EPSS (FIRST.org) API

Base URL

https://api.first.org/data/v1/epss

Authentication

No API key or account. FIRST.org publishes EPSS free for any use including commercial, asking for attribution to the EPSS project.

Rate limit

No published hard limit. Scores change once daily, so caching for a day costs nothing in accuracy and removes almost all traffic.

Pricing

Free, including commercial use, with attribution requested.

CORS

Enabled — callable directly from browser JavaScript

Official docs

Read the docs

Every request below was executed against the live API on 21 Aug 2026, and the response shown is the real body it returned — not an illustration.

curl 'https://api.first.org/data/v1/epss?cve=CVE-2021-44228'

const res = await fetch("https://api.first.org/data/v1/epss?cve=CVE-2021-44228");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

import requests

res = requests.get("https://api.first.org/data/v1/epss?cve=CVE-2021-44228", timeout=20)
res.raise_for_status()
print(res.json())

{
  "status": "OK",
  "status-code": 200,
  "version": "1.0",
  "access": "public",
  "total": 1,
  "offset": 0,
  "limit": 100,
  "data": [
    {
      "cve": "CVE-2021-44228",
      "epss": "0.999990000",
      "percentile": "1.000000000",
      "date": "2026-08-20"
    }
  ]
}

status / status-codestring / integer

FIRST's envelope. Always check these rather than only the HTTP status.

totalinteger

Number of matching records, independent of paging.

data[].cvestring

The CVE identifier.

data[].epssstring

Probability of exploitation in the next 30 days, 0 to 1, as a string. Cast before comparing.

data[].percentilestring

Rank against all scored CVEs, 0 to 1. The number to sort on when prioritising.

data[].datestring

The model run date these values come from. Scores are recomputed daily.

• Prioritise a vulnerability backlog by exploitation likelihood rather than CVSS alone
• Alert when a CVE in your estate crosses an EPSS threshold
• Chart a vulnerability's exploitation probability over time
• Combine EPSS with CISA KEV to separate predicted from confirmed exploitation
• Report patching coverage weighted by real-world risk

If EPSS (FIRST.org) does not fit, these security & auth apis cover similar ground. Every one was called before publishing, and each links to its own reference page with a working curl command and the response it returned.