NIST's vulnerability database puts its errors in a header, not the body

What it covers

The NVD API 2.0 serves CVE records. Each record carries CVSS scores, CPE product matches, and CWE weakness types, plus a CISA Known Exploited Vulnerabilities flag where one applies. No key and no sign-up are needed. A free key raises the rate limit from 5 requests per rolling 30 seconds to 50.

GET /rest/json/cves/2.0?cveId=CVE-2021-44228, queried live this session, returned 200 with the full Log4Shell record: source, publish date, CVSS scores, and CWE weakness types.

GET /rest/json/cves/2.0?resultsPerPage=1, queried live this session, returned 200 with totalResults over 388,000. Adding hasKev to that same query narrowed the count to under 1,700. Both figures move daily as NIST publishes new records.

A bad request comes back empty

GET with cveId=notacve, a value that fails the API's own ID format, returned 404 with an empty body. The reason sits in a response header instead: message: Invalid cveId parameter.

GET with bogusParam=1, a parameter the API does not define, also returned 404 with an empty body. Its header read: message: Invalid parameter: bogusParam.

GET with resultsPerPage=3000, a page size over the documented cap of 2000, returned the same shape. The body was empty and the header read: message: resultsPerPage parameter cannot exceed 2000.

A client that reads the response body for the error text finds nothing. It has to read the message header instead.

A CVE that does not exist is not a 404

GET with cveId=CVE-9999-99999, an ID that is correctly formed but matches no real record, returned 200 with totalResults: 0 and an empty vulnerabilities array.

The API draws a line most callers do not expect. A malformed ID fails with a 404 and a header, but a well-formed ID with no match succeeds with an empty list. Code that treats every miss as a 404 will skip the empty-list case.

This session also sent an Origin header on a request to the CVE endpoint and got back Access-Control-Allow-Origin: *, confirming the catalogue's cors: yes entry for this API.