> ## Documentation Index > Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get the platform advisory page for one CVE (browser session) > The parsed NVD/OSV advisory record for a CVE in one of three states (fetched, pending, missing - an error state carries the reason), the platform's CISA KEV / EPSS intelligence for it, and the organisation's own exposure. A CVE the platform has not read yet is reported pending and queued for the vulnerability_advisories loop, so callers poll until it is fetched or missing. ## OpenAPI ````yaml https://platform.ankra.app/openapi.json get /org/security/advisories/{cve_id} openapi: 3.1.0 info: title: Ankra Platform API version: v1 description: >- The Ankra platform HTTP contract. The /api/v1 surface is the public, bearer-authenticated API used by the Ankra CLI, MCP clients and automation; send a personal or service API token as `Authorization: Bearer `. Browser routes under /org and /chat are served on api.platform.ankra.app (each declares that server); they and /oauth/access authenticate with the ankra_session cookie, and mutations also require the X-Ankra-CSRF header. Every operation declares the credential it accepts, and no operation is served without one. This document is published deliberately: it describes the contract only and carries no organisation data or credentials. Report security issues to security@ankra.ai (see /.well-known/security.txt). servers: - url: https://platform.ankra.app security: - BearerAuth: [] tags: - name: Onboarding description: >- Generate a first website from a prompt and deploy it to a new organisation's cluster. - name: Access Gate description: >- Private service sign-in and membership checks for trusted Ankra proxy relays. - name: Canvas Datasets description: >- Read the fixed, named datasets canvas dashboards bind their charts, tables and stats to. - name: Canvases description: >- Keep dashboards and pages in the organisation's canvas library, with revision history, undo and pins. - name: Canvas Pages description: >- Publish a chat canvas artifact at a public pages address and take it down again. - name: Cloud Delegation description: >- Platform browser consent and organisation-bound connections for Ankra Cloud. - name: Organisation IAM description: >- Custom organisation roles and scoped role assignments for member and service-account identities. - name: Clusters description: Create, inspect and manage clusters, and the stacks deployed on them. - name: Managed Clusters description: Provider-managed control planes, driven through one common surface. - name: Imported Clusters description: Clusters that already existed and were connected to Ankra. - name: Cluster Access description: Kubeconfigs, service-account tokens and per-cluster access grants. - name: Kubernetes description: Read and act on the Kubernetes objects inside a cluster. - name: AWS Clusters description: >- Provision and manage self-managed k3s / kubeadm clusters on AWS EC2 in your own VPC. - name: Ankra Cloud Clusters description: >- Provision and manage self-managed kubeadm / k3s clusters on Ankra Cloud servers: a private network, a NAT router and a bastion per cluster. - name: DigitalOcean Clusters description: Provision and manage DigitalOcean Kubernetes clusters. - name: Hetzner Clusters description: Provision and manage Hetzner Kubernetes clusters. - name: OVH Clusters description: Provision and manage OVH Kubernetes clusters. - name: Scaleway Clusters description: Provision and manage Scaleway Kapsule clusters. - name: UpCloud Clusters description: Provision and manage UpCloud Kubernetes clusters. - name: Applications description: Deploy, configure and observe applications across the fleet. - name: Pipelines description: >- Pipeline definitions, the approval of the authority they declare, and the caches pipelines keep between runs. - name: Workspaces description: >- Personal workspaces on the organisation's CI pool where a repository's heavy commands run, and the repository profiles they are built from. - name: Deploy Targets description: >- Environments, the hosts registered to receive deployments, and the releases deployed to them. - name: Deploy Provenance description: >- Whether an application's deploys verify signed provenance from the organisation's own pipeline, the keys that provenance is signed with, and a dry-run that verifies images without deploying. - name: Backups description: >- Backup vaults, restore points, protection posture and captures for stacks and application deployments; a completed capture is not a verified restore. - name: Stack Profiles description: Reusable stack definitions, their versions and sharing. - name: Services description: >- Versioned service packages and explicit sharing. Runtime admission is separate from publication. - name: Charts description: Browse the chart catalogue behind stacks and addons. - name: Helm description: Helm registries, credentials and the charts they expose. - name: