Every page on this site is drawn by a public JSON API, and you can call the same endpoints — no key, no sign-up, no rate limit, open CORS. 83 documented endpoints; 81 of them you can run from this page.
no auth
Base URLhttps://mitre-explorer.org/api/v1
Authnone — no key, no sign-up, no account, no header
CORSAccess-Control-Allow-Origin: * — browser dashboards can read it directly
Rate limitnone on /api/v1. Only POST /api/a2a (50 requests/day per IP) and POST /api/v1/profile/submit are metered.
Errors{ error, code } with a 4xx status. An unusable filter value fails loudly rather than being dropped.
Pagination — read this once
Every LIST endpoint takes ?page= (1-based, max 100) and ?limit= (max 5000, default 50 — except /applications and /assets (200), /applications/{...} (100) and /relationships/{attackId} (500), which answer 400 above their own cap), and answers with
There is no ?offset=. An unknown query parameter is IGNORED, so ?offset=50 silently returns page 1.
The ?version= contract
Add ?version= to /cves, /cves/{cveId}, /applications, /applications/{vendor}/{product}, /packages, /packages/{ecosystem}/{name} and /ghsa/{ghsaId}. It is a SUBSTRING/TEXT match on the affected-version range, not a semantic "is this version vulnerable" verdict. On the LIST endpoints it REQUIRES product context (app for /cves; search or vendor for /applications; ecosystem or q for /packages), else HTTP 400.
The same data is served to AI clients over MCP and to agents over A2A — Open MCP has the tool catalogue. Machine-readable orientation for crawlers and models lives at /llms.txt.
83 of 83 endpoints
ATT&CK core · 18
Techniques, tactics, malware, mitigations, data sources, the matrix and cross-domain search.
Threat actors · 9
ATT&CK groups and campaigns, the ThaiCERT/ETDA actor set, and the sectors they target.
CTI feeds · 8
Reports, IOCs, Sigma rules, Atomic tests and the per-technique intelligence rollup.
Vulnerabilities · 8
CVEs with CVSS, EPSS and KEV, CAPEC patterns, and the vendor products they affect.
Supply chain · 8
GHSA + OSV advisories, packages and per-ecosystem dashboards.
Frameworks · 20
OWASP, NIST CSF and 800-53, ISO 27001, D3FEND, Engage, RE&CT, VERIS and cloud controls.
Compliance · 8
Regulatory regimes bridged to ATT&CK through the Secure Controls Framework.
ICS / OT · 3
ATT&CK for ICS assets and the Purdue model they are placed on.
Threat profile · 1
The ranked briefing the /profile page renders, as data.