CyberPulse API

Endpoints (11 live)

• GET /api/cyber/cisa-kev — Returns the CISA Known Exploited Vulnerabilities feed for active threat monitoring. (0.08 USDC on Solana)
• GET /api/cyber/dark-web-monitor — Dark-web monitoring for any brand or domain — paste-site mentions, credential-dump signals, forum chatter, ransomware leak-site activity, brand impersonation, and initial-access-broker listings, for threat-intel and brand-protection agents. Ethical OSINT only. (0.2 USDC on Base)
• GET /api/cyber/compliance-gap — Compliance gap analysis for SOC2, ISO27001, GDPR, HIPAA, PCI-DSS, NIST CSF, NIS2, PDPA, POPIA, LGPD, CCPA, FISMA, and CMMC — control gaps, common audit failures, enforcement trends, cost to comply, and fastest path to certification, for compliance and CISO agents. (0.25 USDC on Base)
• GET /api/cyber/threat-intel — Threat-intelligence brief for any industry and region — active threat-actor campaigns, TTPs, nation-state APTs, eCrime/ransomware operators, and MITRE ATT&CK mapping, with recent CISA KEV and GDELT-scored news coverage. Worldwide sector-specific context, for threat-intel and SOC agents. (0.2 USDC on Base)
• GET /api/cyber/osint — OSINT lookup for any domain or IP — open ports and known CVEs (Shodan InternetDB), DNS and email posture (SPF/DMARC/DKIM), SSL grade, threat-feed status, and geolocation, for security and defensive agents. Authorized defensive use only. (0.15 USDC on Solana)
• GET /api/cyber/cve-check — CVE fact check, deterministic. Answers "is CVE-XXXX-NNNN real", "is it exploited in the wild", "what version fixes it", "how severe is it". Joins the NVD record (CVSS score, vector, dates), the CISA KEV catalog (actively-exploited flag, remediation due date, ransomware use), and OSV (affected packages + fixed versions per ecosystem). No LLM. Distinguishes "not a known CVE" from "registry unreachable" — never a false not-found. (0.02 USDC on Base)
• GET /api/cyber/attack-surface — External attack-surface assessment (EASM) for any company and domain — internet-exposed assets, tech-stack fingerprinting, email-security posture, supply-chain and identity exposure, and a prioritized remediation roadmap, for security and red-team-context agents. Authorized defensive use only. (0.25 USDC on Base)
• GET /api/cyber/breach-check — Data-breach lookup and credential-exposure check for any domain. Surfaces known data breaches, credential dumps, dark-web signals, and regulatory notification duties (GDPR, CCPA, PDPA, LGPD, POPIA), for security and compliance agents. Authorized security use only. (0.15 USDC on Base)
• GET /api/cyber/ransomware-intel — Ransomware-group threat brief and tracking — victim patterns, TTPs, ransom economics, and defensive playbooks across LockBit, ALPHV, Cl0p, RansomHub, BlackBasta, Akira, and 50+ active groups, plus CISA KEV ransomware-linked CVEs. Global, for threat-intel and incident-response agents. (0.2 USDC on Base)
• GET /api/cyber/vuln-scan — Vulnerability scan / known-CVE lookup for any software, product, or package version. Returns NVD CVEs, CISA KEV matches, OSV open-source/dependency vuln results, version risk assessment, and prioritized patch guidance, for vuln-management and dependency-security agents. (0.12 USDC on Base)
• GET /api/cyber/cve-brief — CVE lookup and severity brief for any CVE ID — CVSS score, exploit / CISA KEV / active-exploitation / PoC status, affected products, patch urgency, and remediation steps. Authoritative NVD + CISA data plus threat-intel context, for security and vuln-management agents. (0.1 USDC on Base)