Executions description: Long-running platform executions and their jobs. - name: Operations description: Cancel in-flight cluster operations and their jobs. - name: Chat description: Conversational sessions, plans and confirmable actions. - name: AI Management description: >- Customer agent lifecycle, authenticated identity and organisation automation controls. - name: AI Agent Runs description: Autonomous agent runs and their outcomes. - name: AI Tickets description: The AI ticket board, its sync connections and settings. - name: AI Playbooks description: Reusable playbooks the AI lanes execute. - name: AI Conditions description: Conditions that gate AI autonomy. - name: AI Remediation description: >- The organisation's auto-remediation policy: what the AI lanes may fix by themselves, and who approves the rest. - name: AI Engineering Handoffs description: Work the AI lanes escalate to a human engineer. - name: AI Environment description: The environment and base stacks AI demos deploy into. - name: AI Memory description: >- What the assistant has learned about you: your cross-session memories and learned profile. - name: MCP Servers description: >- Register the MCP servers the organisation's AI agents can call, choose their tools and grant them to roles. - name: Security description: Findings, advisories, SBOMs, compliance and posture. - name: Cost description: Cluster and fleet cost, rate cards and cost settings. - name: Decisions description: >- The decision ledger behind the Security and Cost queues: proposals a surface computed, the approve and set-aside decisions people took on them, and the receipts of running them. - name: Usage description: >- What your organisation used of Ankra - vCPU-hours, playgrounds, managed services, hosted logs and metrics, and AI - per meter and period, with how completely it was measured and whether a published rate applies. - name: Billing description: Subscription and spend caps. - name: Organisation description: Members, invitations, audit logs and organisation settings. - name: Account description: >- Your own account: the contact email Ankra mails when it differs from your sign-in address. - name: Account Tokens description: Personal access tokens for the API and CLI. - name: Credentials description: The shared credential store. - name: AWS Credentials description: >- AWS credentials: access keys or CloudFormation-onboarded STS roles for cost, EKS and self-managed provisioning. - name: Ankra Cloud Credentials description: >- Ankra Cloud API tokens, shared by the self-managed and managed Ankra Cloud lanes. - name: Azure Credentials description: Azure credentials and SSH keys. - name: DigitalOcean Credentials description: DigitalOcean credentials and SSH keys. - name: Hetzner Credentials description: Hetzner credentials and SSH keys. - name: HPE Morpheus Credentials description: HPE Morpheus credentials and the capacity and quotas behind them. - name: OVH Credentials description: OVH credentials and SSH keys. - name: Proxmox Credentials description: Proxmox VE credentials and the capacity and quotas behind them. - name: Scaleway Credentials description: Scaleway credentials. - name: UpCloud Credentials description: UpCloud credentials and SSH keys. - name: Data Source Credentials description: Credentials for metrics and log sources. - name: DNS Credentials description: Credentials for DNS providers. - name: Object Storage Buckets description: >- Buckets Ankra creates and manages on an organisation's own provider credentials. - name: DNS description: DNS zones and records, including custom organisation zones. - name: Cloudflare description: Cloudflare domains and the credentials behind them. - name: Avura description: >- The linked Avura organization, the domains it shares with Ankra Platform, and their DNS records. - name: Variables description: Organisation- and cluster-scoped variables. - name: Secret Slots description: >- Store secrets in Vault and reference them by ${SECRET_SLOT:} sentinel instead of by value. - name: SOPS description: Encrypt and decrypt values with the organisation SOPS config. - name: Alerts description: Alert integrations and ingest credentials. - name: Notifications description: Notification routes and their delivery targets. - name: Support description: Support tickets. - name: AI Settings description: Organisation AI provider, model catalog and per-function model settings paths: /org/security/advisories/{cve_id}: get: tags: - Security summary: Get the platform advisory page for one CVE (browser session) description: >- The parsed NVD/OSV advisory record for a CVE in one of three states (fetched, pending, missing - an error state carries the reason), the platform's CISA KEV / EPSS intelligence for it, and the organisation's own exposure. A CVE the platform has not read yet is reported pending and queued for the vulnerability_advisories loop, so callers poll until it is fetched or missing. operationId: