Cyber Security API quickstart

Fetch security news, read vulnerability details and add filters in five steps. The examples use /v1/cyber-security/news and show how to keep articles about actively exploited vulnerabilities.

Before you start

Sign up and copy your key from the APITube dashboard. The Free plan is enough for the requests below, except export. Send your key in X-API-Key, an Authorization: Bearer header, or the api_key URL parameter. See Authentication.

API keys restricted to specific endpoints need the cyber_security_news scope. Unrestricted keys work as they are.

Endpoint

GET  /v1/cyber-security/news
POST /v1/cyber-security/news

Base URL: https://api.apitube.io. Send filters in the URL with GET or as JSON with POST. If a POST request also includes URL parameters, values in the body take priority.

Step 1: Fetch the latest cyber security news

Call the endpoint without filters. It returns the newest articles from the cyber crime and cyber warfare categories. Use per_page=1 to fetch one article with every field.

bash

curl "https://api.apitube.io/v1/cyber-security/news?per_page=1" \
  -H "X-API-Key: YOUR_API_KEY"

python

import requests

response = requests.get(
    "https://api.apitube.io/v1/cyber-security/news",
    params={"per_page": 1},
    headers={"X-API-Key": "YOUR_API_KEY"},
)

for article in response.json()["results"]:
    print(article["published_at"], article["title"], article["cyber"]["cves"])

javascript

const params = new URLSearchParams({ per_page: '1' });

const response = await fetch(`https://api.apitube.io/v1/cyber-security/news?${params}`, {
  headers: { 'X-API-Key': 'YOUR_API_KEY' }
});
const data = await response.json();

for (const article of data.results) {
  console.log(article.published_at, article.title, article.cyber.cves);
}

Step 2: Read the response

The complete JSON response contains one article in results, pagination links, export URLs and a request_id. The article values below are illustrative. On Free, body and body_html contain a preview; the full text shown here is available on paid plans.

