “MISP Feed” format with an Authorization header; polling every 15 minutes is sufficient.

GET https://api.intel.neosec.eu/v1/api/misp/events?since=2026-10-01T00:00:00Z
Authorization: Bearer <API-Token>

Push: alternatively, NEOSEC delivers actively to your MISP instance; manage the targets via /v1/api/misp/endpoints.

RSS feeds

/feed.xml with lang (de, en), filter (kev, critical, priority, headline, all, ot) and limit (1–100). With the same parameters as the search (e.g. severity, vendor, kev, industry, year), /feed.xml returns the 50 newest hits of exactly that search.

• https://intel.neosec.eu/feed.xml?lang=de&filter=kev&limit=30
• https://intel.neosec.eu/feed.xml?severity=critical&vendor=microsoft
• https://intel.neosec.eu/feed.xml?kev=1&industry=energy

Export

Search results and threat actors can be exported with the current filter as CSV or JSON (format=csv|json), up to 1,000 rows per request.

• https://intel.neosec.eu/search/export?format=csv&kev=1
• https://intel.neosec.eu/search/export?format=json&severity=critical&vendor=fortinet

Badges

Embeddable SVG badges: per CVE with severity, KEV status and date; per vendor with the number of entries in the CISA KEV catalog. Cached for one hour; ?lang=en for English. The embed code with backlink is on every CVE page.

• https://intel.neosec.eu/badge/cve/CVE-2024-4577.svg
• https://intel.neosec.eu/badge/vendor/microsoft.svg