API Documentation

Subdomain Center

Subdomain Center is a Shadow IT / Subdomain Intelligence API.

Endpoints without authentication (modest ratelimits, limited access)

• Returns a list of subdomains for a domain
  GET https://api.subdomain.center/?domain={DOMAIN}&engine={ENGINE}&keyword={KEYWORD}&match={MATCH}
  • domain (string | mandatory for cuttlefish/octopus, optional for ammonites): searches by any domain/subdomain
  • keyword (string | mandatory for ammonites): searches by a subdomain keyword; passing keyword without engine implies ammonites
  • engine (string | optional): choose a clustering engine
    • cuttlefish (default): clusters by domain — returns the queried host and everything beneath it
    • octopus: clusters by brand — returns domains sharing the queried domain's brand token
    • ammonites: clusters by keyword — returns hosts carrying the given keyword
  • match (string | optional): refine octopus/ammonites results
    • octopus: prefix (default, catches variants like brand-secure.com), exact, substring
    • ammonites: exact (default), prefix
  • returns up to 500 results, in random order

Endpoints with authentication (no ratelimits, full access)

• Returns a list of subdomains for a domain, with full unsampled results
  GET https://api.subdomain.center/?domain={DOMAIN}&engine={ENGINE}&keyword={KEYWORD}&match={MATCH}
  • same parameters as above
  • X-API-Key (header | mandatory): authentication code — also accepted as Authorization: Bearer {AUTH}
  • returns full, sorted results

Exploit Observer

Exploit Observer is a Vulnerability / Exploit Intelligence API.

Endpoints without authentication (no ratelimits)

• Returns a watchlist of vulnerability & exploit identifiers
  GET https://api.exploit.observer/watchlist/identifiers

• Returns a detailed watchlist of vulnerability & exploit identifiers
  GET https://api.exploit.observer/watchlist/describers

• Returns a watchlist of vulnerable technologies
  GET https://api.exploit.observer/watchlist/technologies

• Returns statistics around all vulnerabilities & exploits
  GET https://api.exploit.observer/stats

• Returns service status and the age of the currently-served dataset
  GET https://api.exploit.observer/health

Endpoints without authentication (aggressive ratelimits, 2 requests/minute per IP)

• Returns information related to a VID
  GET https://api.exploit.observer/?keyword={VID}&enrich={TRUE/FALSE}&match={MATCH}
  • keyword (string | mandatory): searches by any of the supported vulnerability identifiers
  • enrich (boolean | optional): enables enrichment with additional data points for CVE/GHSA IDs (adds EPSS + VEDAS maturity scores, correlated references, related IDs and affected products; any other field the underlying CVE-JSON5/GHSA record already carries, e.g. its own upstream aliases list, passes through unchanged)
  • match (string | optional): only applies when keyword isn't already a known identifier (a free-text/vendor-product search, or a cpe:2.3:/pkg: URI) — ignored once it resolves directly
    • substring (default): matches anywhere in the indexed key
    • prefix: matches from the start of the indexed key
    • exact: matches the indexed key exactly

Endpoints with authentication (no ratelimits)

• Returns information related to a VID — same data as the unauthenticated endpoint above, just without the rate limit (authentication does not unlock more complete results; both tiers return the identical response for a given keyword)
  GET https://api.exploit.observer/?keyword={VID}&enrich={TRUE/FALSE}&match={MATCH}

  • same parameters as above
  • X-API-Key (header | mandatory): authentication code — also accepted as Authorization: Bearer {AUTH}

• Returns non-CVE identifiers clustered under a VEDAS group, by region/source or overall
  GET https://api.exploit.observer/noncve/{ENGINE}

  • ENGINE (string | mandatory, in the path): browser (BRAVE-/CHROMIUM-/MOZILLA-), china (CNVD-/CNNVD-), russia (BDU:), europe (EUVD-), or exploitable (every VEDAS group with no CVE- member at all)
  • X-API-Key (header | mandatory): same as above — an anonymous or invalid key returns {}, not 401

Supported Vulnerability Identifiers (150+)

