APITube Documentation
Sign inGet started

Cyber Security API use cases ​

Use these examples to build alerts, vendor monitoring and daily digests with /v1/cyber-security/news. Each includes a request and code for reading the cyber block. Replace YOUR_API_KEY with your key.

Alert on actively exploited vulnerabilities ​

Goal: get a message when an article mentions a CVE that CISA lists as used in real attacks.

Check the API on a schedule for articles published since the previous check. Keep those with cyber.in_kev: true and record the CVEs you have already reported, so several articles about one vulnerability produce only one alert.

python
import time
from datetime import datetime, timedelta, timezone

import requests

API_URL = "https://api.apitube.io/v1/cyber-security/news"
HEADERS = {"X-API-Key": "YOUR_API_KEY"}

seen_cves = set()
since = datetime.now(timezone.utc) - timedelta(hours=1)

while True:
    started = datetime.now(timezone.utc)
    response = requests.get(
        API_URL,
        params={
            "published_at.start": since.strftime("%Y-%m-%dT%H:%M:%SZ"),
            "sort.by": "published_at",
            "sort.order": "asc",
            "per_page": 50,
            "fl": "title,href,published_at,cyber",
        },
        headers=HEADERS,
    )

    for article in response.json()["results"]:
        cyber = article["cyber"]
        new_cves = [cve for cve in cyber["cves"] if cve not in seen_cves]

        if cyber["in_kev"] and new_cves:
            seen_cves.update(new_cves)
            print(f"EXPLOITED {', '.join(new_cves)} ({', '.join(cyber['vendors'])})")
            print(f"  {article['title']}\n  {article['href']}")

    since = started
    time.sleep(600)

Each check that returns articles costs 1 point; a check with no new articles is free. If more than 50 articles can arrive between checks, follow next_page until has_next_pages is false.

Watch vulnerabilities of one vendor ​

Goal: follow news about vulnerabilities in the products of one company, for example Fortinet.

organization.name keeps articles that mention the company. cyber.vendors tells you whether a mentioned CVE of that vendor is in the KEV catalog. Use both: the first narrows the search, the second marks the urgent articles.

bash
curl "https://api.apitube.io/v1/cyber-security/news?organization.name=Fortinet&language.code=en&per_page=20&fl=title,href,published_at,cyber" \
  -H "X-API-Key: YOUR_API_KEY"
python
import requests

response = requests.get(
    "https://api.apitube.io/v1/cyber-security/news",
    params={
        "organization.name": "Fortinet",
        "language.code": "en",
        "per_page": 20,
        "fl": "title,href,published_at,cyber",
    },
    headers={"X-API-Key": "YOUR_API_KEY"},
)

for article in response.json()["results"]:
    cyber = article["cyber"]
    urgent = "Fortinet" in cyber["vendors"]
    label = "KEV" if urgent else "   "
    print(label, article["published_at"], article["title"], cyber["cves"])

organization.name takes up to 3 names. Vendor names in cyber.vendors are spelled as in the KEV catalog, so compare them with the same spelling — Microsoft, Fortinet, Cisco.

Build a daily digest ranked by severity ​

Goal: a morning list of yesterday's cyber crime news, with the most severe vulnerabilities on top.

Set published_at to one date to get that day's articles. Sort them by cyber.cvss in your code; the API does not support sort.by=cvss. Put articles with a null score last.

python
from datetime import date, timedelta

import requests

yesterday = (date.today() - timedelta(days=1)).isoformat()

response = requests.get(
    "https://api.apitube.io/v1/cyber-security/news",
    params={
        "cyber.type": "crime",
        "language.code": "en",
        "published_at": yesterday,
        "per_page": 100,
        "fl": "title,href,source,cyber",
    },
    headers={"X-API-Key": "YOUR_API_KEY"},
)

articles = response.json()["results"]
articles.sort(key=lambda a: a["cyber"]["cvss"] if a["cyber"]["cvss"] is not None else -1, reverse=True)

for article in articles:
    score = article["cyber"]["cvss"]
    print(f"{score if score is not None else '—':>4}  {article['title']}")
    print(f"      {article['href']}")

On a paid plan, add export=xlsx to download the digest as a spreadsheet. The Cyber column contains each article's CVE IDs, KEV status and score.

Monitor cyber warfare around a country ​

Goal: follow state-backed attacks and cyber operations connected to one country, and see which countries' media report them.

Combine cyber.type=warfare with location.name. Add a facet on source.country.id to count the matching articles by the country of the outlet.

bash
curl "https://api.apitube.io/v1/cyber-security/news?cyber.type=warfare&location.name=Ukraine&per_page=20&facet=1&facet.field=source.country.id&fl=title,href,published_at,source" \
  -H "X-API-Key: YOUR_API_KEY"

The facets["source.country.id"] array in the response counts every matching article, not only the 20 on the page. Its values are numeric country IDs, not ISO codes. location.name must match a known location — check the spelling with /v1/suggest/entities first.

Count attack news per day ​

Goal: a daily volume chart of cyber crime coverage, without downloading the articles.

Use range facets to count matching articles by day. Set per_page=1 and fl=id to keep the response small:

bash
curl "https://api.apitube.io/v1/cyber-security/news?cyber.type=crime&per_page=1&fl=id&facet.range=1&facet.range.field=published_at&facet.range.start=2026-10-01&facet.range.end=2026-10-15&facet.range.gap=%2B1DAY" \
  -H "X-API-Key: YOUR_API_KEY"
json
{
  "facets": {
    "published_at_ranges": [
      { "range_start": "2026-10-01", "range_end": "2026-10-02", "count": 412 },
      { "range_start": "2026-10-02", "range_end": "2026-10-03", "count": 388 }
    ]
  }
}

Encode the + in +1DAY as %2B in a URL, otherwise it arrives as a space. Days with no articles are not listed. Run the request once for cyber.type=crime and once for cyber.type=warfare to chart the two categories separately.