get_security_advisory parameters: - in: path name: cve_id required: true schema: type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/SecurityAdvisoryResponse' description: Successful response '400': content: application/json: schema: $ref: '#/components/schemas/SecurityDetailError' description: Invalid CVE id '403': content: application/json: schema: $ref: '#/components/schemas/SecurityPermissionDenied' description: Permission or CSRF denied '404': content: application/json: schema: $ref: '#/components/schemas/SecurityDetailError' description: Organization-scoped resource not found '422': content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' description: Request validation error '500': content: application/json: schema: $ref: '#/components/schemas/SecurityDetailError' description: Internal server error security: - SessionCookie: [] servers: - url: https://api.platform.ankra.app components: schemas: SecurityAdvisoryResponse: description: >- The advisory page for one CVE. status is fetched (advisory present), pending (not read yet - queued, poll again), missing (neither NVD nor OSV holds a record) or error (a source could not be read; fetch_error says which). properties: advisory: anyOf: - $ref: '#/components/schemas/SecurityAdvisoryRecord' - type: 'null' cve_id: type: string fetch_error: anyOf: - type: string - type: 'null' fleet: $ref: '#/components/schemas/SecurityAdvisoryFleet' intelligence: $ref: '#/components/schemas/SecurityExploitIntelligence' intelligence_status: $ref: '#/components/schemas/SecurityIntelligenceStatus' last_attempt_at: anyOf: - type: string format: date-time - type: 'null' requested_at: anyOf: - type: string format: date-time - type: 'null' sources: $ref: '#/components/schemas/SecurityAdvisorySources' status: enum: - fetched - pending - missing - error type: string required: - cve_id - status - fetch_error - requested_at - last_attempt_at - sources - advisory - intelligence - intelligence_status - fleet type: object SecurityDetailError: properties: detail: type: string required: - detail type: object SecurityPermissionDenied: properties: detail: enum: - permission_denied type: string permission: type: string scope_type: type: string required: - detail - permission - scope_type type: object HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' title: Detail type: array title: HTTPValidationError type: object SecurityAdvisoryRecord: description: >- The parsed public advisory record, merged from NVD (authoritative) and OSV. properties: affected: items: $ref: '#/components/schemas/SecurityAdvisoryAffected' type: array aliases: type: array items: type: string cvss_score: anyOf: - type: number - type: 'null' cvss_severity: anyOf: - type: string - type: 'null' cvss_vector: anyOf: - type: string - type: 'null' cvss_version: anyOf: - type: string - type: 'null' cwe_ids: type: array items: type: string description: anyOf: - type: string - type: 'null' last_modified_at: anyOf: - type: string format: date-time - type: 'null' metrics: items: $ref: '#/components/schemas/SecurityAdvisoryMetric' type: array published_at: anyOf: - type: string format: date-time - type: 'null' references: items: $ref: '#/components/schemas/SecurityAdvisoryReference' type: array source_identifier: anyOf: - type: string - type: 'null' ssvc: anyOf: - $ref: '#/components/schemas/SecurityAdvisorySSVC' - type: 'null' title: anyOf: - type: string - type: 'null' vulnerability_status: anyOf: - type: string - type: 'null' required: - title - description - source_identifier - vulnerability_status - published_at - last_modified_at - cvss_score - cvss_severity - cvss_vector - cvss_version - metrics - cwe_ids - references - affected - aliases - ssvc type: object SecurityAdvisoryFleet: description: >- The organisation's current findings for the CVE (one per package) and the totals across them. properties: affected_clusters: type: integer affected_workloads: type: integer findings: items: $ref: '#/components/schemas/SecurityFindingSummary' type: array fixable_occurrences: type: integer occurrences: type: integer required: - findings - occurrences - fixable_occurrences - affected_clusters - affected_workloads type: object SecurityExploitIntelligence: description: CISA KEV and EPSS intelligence for one CVE. properties: known_exploited: type: boolean kev_date_added: anyOf: - type: string - type: 'null' kev_due_date: anyOf: - type: string - type: 'null' kev_ransomware_use: type: boolean epss_score: anyOf: - format: double type: number - type: 'null' epss_percentile: anyOf: - format: double type: number - type: 'null' kev_vendor_project: anyOf: - type: string - type: 'null' kev_product: anyOf: - type: string - type: 'null' kev_vulnerability_name: anyOf: - type: string - type: 'null' kev_required_action: anyOf: - type: string - type: 'null' required: - epss_percentile - epss_score - kev_date_added - kev_due_date - kev_product - kev_ransomware_use - kev_required_action - kev_vendor_project - kev_vulnerability_name - known_exploited type: object SecurityIntelligenceStatus: properties: epss_synced_at: anyOf: - type: string format: date-time - type: 'null' kev_listed: type: integer kev_synced_at: anyOf: - type: string format: date-time - type: 'null' required: - kev_synced_at - epss_synced_at - kev_listed type: object SecurityAdvisorySources: description: >- When each public source was last read for this CVE and where its own page lives. properties: nvd_fetched_at: anyOf: - type: string format: date-time - type: 'null' nvd_url: type: string osv_fetched_at: anyOf: - type: string format: date-time - type: 'null' osv_url: type: string required: - nvd_fetched_at - osv_fetched_at - nvd_url - osv_url type: object ValidationError: properties: loc: items: anyOf: - type: string - type: integer title: Location type: array msg: title: Message type: string type: title: Error Type type: string required: - loc - msg - type title: ValidationError type: object SecurityAdvisoryAffected: description: >- One affected product (source nvd, from the CNA's affected data) or package (source osv). properties: collection_url: type: string default_status: type: string ecosystem: type: string package: type: string product: type: string ranges: items: $ref: '#/components/schemas/SecurityAdvisoryVersionRange' type: array repository: type: string source: type: string vendor: type: string versions: type: array items: type: string required: - source - ranges type: object SecurityAdvisoryMetric: description: >- One CVSS assessment NVD carries for the CVE (Primary is NVD's own, Secondary the CNA's). properties: attack_complexity: type: string attack_vector: type: string availability_impact: type: string base_score: type: number base_severity: type: string confidentiality_impact: type: string exploitability_score: anyOf: - type: number - type: 'null' impact_score: anyOf: - type: number - type: 'null' integrity_impact: type: string privileges_required: type: string scope: type: string source: type: string type: type: string user_interaction: type: string vector: type: string version: type: string required: - source - type - version - vector - base_score - base_severity - exploitability_score - impact_score type: object SecurityAdvisoryReference: properties: source: type: string tags: type: array items: type: string url: type: string required: - url - source - tags type: object SecurityAdvisorySSVC: description: CISA's SSVC decision for the CVE as republished by NVD. properties: automatable: type: string exploitation: type: string technical_impact: type: string timestamp: anyOf: - type: string format: date-time - type: 'null' required: - exploitation - automatable - technical_impact - timestamp type: object SecurityFindingSummary: properties: affected_clusters: type: integer affected_workloads: type: integer cve_id: type: string disposition_counts: $ref: '#/components/schemas/SecurityDispositionCounts' first_seen_at: type: string format: date-time fixable_occurrences: type: integer id: type: string format: uuid last_seen_at: type: string format: date-time occurrences: type: integer package_name: type: string package_type: type: string primary_link: anyOf: - type: string - type: 'null' provider: type: string score: anyOf: - format: double type: number - type: 'null' severity: type: string title: anyOf: - type: string - type: 'null' known_exploited: type: boolean kev_date_added: anyOf: - type: string - type: 'null' kev_due_date: anyOf: - type: string - type: 'null' kev_ransomware_use: type: boolean epss_score: anyOf: - format: double type: number - type: 'null' epss_percentile: anyOf: - format: double type: number - type: 'null' kev_vendor_project: anyOf: - type: string - type: 'null' kev_product: anyOf: - type: string - type: 'null' kev_vulnerability_name: anyOf: - type: string - type: 'null' kev_required_action: anyOf: - type: string - type: 'null' required: - id - provider - cve_id - package_type - package_name - severity - title - primary_link - score - first_seen_at - last_seen_at - occurrences - affected_clusters - affected_workloads - fixable_occurrences - disposition_counts - known_exploited - kev_date_added - kev_due_date - kev_ransomware_use - epss_score - epss_percentile - kev_vendor_project - kev_product - kev_vulnerability_name - kev_required_action type: object SecurityAdvisoryVersionRange: properties: fixed: type: string introduced: type: string last_affected: type: string status: type: string type: object SecurityDispositionCounts: properties: accepted_risk: type: integer acknowledged: type: integer open: type: integer resolved: type: integer required: - open - acknowledged - accepted_risk - resolved type: object securitySchemes: BearerAuth: bearerFormat: PAT scheme: bearer type: http SessionCookie: description: Browser session. Mutations also require X-Ankra-CSRF. in: cookie name: ankra_session type: apiKey ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.