• A.R.P. Syndicate Vulnerability & Exploit Data Aggregation System (VEDAS) - VEDAS:OBLIVIONHAWK
• China National Vulnerability Database (CNVD) - CNVD-2024-02713
• China National Vulnerability Database of Information Security (CNNVD) - CNNVD-202312-2255
• Cisco Talos (TALOS) - TALOS-2023-1896
• Common Vulnerabilities and Exposures (CVE) - CVE-2021-3450
• CXSecurity World Laboratory of Bugtraq (WLB) - WLB-2024010058
• Defiant Wordfence (WORDFENCE) - WORDFENCE-00086b84-c1ec-447a-a536-1c73eac1cc85
• European Union Vulnerability Database (EUVD) - EUVD-2025-14498
• GitHub Commits (GHCOMMIT) - GHCOMMIT-102448040d5132460e3b0013e03ebedec0677e00
• GitHub Repositories (GITHUB) - GITHUB/aio-libs/aiohttp
• GitHub Security Advisories (GHSA) - GHSA-wfh5-x68w-hvw2
• Google Bug Hunters VRP (GBHVRP) - GBHVRP-F8GFYGv4g
• Google Chromium Issues (CHROMIUM) - CHROMIUM-40057791
• Google Project Zero (PROJECTZERO) - PROJECTZERO-42450487
• Hackerone Hacktivity (H1) - H1-2230915
• Japan Vulnerability Notes iPedia (JVNDB) - JVNDB-2023-006199
• Knownsec Seebug (SSVID) - SSVID-99817
• Linux Open Source Security Foundation (OSSF) - OSSF-OSV-2024-1427
• Microsoft Common Vulnerabilities and Exposures (MSCVE) - MSCVE-2025-21415
• Mozilla Foundation Issues (MOZILLA) - MOZILLA-290162
• Mozilla Foundation Security Advisories (MFSA) - MFSA2024-51
• OffSec Exploit Database (EDB) - EDB-10102
• openSUSE Common Vulnerabilities and Exposures (SUCVE) - SUCVE-2023-40547
• openSUSE Issues (SUSE) - SUSE-1183851
• Packet Storm Security (PSS) - PSS-170615
• Patchstack (PATCHSTACK) - PATCHSTACK/spectrum/wordpress-spectrum-theme-remote-code-execution
• ProjectDiscovery Nuclei (PD) - PD/http/cves/2020/CVE-2020-12720
• ProtectAI Huntr (HUNTR) - HUNTR-001d1c29-805a-4035-93bb-71a0e81da3e5
• Rapid7 Metasploit Framework (MSF) - MSF/auxiliary_admin/2wire/xslt_password_reset
• RedHat Common Vulnerabilities and Exposures (RHCVE) - RHCVE-2025-27098
• RedHat Issues (REDHAT) - REDHAT-290162
• RedHat Security Advisories (RHSA) - RHSA-2025:1730
• Russian Data Bank of Information Security Threats (BDU) - BDU:2024-00390
• Snyk Vulnerability Database (SNYK) - SNYK-JAVA-ORGCLOJURE-5740378
• Source Incite (SRC) - SRC-2021-0019
• Tenable Common Vulnerabilities and Exposures (TNCVE) - TNCVE-2025-25763
• Tenable Security Advisories (TNS) - TNS-2021-05
• Trend Micro Zero Day Initiative (ZDI) - ZDI-23-1714
• VARIoT Exploits (VAR-E) - VAR-E-201704-0525
• VARIoT Vulnerabilities (VAR) - VAR-202404-0085
• Veracode SourceClear Vulnerability Database (SRCCLR-SID) - SRCCLR-SID-3173
• WP Engine WPScan (WPSCAN) - WPSCAN-52568abd-c509-411e-8391-c75e7613eb42
• YouTube (YT) - YT/ccqjhUmwLCk
• Zero Science Lab (ZSL) - ZSL-2022-5743
• 0Day Today (0DAY-ID) - 0DAY-ID-24705
• Vendor/Product ({vendor}__{product}) - grafana
• Vendor/Product + Version ({vendor}__{product}@{version}) - felixwelberg@1.0.45
• Multiple Non-VID Keywords ({keywordA}__{keywordB}) - pci__util