API reference

Research API

CVE records, advisory queries, web search, page reading and file analysis, the same data the chat uses.

These routes give the CLI, the extension and your own code the data the chat uses. They have a per-minute limit that grows with your level. They do not use tokens, so they are not charged per token.

Route	What it does
`GET /v1/cve/{id}`	One CVE with NVD description, CVSS, CWE, EPSS, CISA KEV status and references
`GET /v1/cve/search?q=&vendor=&cwe=&kev=true&min_cvss=&min_epss=&limit=`	Search the mirror
`POST /v1/advisories/query`	Advisories for a package and version
`POST /v1/web/search`	Web search results with title, URL and snippet
`POST /v1/web/read`	Text of a public page, fetched through a protected egress
`POST /v1/files`	Upload a file for static analysis
`GET /v1/files/{id}`, `GET /v1/files/{id}/content`	Status and extracted text

curl

curl https://api.notholy.com/v1/cve/CVE-2021-44228 -H "Authorization: Bearer $NOTHOLY_API_KEY"

curl

curl -X POST https://api.notholy.com/v1/advisories/query \
  -H "Authorization: Bearer $NOTHOLY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ecosystem": "npm", "name": "lodash", "version": "4.17.15"}'

Files

POST /v1/files takes the raw bytes as the body and the name in x-file-name. Add ?wait=1 to wait for the analysis. Files sent here are kept for 1 hour and then deleted. This is storage you ask for, separate from inference, which stores nothing. Files are parsed inside an isolated sandbox with no network, and nothing in them is executed.

Shell

printf 'const q = "SELECT * FROM users WHERE id = " + req.query.id;\n' > handler.js
curl -X POST "https://api.notholy.com/v1/files?wait=1" \
  -H "Authorization: Bearer $NOTHOLY_API_KEY" \
  -H "x-file-name: handler.js" \
  --data-binary @handler.js

web/read only reads public pages. It refuses private addresses, and it never sends traffic to targets for you. Anything a page says is treated as data, never as an instruction.