json

{
  "status": "ok",
  "limit": 1,
  "path": "https://api.apitube.io/v1/cyber-security/news?per_page=1",
  "page": 1,
  "has_next_pages": true,
  "next_page": "https://api.apitube.io/v1/cyber-security/news?per_page=1&page=2",
  "has_previous_page": false,
  "previous_page": "",
  "export": {
    "json": "https://api.apitube.io/v1/cyber-security/news?per_page=1&export=json",
    "xlsx": "https://api.apitube.io/v1/cyber-security/news?per_page=1&export=xlsx",
    "csv": "https://api.apitube.io/v1/cyber-security/news?per_page=1&export=csv",
    "tsv": "https://api.apitube.io/v1/cyber-security/news?per_page=1&export=tsv",
    "xml": "https://api.apitube.io/v1/cyber-security/news?per_page=1&export=xml",
    "rss": "https://api.apitube.io/v1/cyber-security/news?per_page=1&export=rss",
    "parquet": "https://api.apitube.io/v1/cyber-security/news?per_page=1&export=parquet",
    "jsonl": "https://api.apitube.io/v1/cyber-security/news?per_page=1&export=jsonl"
  },
  "request_id": "a4dd55a0-6cca-47a4-a5e5-4da27211e5b0",
  "results": [
    {
      "id": 1234567890,
      "href": "https://example.com/security/firewall-vulnerability-review",
      "published_at": "2026-10-16T08:30:00.000Z",
      "title": "Security teams review firewall vulnerabilities and ongoing attacks",
      "description": "A sample security report covering firewall flaws, exploited vulnerabilities and vendor updates.",
      "body": "Security teams are reviewing reports of cyber crime and state-backed attacks involving firewall and email security products. The report mentions CVE-2025-20393, CVE-2025-40602, CVE-2025-23006 and CVE-2025-14733. Cisco, SonicWall and WatchGuard appear in the report. The highest stated CVSS score is 9. 8. Administrators are checking vendor advisories and reviewing affected deployments.",
      "body_html": "<p>Security teams are reviewing reports of cyber crime and state-backed attacks involving firewall and email security products. The report mentions CVE-2025-20393, CVE-2025-40602, CVE-2025-23006 and CVE-2025-14733.</p><p>Cisco, SonicWall and WatchGuard appear in the report. The highest stated CVSS score is 9.8. Administrators are checking vendor advisories and reviewing affected deployments.</p>",
      "language": "en",
      "translations": {
        "en": {
          "title": null,
          "description": null
        }
      },
      "author": {
        "id": 5,
        "name": "Example Security Desk"
      },
      "image": "https://example.com/images/security-review.jpg",
      "categories": [
        {
          "id": 118,
          "name": "cyber crime",
          "score": 0.96,
          "taxonomy": "iptc_mediatopics",
          "links": {
            "self": "https://api.apitube.io/v1/news/category/iptc_mediatopics/medtop:20000086"
          }
        },
        {
          "id": 90,
          "name": "cyber warfare",
          "score": 0.87,
          "taxonomy": "iptc_mediatopics",
          "links": {
            "self": "https://api.apitube.io/v1/news/category/iptc_mediatopics/medtop:20001361"
          }
        }
      ],
      "topics": [],
      "industries": [],
      "entities": [],
      "locations_mentioned": [],
      "source": {
        "id": 508004,
        "domain": "example.com",
        "home_page_url": "https://example.com",
        "type": "news",
        "bias": "",
        "rankings": {
          "opr": 0
        },
        "location": {
          "country_name": "United States",
          "country_code": "us"
        },
        "favicon": "https://www.google.com/s2/favicons?domain=https://example.com"
      },
      "sentiment": {
        "overall": {
          "score": -0.4,
          "polarity": "negative"
        },
        "title": {
          "score": -0.3,
          "polarity": "negative"
        },
        "body": {
          "score": -0.4,
          "polarity": "negative"
        }
      },
      "summary": [
        {
          "sentence": "Security teams are reviewing vulnerabilities affecting firewall and email security products.",
          "sentiment": {
            "score": -0.4,
            "polarity": "negative"
          }
        }
      ],
      "keywords": [
        "cyber security",
        "firewall",
        "vulnerability",
        "Cisco",
        "SonicWall",
        "WatchGuard"
      ],
      "links": [
        {
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "type": "external"
        }
      ],
      "media": [
        {
          "url": "https://example.com/images/security-review.jpg",
          "type": "image"
        }
      ],
      "readability": {
        "flesch_kincaid_grade": 0,
        "flesch_reading_ease": 0,
        "automated_readability_index": 0,
        "difficulty_level": "unknown",
        "target_audience": "unknown",
        "reading_age": 0,
        "avg_words_per_sentence": 0,
        "avg_syllables_per_word": 0
      },
      "story": {
        "id": 1234567890,
        "uri": "https://api.apitube.io/v1/news/story/1234567890"
      },
      "shares": {
        "total": 0,
        "facebook": 0,
        "twitter": 0,
        "reddit": 0
      },
      "is_duplicate": false,
      "is_free": true,
      "is_breaking": false,
      "read_time": 1,
      "sentences_count": 5,
      "paragraphs_count": 2,
      "words_count": 50,
      "characters_count": 386,
      "cyber": {
        "type": [
          "crime",
          "warfare"
        ],
        "cves": [
          "CVE-2025-20393",
          "CVE-2025-40602",
          "CVE-2025-23006",
          "CVE-2025-14733"
        ],
        "vendors": [
          "Cisco",
          "SonicWall",
          "WatchGuard"
        ],
        "in_kev": true,
        "exploited": true,
        "cvss": 9.8
      }
    }
  ]
}

What the cyber block tells you about this article:

type — the article is in both cyber categories, crime and warfare.
cves — the CVE IDs mentioned in the title, description or body, in the order they first appear.
in_kev and exploited — at least one of those CVEs is in the CISA Known Exploited Vulnerabilities catalog.
vendors — the vendors of the CVEs that are in the KEV catalog.
cvss — the highest CVSS score written in the article, here 9.8.

Every field is described in Response format.

Step 3: Narrow the feed

Pick one cyber category with cyber.type, then add any News API filter. This request returns English cyber crime articles published since a given date, newest first:

Parameter	Type	Required	Description
`cyber.type`	string	No	`crime` for cyber crime, `warfare` for cyber warfare. Omit to include both. One lowercase value; anything else returns `400 ER0900`.

bash

curl "https://api.apitube.io/v1/cyber-security/news?cyber.type=crime&language.code=en&published_at.start=2026-10-01&sort.by=published_at&sort.order=desc&per_page=10&fl=id,title,href,cyber" \
  -H "X-API-Key: YOUR_API_KEY"

Combine cyber.type with title, language, date, source, entity and other filters. Sorting, pagination, facets, highlighting, fl and export also work here. See Filters for the complete reference.

