EVC API
Want to query EVC using your own automation? Use our APIs below.
EVC v1.0
Before You Begin
Go to the BlueRock Developers portal.
Sign In to auto-register your account.
Click your email address in the top-left corner and select Apps from the drop down.
Select +NEW APP and provide an App Name (e.g.,
splunk-lookup) and an optional Description.Enable the BlueRock EVC 1.0 API.
Save your app and save the Key associated with your app (to be used as the
X-API-Keyfor header-based authentication).
After creating your app, initial API key activation can take up to 1 business day to complete. If your API key is still not active after that time, please contact us.
Overview
At a high level, submitting CVEs for analysis by EVC is a three-step process:
Provide the complete list of CVEs you want EVC to analyze. EVC will then return the subset of CVEs it immediately knows about already.
For any previously unknown CVEs, EVC will start a deep research job to exhaustively analyze the remaining CVEs.
Once completed, you can either be notified by EVC via a callback or periodically poll EVC for the final job results.
Deep research jobs usually take about 1-2 hours to complete, depending on the quantity of unknown CVEs.
Technical Details
If you have 1-100 CVEs per query...
Use the HTTP POST /searchendpoint with the application/json content type.
Where
typeis set to"query"andqueryis set to the set of CVEs you want to search forEVC will provide the initial search results along with a
job_id, corresponding to the deep research job to analyze any previously unknown CVEs.
To check when a deep research job is complete, periodically poll the HTTP GET /search?job_id=endpoint with your corresponding job_id.
When the
statusfield is either"done"or"rejected", then the deep research job is complete.Once complete, the response to this call will be the complete results of all corresponding CVEs in your original
query.
(Optional) Instead of polling, you can request to be notified via a callback when the deep research job completes.
To enable this, specify a
callback_urlalong withcallback_headervalues (that EVC can use authenticate to your callback service)Once the deep research job completes, EVC sends a callback as an
HTTP POSTaction to yourcallback_urlwith allcallback_headervalues set.The callback payload in this
HTTP POSTis{"job_id":"YOUR JOB ID"}.Use the
job_idto query theHTTP GET /search?job_id=endpoint to fetch the completed job results.
If you have more than 100+ CVEs per query...
Use the HTTP POST /searchendpoint with the multipart/form-data content type.
Where
typeis set to"file"andfilecontains the set of CVEs to query against.EVC will provide the initial search results along with a
job_id, corresponding to the deep research job to analyze any previously unknown CVEs.
To check when a deep research job is complete, periodically poll the HTTP GET /search?job_id=endpoint with your corresponding job_id.
When the
statusfield is either"done"or"rejected", then the deep research job is complete.Once complete, the response to this call will be the complete results of all corresponding CVEs in your original
query.
(Optional) Instead of polling, you can request to be notified via a callback when the deep research job completes.
To enable this, specify a
callback_urlalong withcallback_headervalues (that EVC can use authenticate to your callback service)Once the deep research job completes, EVC sends a callback as an
HTTP POSTaction to yourcallback_urlwith allcallback_headervalues set.The callback payload in this
HTTP POSTis{"job_id":"YOUR JOB ID"}.Use the
job_idto query theHTTP GET /search?job_id=endpoint to fetch the completed job results.
OpenAPI Swagger
API Playground
Header-based X-API-Key for authentication.
Submission type. Use query for text submissions and file for file uploads.
The text query. Required when type is query.
Optional callback URL sent by EVC as an HTTP POST to notify when processing is complete. Will contain {"job_id": "the job ID", "status": "job status"} as the HTTP body. Invalid URLs will be rejected.
""Initial search results and deep research job status.
An error occurred.
Header-based X-API-Key for authentication.
The unique identifier for the deep research job.
Number of items to return per page. Defaults to 10.
10The starting position of the returned items in the overall result set. Defaults to 0.
0Deep research job status and current response.
An error occurred.
FAQ
What source IP addresses are used by BlueRock EVC to send callbacks?
Callbacks generated by BlueRock EVC will originate from Airtable-owned dynamic IP addresses. More information about this can be found here.
For any lookups made to BlueRock EVC, should I store and use those results forever?
No. As new security mechanisms and features are added to the BlueRock platform, subsequent coverage of existing CVEs may change over time. As such, EVC will periodically reevaluate corresponding coverage as new versions of BlueRock are publicly released. Furthermore, if material details about a CVE change over time, EVC will also reevaluate corresponding coverage, accordingly.
In the API output, each corresponding element within the cve_detailsarray has an expires_at timestamp representing a future expiration date as to how long you should store intermediate results in a local cache. Once expired, it is recommended to re-query the BlueRock EVC for any new information about corresponding coverage for each CVE.
What does BlueRock EVC do about CVEs that are Rejected or Reserved?
BlueRock EVC ignores and omits any CVEs that are Rejected or Reserved from all outputs. This includes any CVEs that might look valid but are not officially published (yet). For any of these CVEs, please resubmit them to EVC once the CVE details are published.
I have other questions. What do I do?
Contact us directly for more information.
Last updated
Was this helpful?