Documentation

Authenticate

The console uses your session. Scripts send an API key as a bearer token. Admin pages and their endpoints accept an admin session only; an API key is refused there.

curl -H "Authorization: Bearer tl_<your key>" https://<host>/api/v1/health

Read errors the same way everywhere

Every error is { "error": { "code", "message" } }. A validation error also lists the fields.

VALIDATION_FAILED

The request did not match its schema. The body lists the fields.

UNAUTHORIZED

No valid session or API key.

FORBIDDEN

Signed in, but not allowed to do this.

NOT_FOUND

No such route or record.

CONFLICT

The request contradicts the current state.

PAYLOAD_TOO_LARGE

The body is over the limit for this route.

RATE_LIMITED

Too many requests. Wait for the number of seconds in retry-after.

INTERNAL_ERROR

Something failed on our side. The message is fixed.

Rate limits and timing

A limited request returns 429 with a retry-after header in seconds. Every response carries Server-Timing, and cached responses say so in x-cache.

Terms you will see

CVE

A publicly disclosed vulnerability, named CVE-YYYY-NNNN.

CVSS

The severity score and vector for a CVE, with a severity label from none to critical.

EPSS

The probability, from FIRST, that a CVE will be exploited, with its percentile.

KEV

CISA Known Exploited Vulnerabilities: exploitation is confirmed, so treat these as urgent.

CWE

The weakness class a CVE belongs to.

CPE

A product name and version range, used to match your software to CVEs.

SBOM

A software bill of materials. Upload CycloneDX or SPDX to see which components are affected.