Cyber Security API response format

The response uses the same format as /v1/news/everything. Each article has the standard fields, including title, href, published_at, source, categories, entities and sentiment, plus cyber.

Top-level response fields

{
  "status": "ok",
  "limit": 10,
  "path": "https://api.apitube.io/v1/cyber-security/news?cyber.type=crime&per_page=10",
  "page": 1,
  "has_next_pages": true,
  "next_page": "https://api.apitube.io/v1/cyber-security/news?cyber.type=crime&per_page=10&page=2",
  "has_previous_page": false,
  "previous_page": "",
  "export": {
    "json": "...",
    "csv": "...",
    "xlsx": "..."
  },
  "request_id": "a4dd55a0-6cca-47a4-a5e5-4da27211e5b0",
  "results": []
}

Field	Type	Description
status	string	ok for a successful request
limit	integer	Articles per page (per_page)
path	string	The request URL
page	integer	Current page number
has_next_pages	boolean	Whether another page exists
next_page	string	URL of the next page with all filters kept, or an empty string
has_previous_page	boolean	Whether a previous page exists
previous_page	string	URL of the previous page, or an empty string
export	object	The same request as download links, one per export format
request_id	string	ID of this request, useful when you contact support
results	array	The articles
facets	object	Facet counts, only with facet=1 or facet.range=1
highlighting	object	Highlighted fragments, only with hl=1
meta	object	Warnings and prompt details, only when there is something to report

The full article object is documented in API Response Structure.

The cyber object

Every article in results has a cyber object with six fields. All six are always present; empty values are [] or null, never missing.

"cyber": {
  "type": ["crime"],
  "cves": ["CVE-2025-43529", "CVE-2025-14174"],
  "vendors": ["Apple", "Google"],
  "in_kev": true,
  "exploited": true,
  "cvss": null
}

Field	Type	Description
type	array of strings	The article's cyber categories: crime, warfare or both. Lists both cyber categories if both apply, even when you selected only one with cyber.type.
cves	array of strings	CVE IDs mentioned in the title, description or body, in the order they first appear. Each ID appears once. Empty when the article mentions none.
vendors	array of strings	Vendors of the mentioned CVEs that are listed in the CISA KEV catalog, as KEV names them (Microsoft, Fortinet, Hewlett Packard Enterprise (HPE)). Empty when no mentioned CVE is in KEV.
in_kev	boolean or null	true when at least one mentioned CVE is in the CISA Known Exploited Vulnerabilities catalog. null when the catalog was not available.
exploited	boolean or null	true if a mentioned vulnerability has been used in real attacks. Currently has the same value as in_kev. null when KEV status is unavailable.
cvss	number or null	The highest CVSS score written in the article, from 0 to 10. null when the article states no score.

Which CVE IDs are returned

The cves list contains vulnerability IDs mentioned in the article's title, description or body. IDs use the CVE-YYYY-NNNN format, with four to seven digits after the year. Returned IDs are uppercase and use plain hyphens, even if the article uses another kind of dash. If the article says only "a critical flaw in FortiOS" without an ID, cves is empty.

KEV status and vendor names

in_kev and exploited are true when at least one mentioned CVE is listed as actively exploited in CISA KEV. The vendors list contains the vendors for those CVEs.

If KEV status is unavailable, in_kev and exploited are null and vendors is empty. Treat null as unknown.

Which severity score is returned

cvss is the highest CVSS score stated in the article. Examples include "CVSS 9.8", "CVSS v3.1: 7.5" and "CVSS score of 8.8". Version numbers such as "CVSS 3.1" and vector strings such as CVSS:3.1/AV:N/... do not count as scores. If no score is stated, the field is null.

Selecting cyber fields with fl

fl limits each article to the fields you list. Name the whole block with cyber, or single fields with cyber.type, cyber.cves, cyber.vendors, cyber.in_kev, cyber.exploited and cyber.cvss.

curl "https://api.apitube.io/v1/cyber-security/news?fl=id,cyber.cves,cyber.in_kev&per_page=1&api_key=YOUR_API_KEY"

{
  "results": [
    {
      "id": 3017161400,
      "cyber": {
        "cves": ["CVE-2025-43529", "CVE-2025-14174"],
        "in_kev": true
      }
    }
  ]
}

If fl does not name cyber or any of its fields, the block is left out.

The cyber block in exports

With export, the same articles come back as a file. Each format stores the cyber block in its own way:

Format	Where the cyber block goes
csv, tsv, xlsx	A Cyber column holding the block as a JSON string
xml	A <cyber> element with child elements; empty lists and null values become empty elements
jsonl, ndjson	A cyber object on each line, as in the JSON response
parquet	A cyber column holding the block as a JSON string
rss	The values of cyber.type as <category> elements of each item

Exports other than JSON require a paid plan; on Free they return 403 ER0706.

Warnings in meta

meta.warnings lists problems that did not stop the request. Two are common on this endpoint:

• ER0901 means some matching articles are unavailable or no longer in the selected categories. A page may have fewer articles than per_page, or be empty while has_next_pages is true. Keep following next_page. Empty pages are free.
• ER0368 — the request had a parameter the endpoint does not know, such as cyber.cves. The parameter was ignored; the warning names it.

Related

• Filters — cyber.type and the filters you can combine with it.
• Use cases — working examples that read the cyber block.
• API Response Structure — every standard article field.