CVE Radar exposes a stateless JSON REST API (OpenAPI 3.1).
| Where | URL |
|---|---|
| Running app | http://localhost:3001/api/openapi.json |
| Production | https://<your-host>/api/openapi.json |
| Docs site (static copy) | extended-docs asset |
| Interactive UI | API Explorer |
Version in GET /api/health matches package.json (e.g. 1.1.0).
Server middleware may return 429 with code: "RATE_LIMITED" on /api/scan and /api/watch (separate buckets; /api/scan/validate exempt). Documented in extended-docs ch. 06 API and 07 Configuration.