Send filters with POST

Use a JSON body for long queries or lists of values:

bash

curl -X POST "https://api.apitube.io/v1/cyber-security/news" \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "cyber.type": "warfare",
    "query": "satellite OR \"power grid\"",
    "language.code": "en",
    "published_at.start": "2026-10-01",
    "published_at.end": "2026-10-15",
    "sort.by": "published_at",
    "per_page": 10
  }'

query searches titles, so it needs a published_at window of 31 days or less. Without published_at.end, the window runs to the current moment.

Step 4: Keep only exploited vulnerabilities

You cannot use cyber.in_kev or cyber.cvss as API filters. Check these fields in your code after receiving the response. This script collects CVEs from articles with at least one actively exploited vulnerability:

python

import requests

response = requests.get(
    "https://api.apitube.io/v1/cyber-security/news",
    params={
        "cyber.type": "crime",
        "language.code": "en",
        "per_page": 10,
        "fl": "id,title,href,published_at,cyber",
    },
    headers={"X-API-Key": "YOUR_API_KEY"},
)

for article in response.json()["results"]:
    cyber = article["cyber"]

    if cyber["in_kev"]:
        score = cyber["cvss"] if cyber["cvss"] is not None else "n/a"
        print(f"{article['published_at']}  CVSS {score}  {', '.join(cyber['vendors'])}")
        print(f"  {article['title']}")
        print(f"  {', '.join(cyber['cves'])}")

Treat in_kev: null as unknown. It means the KEV catalog was unavailable, so it does not tell you whether the vulnerability has been exploited.

Step 5: Page through results and export

When has_next_pages is true, request the URL in next_page. It keeps all your filters, including cyber.type. A page may contain fewer articles than per_page; continue until has_next_pages is false.

On paid plans the same request can return a file. Add export=csv (or tsv, xlsx, xml, rss, jsonl, parquet); the cyber block is written to a Cyber column in tabular formats:

bash

curl "https://api.apitube.io/v1/cyber-security/news?cyber.type=crime&language.code=en&per_page=10&export=csv" \
  -H "X-API-Key: YOUR_API_KEY" -o cyber-news.csv

Limits and request costs

Each request that returns articles costs 1 point. Empty pages are free.
prompt requires Basic or above and adds 2 points when the wording has not been parsed before. Repeated prompts use the cached interpretation without the extra charge.
per_page is capped by plan: Free 10, Starter 50, Basic 200, Professional and Corporate 250. Free cannot go past page 5. See Rate limits and quotas.
Free returns previews in body and body_html. Exports other than JSON require a paid plan.
Title search (title, title_starts_with, title_ends_with, title_pattern, query) covers at most 31 days of published_at.
A page may contain fewer articles than per_page. If some results are unavailable, the response includes an ER0901 warning. Follow next_page to continue.
The cyber fields are output only. Check CVE IDs, vendors, KEV status and CVSS scores in your code, as in Step 4.

Errors

Errors use the shared format described in HTTP response codes.

Code	Status	What went wrong
`ER0900`	400	`cyber.type` is not `crime` or `warfare` — for example `ransomware`, `CRIME` or `crime,warfare`
`ER0179`	400	`cyber.type` (or another parameter) appears twice in the URL
`ER0110`	400	Title search covers more than 31 days of `published_at`
`ER0171`	400	`per_page` is above your plan's limit (10 on Free)
`ER0201`	401	No API key in the request
`ER0202`	401	The API key is invalid
`ER0176`	402	No points left on the account
`ER0603`	403	The API key is restricted and lacks the `cyber_security_news` scope
`ER0706`	403	Export or `prompt` used on a plan that does not include it
`ER0203`	429	Rate limit exceeded

Warnings arrive in meta.warnings with HTTP 200:

Code	Meaning
`ER0901`	Some matching articles are unavailable or no longer in the cyber categories; the page may contain fewer results
`ER0368`	Unknown parameters were ignored; the warning names them

Next steps

Filters — every way to narrow the feed.
Use cases — alert feeds, vendor watch and daily digests built on this endpoint.
Response format — what CVE IDs, KEV status and CVSS scores mean.

Cyber Security API quickstart ​

Before you start ​

Endpoint ​

Step 1: Fetch the latest cyber security news ​

Step 2: Read the response ​

Step 3: Narrow the feed ​

Send filters with POST ​

Step 4: Keep only exploited vulnerabilities ​

Step 5: Page through results and export ​

Limits and request costs ​

Errors ​

Next steps ​

Cyber Security API quickstart

Before you start

Endpoint

Step 1: Fetch the latest cyber security news

Step 2: Read the response

Step 3: Narrow the feed

Send filters with POST

Step 4: Keep only exploited vulnerabilities

Step 5: Page through results and export

Limits and request costs

Errors

Next steps