VulDB Getting Started: Quickstart Guide & API Keys (2026)

Getting started overview

Integrating with the VulDB API involves a sequence of steps to establish authenticated access and retrieve vulnerability data. The API is designed with a RESTful architecture, providing JSON responses for various queries related to vulnerabilities, exploits, and threat intelligence. The initial setup requires creating a user account, subscribing to an API plan (or utilizing the limited public access if applicable), and generating an API key. This key serves as the primary authentication mechanism for all subsequent API calls. After obtaining the key, developers can construct HTTP requests to specific endpoints, including those for searching vulnerabilities or retrieving detailed vulnerability records, typically using tools like curl or programming language libraries.

This guide outlines the process, from account creation to executing a first successful API call. It addresses common setup procedures and provides a foundational understanding for further integration with VulDB's threat intelligence services. For detailed API specifications and comprehensive endpoint documentation, refer to the official VulDB API reference.

Quick Reference Steps

Create an account and get keys

To access the VulDB API, an account is required. VulDB offers a limited public access tier for general vulnerability details, but programmatic access via the API typically necessitates a paid subscription. API plans start at 199 EUR/month for basic access, with increased request limits and features available in higher tiers. Enterprise options are also available for specific organizational needs. The process for obtaining an API key is integrated into the user account management system.

1. Sign Up for a VulDB Account: Navigate to the VulDB homepage and locate the registration option. Follow the prompts to create a new user account by providing an email address and setting a password. Account creation is a prerequisite for managing subscriptions and API keys.
2. Select an API Plan: After registration, consider your access needs. If your requirements exceed the capabilities of the public access, visit the VulDB pricing page to review available API plans. Select a plan that aligns with your anticipated usage, such as the "API Basic" tier, and complete the subscription process.
3. Generate Your API Key: Once your account is active and any necessary subscription is confirmed, log in to the VulDB portal. The API key generation is typically found within a user's profile settings or a dedicated "API Access" section. Detailed instructions for key generation are provided on the VulDB API authentication page. The generated API key is a unique string that identifies your application and authorizes its requests. Store this key securely, as it grants access to your API quota and data.

Your first request

After obtaining your API key, you can make your first authenticated request to the VulDB API. The API uses a RESTful design, expecting HTTP GET requests and returning JSON responses. Authentication is handled by passing your API key as a header or query parameter, as specified in the VulDB API documentation. A common first step is to query for recent vulnerabilities or search for a specific CVE (Common Vulnerabilities and Exposures) ID.

For this example, we will retrieve information about a known vulnerability. Replace YOUR_API_KEY with the key you generated.

Using curl

The curl command-line tool is a common method for testing REST APIs. Execute the following command in your terminal to query for a specific vulnerability (e.g., CVE-2021-44228, also known as Log4Shell):

curl -X GET \
  "https://vuldb.com/?api&k=YOUR_API_KEY&q=cve&id=CVE-2021-44228" \
  -H "Accept: application/json"

This request sends your API key (k=YOUR_API_KEY) and the query parameters (q=cve&id=CVE-2021-44228) to the VulDB API endpoint. The -H "Accept: application/json" header requests a JSON response.

Using Python

For programmatic access, Python with the requests library is a common choice. Ensure you have requests installed (pip install requests).

import requests
import json

API_KEY = "YOUR_API_KEY"
BASE_URL = "https://vuldb.com/?api"

params = {
    "k": API_KEY,
    "q": "cve",
    "id": "CVE-2021-44228"
}

headers = {
    "Accept": "application/json"
}

try:
    response = requests.get(BASE_URL, params=params, headers=headers)
    response.raise_for_status()  # Raise an HTTPError for bad responses (4xx or 5xx)
    data = response.json()
    print(json.dumps(data, indent=2))

except requests.exceptions.HTTPError as errh:
    print(f"HTTP Error: {errh}")
except requests.exceptions.ConnectionError as errc:
    print(f"Error Connecting: {errc}")
except requests.exceptions.Timeout as errt:
    print(f"Timeout Error: {errt}")
except requests.exceptions.RequestException as err:
    print(f"An error occurred: {err}")

This Python script constructs a similar GET request, authenticates with your API key, and prints the pretty-printed JSON response. The response.raise_for_status() line is crucial for error handling, as it will automatically raise an exception for HTTP error codes.

