---
title: "Read a sourced CVE disclosure"
description: "Returns the normalized public disclosure used by Cyber and the public CVE page, linked to its stable ontology entity. Includes all retained source assessments, affected products and versions, remediation, references, and provenance. Private workspace data is excluded. The request reads stored data and does not contact providers. Missing assessments are unknown, not evidence of absence. Pass `revision` to retrieve a retained immutable disclosure. Unknown CVEs or revisions return 404; rejected records remain readable. Disclosure timestamps are Unix milliseconds, matching the public JSON representation. Source calendar dates such as EPSS `date` remain strings."
canonical: https://y2.dev/docs/api/reference/intel/getCVEDisclosureV2/
---

Endpoint Reference[Intel](https://y2.dev/docs/api/reference/intel)

# Read a sourced CVE disclosure

Returns the normalized public disclosure used by Cyber and the public CVE page, linked to its stable ontology entity. Includes all retained source assessments, affected products and versions, remediation, references, and provenance. Private workspace data is excluded. The request reads stored data and does not contact providers. Missing assessments are unknown, not evidence of absence. Pass \`revision\` to retrieve a retained immutable disclosure. Unknown CVEs or revisions return 404; rejected records remain readable. Disclosure timestamps are Unix milliseconds, matching the public JSON representation. Source calendar dates such as EPSS \`date\` remain strings.

`GET https://api.y2.dev/api/v2/cyber/cves/{cveId}`

- Operation ID: `getCVEDisclosureV2`
- Required scopes: `intel:cyber`
- Accepts x402 pay-per-request payment
- Contract: https://y2.dev/openapi.json

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `cveId` | path | `CVEIdentifier` | Yes | Canonical CVE identifier. This is not an `ent_...` identifier. |
| `revision` | query | `CVERevision` | No | SHA-256 revision from a previously returned disclosure. Omit for the current record. |

## Responses

| Status | Description | Body |
| --- | --- | --- |
| 200 | Full retained public disclosure with ontology identity and discovery links | `CVEDisclosureResponse` |
| 400 | Invalid request parameters |  |
| 401 | Missing or invalid API key |  |
| 402 | x402 payment required | `X402PaymentRequiredResponse` |
| 403 | Insufficient permissions or access denied |  |
| 404 | Resource not found |  |
| 429 | Rate limit exceeded (per-key or per-account aggregate) |  |
| 500 | Internal server error |  |

### 200 response fields

| Field | Type | Description |
| --- | --- | --- |
| `data` | `CVEDisclosureResource` |  |
| `data.cveId` | `CVEIdentifier` |  |
| `data.title` | string |  |
| `data.description` | string |  |
| `data.status` | `published`, `rejected`, `reserved` |  |
| `data.publishedAt` | `CVETime` | Unix milliseconds, or null when the source does not provide a time. |
| `data.modifiedAt` | `CVETime` | Unix milliseconds, or null when the source does not provide a time. |
| `data.metrics[]` | array of `CVEMetric` | Source-specific assessments; the primary authority leads when available. |
| `data.affected[]` | array of `CVEAffected` |  |
| `data.cpeConfigurations[]` | array of `CVECpeConfiguration` |  |
| `data.remediation[]` | array of `CVERemediation` |  |
| `data.references[]` | array of `CVEReference` |  |
| `data.cwes[]` | array of string |  |
| `data.kev` | `CVEKEV` or null |  |
| `data.epss` | `CVEEPSS` or null |  |
| `data.ssvc` | `CVESSVC` or null |  |
| `data.exploits[]` | array of `CVEExploit` |  |
| `data.sources[]` | array of `CVESource` |  |
| `data.revision` | `CVERevision` |  |
| `data.updatedAt` | integer | Unix milliseconds when this disclosure snapshot was recorded. |
| `data.id` | string |  |
| `data.type` | string |  |
| `data.links` | object |  |