# Research API

> CVE records, advisory queries, web search, page reading and file analysis, the same data the chat uses.


These routes give the CLI, the extension and your own code the data the chat uses. They have a per-minute limit that grows with your level. They do not use tokens, so they are not charged per token.

| Route | What it does |
|---|---|
| `GET /v1/cve/{id}` | One CVE with NVD description, CVSS, CWE, EPSS, CISA KEV status and references |
| `GET /v1/cve/search?q=&vendor=&cwe=&kev=true&min_cvss=&min_epss=&limit=` | Search the mirror |
| `POST /v1/advisories/query` | Advisories for a package and version |
| `POST /v1/web/search` | Web search results with title, URL and snippet |
| `POST /v1/web/read` | Text of a public page, fetched through a protected egress |
| `POST /v1/files` | Upload a file for static analysis |
| `GET /v1/files/{id}`, `GET /v1/files/{id}/content` | Status and extracted text |

```bash test
curl https://api.notholy.com/v1/cve/CVE-2021-44228 -H "Authorization: Bearer $NOTHOLY_API_KEY"
```

```bash test
curl -X POST https://api.notholy.com/v1/advisories/query \
  -H "Authorization: Bearer $NOTHOLY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ecosystem": "npm", "name": "lodash", "version": "4.17.15"}'
```

## Files

`POST /v1/files` takes the raw bytes as the body and the name in `x-file-name`. Add `?wait=1` to wait for the analysis. Files sent here are kept for 1 hour and then deleted. This is storage you ask for, separate from inference, which stores nothing. Files are parsed inside an isolated sandbox with no network, and nothing in them is executed.

```bash test
printf 'const q = "SELECT * FROM users WHERE id = " + req.query.id;\n' > handler.js
curl -X POST "https://api.notholy.com/v1/files?wait=1" \
  -H "Authorization: Bearer $NOTHOLY_API_KEY" \
  -H "x-file-name: handler.js" \
  --data-binary @handler.js
```

`web/read` only reads public pages. It refuses private addresses, and it never sends traffic to targets for you. Anything a page says is treated as data, never as an instruction.

## Next

- [CVEs in the chat](/en/chat/cves)
- [MCP](/en/mcp/local)