{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":46272,"path":"security-management/vulnerability-response-workspaces/vr-va-ws-cve-exposure-assessment-api.md","title":"CVE Exposure Assessment REST API","bundle":null,"doc_type":null,"release":"australia","body":"\n# CVE Exposure Assessment REST API\n\nReview the following information before using the CVE Exposure Assessment REST API to trigger a CVE exposure assessment or create a vulnerability assessment record from an external system.\n\nTo call either operation in this API, the sn\\_vul\\_analyst.emergency\\_response role is required. If you don't pass a **source** value in the request body, the system records `VR-SNOW` so the calling system is still identifiable.\n\n## Assess CVEs\n\nAccepts one or more CVE IDs and triggers the same exposure assessment that the **Get CVE exposure** action triggers in the [Vulnerability Assessment Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response-workspaces/vr-ws-vuln-analyst-workspace.md). CVE IDs that don't match a CVE entry in your instance aren't treated as a failure: the request still succeeds, and those IDs are returned separately so you can identify them.\n\nHTTP method: \\(POST\\)\n\nAPI URL: &lt;host\\_name&gt;/api/sn\\_vul\\_analyst/exposure\\_assessment/cve\n\n**Note:** &lt;host\\_name&gt; is your ServiceNow instance name.\n\n|Request parameters|Possible values|Description|\n|------------------|---------------|-----------|\n|cveIds|Array of CVE ID strings, for example \\[\"CVE-2024-1234\", \"CVE-2024-5678\"\\]|Required. The request fails if this array is missing or empty.|\n|source|Any string that identifies the calling system, for example \"Qualys\"|Optional.|\n\nRequest example.\n\n```\n{\"cveIds\": [\"CVE-2024-1234\", \"CVE-2024-5678\"], \"source\": \"Qualys\"}\n```\n\nResponse example. **existingCves** lists CVE IDs that were already tracked for exposure before this call, and **newCves** lists the ones this call newly enabled. **jobStatusLink** is an HTML link, not a plain URL: parse the `href` attribute if you need the link target programmatically.\n\n```\n{\n  \"result\": {\n    \"notFoundCveIds\": [\"CVE-2024-9999\"],\n    \"existingCves\": [\"CVE-2024-1234\"],\n    \"newCves\": [\"CVE-2024-5678\"],\n    \"jobStatusLink\": \"<a href=/nav_to.do?uri=sn_sec_cmn_background_job.do%3Fsys_id%3D... target=\\\"_blank\\\">View Status</a>\"\n  }\n}\n```\n\nIf **cveIds** isn't a non-empty array, the API rejects the request with an `HTTP 400` error.\n\n## Create a vulnerability assessment\n\nCreates a vulnerability assessment record the same way the **Create Vulnerability Assessment** action does in the [Vulnerability Assessment Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response-workspaces/vr-ws-vuln-analyst-workspace.md). Use this operation to create the record only, then use [Perform an assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response-workspaces/perform-initial-assesment.md) \\(or the Assess CVEs operation above\\) to run the assessment.\n\nHTTP method: \\(POST\\)\n\nAPI URL: &lt;host\\_name&gt;/api/sn\\_vul\\_analyst/exposure\\_assessment/vulnerability\\_assessment\n\n**Note:** &lt;host\\_name&gt; is your ServiceNow instance name.\n\n|Request parameters|Possible values|Description|\n|------------------|---------------|-----------|\n|title|String|Required. Title of the vulnerability assessment record.|\n|cve|A single CVE ID, for example \"CVE-2024-1234\"|Optional. Associates the CVE as the **Primary CVE** on the new record. The request fails if the CVE ID doesn't match an existing record, or if there's already an active \\(non-closed\\) vulnerability assessment for that CVE. The error doesn't return the existing record's sys\\_id, so check for an existing assessment first if you need to find it.|\n|source|Any string that identifies the calling system, for example \"Qualys\"|Optional.|\n|autoCreateVitsAvits|true or false|Optional. Sets the **Auto-create VITs/AVITs** field on the new record. Defaults to false.|\n|priority|1, 2, 3, 4, or 5|Optional. The request fails if you pass a value outside this range.|\n\nRequest example.\n\n```\n{\"title\": \"Assess CVE-2024-1234\", \"cve\": \"CVE-2024-1234\", \"source\": \"Qualys\", \"autoCreateVitsAvits\": false, \"priority\": \"2\"}\n```\n\nOn success, the API returns an `HTTP 201` status and the sys\\_id of the new record.\n\n```\n{\n  \"result\": {\n    \"sysId\": \"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6\"\n  }\n}\n```\n\nIf **title** is missing, **priority** is outside the valid range, **cve** doesn't match an existing CVE, or an active assessment already exists for that CVE, the API rejects the request with an `HTTP 400` error and an error message describing which check failed.\n\n**Related topics**  \n\n\n[Create a vulnerability assessment record](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response-workspaces/create-vuln-assessment.md)\n\n[Perform an assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response-workspaces/perform-initial-assesment.md)\n\n[Add CVEs to assess exposure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response-workspaces/vr-ws-add-cve.md)\n\n"}}