VALTERSIT API

Base URL: /api/v1/ · Auth endpoints: /auth/

No account needed — sandbox key

Don't want to sign up yet? This shared, free key always returns the same 10 fixed demonstration CVE records (never real data, never billed) — enough to see the exact response shape and wire up your integration before you commit to anything.

curl -H "Authorization: Bearer vit_sandbox_free_demo_key_2026" \
  "https://api.valtersit.com/api/v1/cve"

No filters needed — the sandbox key always returns the same 10 fixed records regardless of query parameters. Try a single-record lookup too: /api/v1/cve/CVE-2026-90001. Shared by everyone testing the API, so it has its own modest rate limit — fine for exploring, not meant for production traffic. Same endpoints, same response schema as real data; swap in a real key from the dashboard when you're ready.

QUICK START

Get your API key from the dashboard, then fetch critical-severity Cisco CVEs. Three lines of code, any language.

curl -H "Authorization: Bearer vit_v1_YOUR_KEY" \
  "https://api.valtersit.com/api/v1/cve?vendor=cisco&severity=critical&cvss_min=9.0"

import requests

API_KEY = "vit_v1_YOUR_KEY"
BASE_URL = "https://api.valtersit.com/api/v1"

r = requests.get(
    f"{BASE_URL}/cve",
    headers={"Authorization": f"Bearer {API_KEY}"},
    params={"vendor": "cisco", "severity": "critical", "cvss_min": 9.0},
)
r.raise_for_status()
data = r.json()
print(f"{data['total_count']} matches, {data['credits_remaining']} credits left")
for cve in data["data"]:
    print(cve["cve_id"], cve["cvss"], cve["summary"][:80])

const API_KEY = "vit_v1_YOUR_KEY";
const BASE_URL = "https://api.valtersit.com/api/v1";

const params = new URLSearchParams({
  vendor: "cisco", severity: "critical", cvss_min: "9.0",
});

const res = await fetch(`${BASE_URL}/cve?${params}`, {
  headers: { Authorization: `Bearer ${API_KEY}` },
});
if (!res.ok) throw new Error(`API error ${res.status}`);
const data = await res.json();
console.log(`${data.total_count} matches, ${data.credits_remaining} credits left`);
for (const cve of data.data) {
  console.log(cve.cve_id, cve.cvss, cve.summary.slice(0, 80));
}

Every response includes credits_remaining — no separate call needed to check your balance after a request. Full parameter list and live "Try it out" console: see /docs.

AUTHENTICATION

Two methods: API key (metered requests) or JWT Bearer (dashboard).

Authorization: Bearer vit_v1_xxxxxxxxxxxx

POST /auth/register Register. Body: {email, password}

POST /auth/login Log in. Body: {email, password}

POST /auth/refresh Refresh access token (httpOnly cookie)

POST /auth/logout Log out

GET /auth/me Account information

CVE DATABASE

Use an API key or JWT. Each request consumes credits based on records returned.

GET /api/v1/cve CVE list with filters. At least one filter required.

Parameters: vendor, severity, cvss_min, cvss_max, epss_min, has_exploit, has_patch, changed_since, published_since, limit (max 100), page

GET /api/v1/cve/{cve_id} Single CVE record

Example:

curl -H "Authorization: Bearer vit_v1_..." \ "https://api.valtersit.com/api/v1/cve?vendor=cisco&severity=critical&cvss_min=9.0&limit=10"

BILLING

GET /billing/status Plan, credit balance, top-up options

POST /billing/checkout/subscription Body: {plan: "standard"|"pro"}

POST /billing/checkout/topup Body: {credits: 250|500|1000}

POST /billing/portal Stripe billing portal URL

API KEY MANAGEMENT

GET /keys List my API keys

POST /keys Create a new key. Body: {label?}

DEL /keys/{id} Delete a key

PATCH /keys/{id} Rename a key. Body: {label?}

RESPONSE FORMAT

All responses: JSON. HTTP status codes:

`200`	OK
`201`	Created
`401`	Not authenticated
`403`	Forbidden (insufficient credits/plan limit)
`422`	Validation error
`429`	Rate limit exceeded