CVE Exposure Assessment REST API

Review the following information before using the CVE Exposure Assessment REST API to trigger a CVE exposure assessment or create a vulnerability assessment record from an external system.

To call either operation in this API, the sn_vul_analyst.emergency_response role is required. If you don’t pass a source value in the request body, the system records VR-SNOW so the calling system is still identifiable.

Assess CVEs

Accepts one or more CVE IDs and triggers the same exposure assessment that the Get CVE exposure action triggers in the Vulnerability Assessment Workspace. CVE IDs that don’t match a CVE entry in your instance aren’t treated as a failure: the request still succeeds, and those IDs are returned separately so you can identify them.

HTTP method: (POST)

API URL: <host_name>/api/sn_vul_analyst/exposure_assessment/cve

Note: <host_name> is your ServiceNow instance name.

Request parameters Possible values Description cveIds Array of CVE ID strings, for example [“CVE-2024-1234”, “CVE-2024-5678”] Required. The request fails if this array is missing or empty. source Any string that identifies the calling system, for example “Qualys” Optional.

Request example.

{"cveIds": ["CVE-2024-1234", "CVE-2024-5678"], "source": "Qualys"}

Response example. existingCves lists CVE IDs that were already tracked for exposure before this call, and newCves lists the ones this call newly enabled. jobStatusLink is an HTML link, not a plain URL: parse the href attribute if you need the link target programmatically.

{
  "result": {
    "notFoundCveIds": ["CVE-2024-9999"],
    "existingCves": ["CVE-2024-1234"],
    "newCves": ["CVE-2024-5678"],
    "jobStatusLink": "<a href=/nav_to.do?uri=sn_sec_cmn_background_job.do%3Fsys_id%3D... target=\"_blank\">View Status</a>"
  }
}

If cveIds isn’t a non-empty array, the API rejects the request with an HTTP 400 error.

Create a vulnerability assessment

Creates a vulnerability assessment record the same way the Create Vulnerability Assessment action does in the Vulnerability Assessment Workspace. Use this operation to create the record only, then use Perform an assessment (or the Assess CVEs operation above) to run the assessment.

HTTP method: (POST)

API URL: <host_name>/api/sn_vul_analyst/exposure_assessment/vulnerability_assessment

Note: <host_name> is your ServiceNow instance name.

Request parameters Possible values Description title String Required. Title of the vulnerability assessment record. cve A single CVE ID, for example “CVE-2024-1234” Optional. Associates the CVE as the Primary CVE on the new record. The request fails if the CVE ID doesn’t match an existing record, or if there’s already an active (non-closed) vulnerability assessment for that CVE. The error doesn’t return the existing record’s sys_id, so check for an existing assessment first if you need to find it. source Any string that identifies the calling system, for example “Qualys” Optional. autoCreateVitsAvits true or false Optional. Sets the Auto-create VITs/AVITs field on the new record. Defaults to false. priority 1, 2, 3, 4, or 5 Optional. The request fails if you pass a value outside this range.

Request example.

{"title": "Assess CVE-2024-1234", "cve": "CVE-2024-1234", "source": "Qualys", "autoCreateVitsAvits": false, "priority": "2"}

On success, the API returns an HTTP 201 status and the sys_id of the new record.

{
  "result": {
    "sysId": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6"
  }
}

If title is missing, priority is outside the valid range, cve doesn’t match an existing CVE, or an active assessment already exists for that CVE, the API rejects the request with an HTTP 400 error and an error message describing which check failed.

Related topics

Create a vulnerability assessment record

Perform an assessment

Add CVEs to assess exposure