References
API reference
Every route of https://api.notholy.com/v1, generated from the OpenAPI file. Download it as openapi.json.
openapi.json · Authentication: Bearer token or x-api-key header.
Inference
POST/chat/completions
Chat completion (OpenAI format)
Parameters
Idempotency-Key | header | string | Non-streaming requests with the same key within 24 hours return the first response and are not charged again. |
Request body: application/json
curl -X POST https://api.notholy.com/v1/chat/completions \
-H "Authorization: Bearer $NOTHOLY_API_KEY" \
-H "Content-Type: application/json" \
-d '{"model":"notholy-pulse","messages":[{"role":"user","content":"Explain IDOR in two sentences."}]}'Responses
200 · default
POST/responses
Response (OpenAI Responses format, stateless)
previous_response_id returns 400. Send the full conversation in input.
Parameters
Idempotency-Key | header | string | Non-streaming requests with the same key within 24 hours return the first response and are not charged again. |
Request body: application/json
curl -X POST https://api.notholy.com/v1/responses \
-H "Authorization: Bearer $NOTHOLY_API_KEY" \
-H "Content-Type: application/json" \
-d '{"model":"notholy-specter","input":"Summarize what CVSS 3.1 AV:N means."}'Responses
200 · default
POST/completions
Text completion (legacy OpenAI format)
Request body: application/json
curl -X POST https://api.notholy.com/v1/completions \
-H "Authorization: Bearer $NOTHOLY_API_KEY" \
-H "Content-Type: application/json" \
-d '{"model":"notholy-vector","prompt":"The OWASP category for SSRF is","max_tokens":30}'Responses
200 · default
POST/messages
Message (Anthropic Messages format)
The Anthropic SDK base URL is https://api.notholy.com. cache_control is ignored; PDF document sources return 400.
Request body: application/json
curl -X POST https://api.notholy.com/v1/messages \
-H "Authorization: Bearer $NOTHOLY_API_KEY" \
-H "Content-Type: application/json" \
-d '{"model":"notholy-pulse","max_tokens":512,"messages":[{"role":"user","content":"What is a Sigma rule?"}]}'Responses
200 · default
POST/messages/count_tokens
Count input tokens (Anthropic format)
Request body: application/json
curl -X POST https://api.notholy.com/v1/messages/count_tokens \
-H "Authorization: Bearer $NOTHOLY_API_KEY" \
-H "Content-Type: application/json" \
-d '{"model":"notholy-pulse","messages":[{"role":"user","content":"What is a Sigma rule?"}]}'Responses
200 · default
POST/embeddings
Embeddings (no model available yet)
Always returns 404 model_not_found until an embedding model is added. Not charged.
Request body: application/json
curl -X POST https://api.notholy.com/v1/embeddings \
-H "Authorization: Bearer $NOTHOLY_API_KEY" \
-H "Content-Type: application/json" \
-d '{"model":"notholy-embed","input":"text"}'Responses
404
Models
GET/models
List models
curl https://api.notholy.com/v1/models \
-H "Authorization: Bearer $NOTHOLY_API_KEY"Responses
200 · default
GET/models/{id}
Get one model
Parameters
id | path, required | string |
curl https://api.notholy.com/v1/models/notholy-pulse \
-H "Authorization: Bearer $NOTHOLY_API_KEY"Responses
200 · default
Account
GET/credits
Balance of the organization and spend of the key
curl https://api.notholy.com/v1/credits \
-H "Authorization: Bearer $NOTHOLY_API_KEY"Responses
200 · default
Research
GET/cve/{id}
One CVE with NVD, CISA KEV and FIRST EPSS data
Parameters
id | path, required | string |
curl https://api.notholy.com/v1/cve/CVE-2021-44228 \
-H "Authorization: Bearer $NOTHOLY_API_KEY"Responses
200 · default
GET/cve/search
Search the CVE mirror
Parameters
q | query | string | |
vendor | query | string | |
cwe | query | string | |
kev | query | boolean | |
min_cvss | query | number | |
min_epss | query | number | |
limit | query | integer |
curl https://api.notholy.com/v1/cve/search \
-H "Authorization: Bearer $NOTHOLY_API_KEY"Responses
200 · default
POST/advisories/query
Advisories for a package and version
Request body: application/json
curl -X POST https://api.notholy.com/v1/advisories/query \
-H "Authorization: Bearer $NOTHOLY_API_KEY" \
-H "Content-Type: application/json" \
-d '{"ecosystem":"npm","name":"lodash","version":"4.17.15"}'Responses
200 · default
POST/web/search
Web search
Request body: application/json
curl -X POST https://api.notholy.com/v1/web/search \
-H "Authorization: Bearer $NOTHOLY_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query":"CVE-2024-3094 xz backdoor analysis","count":5}'Responses
200 · default
POST/web/read
Read a public page through the protected egress
Request body: application/json
curl -X POST https://api.notholy.com/v1/web/read \
-H "Authorization: Bearer $NOTHOLY_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228"}'Responses
200 · default
POST/files
Upload a file for static analysis (kept 1 hour)
Parameters
x-file-name | header, required | string | |
wait | query | string | Wait for the analysis to finish |
Request body: application/octet-stream
curl -X POST https://api.notholy.com/v1/files \
-H "Authorization: Bearer $NOTHOLY_API_KEY"Responses
200 · 202 · default
GET/files/{id}
File status
Parameters
id | path, required | string |
curl https://api.notholy.com/v1/files/{id} \
-H "Authorization: Bearer $NOTHOLY_API_KEY"Responses
200 · default
GET/files/{id}/content
Extracted text of a file
Parameters
id | path, required | string |
curl https://api.notholy.com/v1/files/{id}/content \
-H "Authorization: Bearer $NOTHOLY_API_KEY"Responses
200 · default