> ## Documentation Index
> Fetch the complete documentation index at: https://how.to.usegolem.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# CVEs & Subdomains

> Query the CVE catalog and trigger subdomain scans

# CVEs & Subdomains

## Browse the CVE catalog

`GET /api/cves`

```bash theme={null}
curl -H "Authorization: Bearer $GOLEM_API_KEY" \
  "https://api.usegolem.ai/api/cves?q=nginx&kev=true&minCvss=7&page=1&sort=cvss"
```

| Parameter       | Values                             |
| --------------- | ---------------------------------- |
| `q`             | Search by CVE ID or keyword        |
| `kev`           | `true` — only CISA KEV-listed CVEs |
| `minCvss`       | Minimum CVSS score (e.g. `7`)      |
| `sort`          | `cvss`, `epss`, or `newest`        |
| `page`, `limit` | Pagination                         |

Returns slim rows with ID, description, CVSS, EPSS, and KEV flags.

## Get one CVE

`GET /api/cves/{cveId}`

Returns the full record: description, references, CVSS vector and score, EPSS score, and KEV status.

## Per-app CVE scoping

`GET /api/apps/{id}/cves` — the same catalog, scoped to the app's identity and tech stack, including the app's exposure state (open / fixed / reopened) for CVEs its audits have touched. `GET /api/apps/{id}/cves/{cveId}` adds the per-app exposure history.

The catalog is refreshed daily from NVD, CISA KEV, and FIRST EPSS. See [CVE Intelligence](/platform/cve-intelligence) for the product-level picture.

## Trigger a subdomain scan

`POST /api/subdomains`

```bash theme={null}
curl -X POST https://api.usegolem.ai/api/subdomains \
  -H "Authorization: Bearer $GOLEM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain": "acme.example.com", "resolveAll": true}'
```

| Field        | Required | Notes                                            |
| ------------ | -------- | ------------------------------------------------ |
| `domain`     | yes      | Domain to enumerate                              |
| `resolveAll` | no       | Resolve every candidate, not just validated ones |

Returns a `runId` immediately — the scan runs asynchronously.

## Check scan results

`GET /api/subdomains/{runId}`

Returns the discovered subdomains (with the source that surfaced each and resolution status), the resolved count, and — when run against an app — the diff versus the previous scan (`newSubdomains` / `removedSubdomains`).

New-subdomain detections against a monitored app also trigger email and Slack notifications.