Expected Response Structure

A successful request will return a JSON object containing vulnerability details. The structure will vary slightly depending on the query, but generally includes fields like response_code, message, and a result object with the requested data. For example, a CVE query might return:

{
  "response_code": 200,
  "message": "OK",
  "result": [
    {
      "vuldb_id": "175852",
      "cve_id": "CVE-2021-44228",
      "title": "Apache Log4j RCE (Log4Shell)",
      "discovery_date": "2021-12-09 10:00:00",
      "vulnerability_type": "remote code execution",
      "cvss3_score": "10.0",
      "impact": "critical",
      "solution": "Upgrade to Log4j 2.15.0 or later",
      "references": [
        "https://logging.apache.org/log4j/2.x/security.html"
      ],
      "permalink": "https://vuldb.com/?id.175852"
    }
  ]
}

This example shows a simplified response for CVE-2021-44228, providing key details about the vulnerability.

Common next steps

Once you have successfully made your first API call to VulDB, there are several common next steps you might consider for further integration and utilization of the vulnerability intelligence:

• Explore Additional Endpoints: Review the VulDB API documentation to discover other available endpoints. These might include queries for specific vendors, products, or timeframes, as well as accessing exploit information or threat intelligence feeds. Understanding the full range of API capabilities will enable you to retrieve the specific data required for your application.
• Implement Robust Error Handling: Beyond basic success checks, implement comprehensive error handling in your application. The API will return various HTTP status codes and JSON error messages for issues such as invalid API keys, rate limit breaches, or malformed requests. Properly handling these errors is crucial for building a resilient integration.
• Manage Rate Limits: Be aware of the rate limits associated with your VulDB API plan. Exceeding these limits will result in temporary blocking of your API key. Implement mechanisms such as exponential backoff strategies to gracefully handle rate limit responses and prevent service interruptions. Information on rate limits is typically found in the VulDB API reference.
• Integrate into Security Workflows: Begin integrating VulDB data into your existing security tools and workflows. This could involve populating a security information and event management (SIEM) system with vulnerability data, prioritizing patch management efforts based on VulDB's threat intelligence, or enriching incident response processes with contextual vulnerability information.
• Monitor for New Vulnerabilities: Develop a strategy to regularly query the API for newly discovered vulnerabilities relevant to your infrastructure. This proactive monitoring can help you stay informed about emerging threats.
• Secure API Key Storage: Ensure your API key is stored securely, ideally using environment variables or a dedicated secret management solution, rather than hardcoding it directly into your application's source code. This practice mitigates the risk of unauthorized access if your code repository is compromised. Security best practices for API keys are also discussed by providers like Cloudflare for API key properties.

Troubleshooting the first call

When making your initial API request, you might encounter issues. Here are common problems and their solutions:

• Invalid API Key (HTTP 401 Unauthorized):
  • Problem: The API returns a 401 status code or a message indicating an invalid key.
  • Solution: Double-check that you have copied the API key correctly. Ensure there are no leading or trailing spaces. Verify that your API key is active and associated with a valid subscription on the VulDB portal.
• Rate Limit Exceeded (HTTP 429 Too Many Requests):
  • Problem: The API responds with a 429 status code.
  • Solution: You have made too many requests within a specific timeframe for your API plan. Wait for the rate limit window to reset (often a few minutes) and try again. For production applications, implement proper rate limiting management, such as exponential backoff, to prevent hitting this limit. Review your plan's rate limits on the VulDB API documentation.
• Bad Request (HTTP 400 Bad Request):
  • Problem: The API returns a 400 status code, indicating an issue with your request parameters.
  • Solution: Carefully review your query parameters (e.g., q, id) against the VulDB API reference. Ensure all required parameters are present and correctly formatted. Check for typos in parameter names or values.
• Network or Connection Issues:
  • Problem: Your client (curl or Python script) reports a connection error or timeout.
  • Solution: Verify your internet connection. Check if there are any firewalls or proxies that might be blocking outbound connections to vuldb.com. Try accessing vuldb.com in a web browser to confirm general connectivity.
• Incorrect Endpoint or Method:
  • Problem: You receive an unexpected response or a 404 Not Found error.
  • Solution: Confirm that you are using the correct base URL (https://vuldb.com/?api) and that you are making a GET request, as specified in the VulDB API documentation.
• JSON Parsing Errors:
  • Problem: Your application fails to parse the API response as JSON.
  • Solution: Ensure your request includes the Accept: application/json header. If the server returns an HTML or plain text error page instead of JSON, it's often an indication of another underlying issue (e.g., authentication, bad request) that the server is communicating in a non-JSON format. Inspect the raw response content to diagnose.