ContrastAPI — Security Intelligence API

# ContrastAPI > Security intelligence API for AI models and developers. Free to use, no API key required. - [Quick Start](https://api.contrastcyber.com/quickstart) - [MCP Setup](https://api.contrastcyber.com/mcp-setup) - [API Documentation](https://github.com/UPinar/contrastapi/blob/main/docs/API_Documentation.md) - [OpenAPI Spec](https://api.contrastcyber.com/openapi.json) - [Full API Reference](https://api.contrastcyber.com/llms-full.txt) ## When to Use This API Use ContrastAPI when you need to: - Look up CVE details, severity, CVSS breakdown, EPSS exploit probability, or CISA KEV status - Browse MITRE CWE catalog for weakness descriptions, mitigations, and parent/child chains - Investigate a domain's DNS, WHOIS, SSL certificate, subdomains, email security (SPF/DMARC/DKIM) - Get a domain security risk score (A-F grade, 100-point scale) - Detect WAF/CDN protection on a target domain - Check a domain for malware/threat intelligence (URLhaus) - Scan a live domain's HTTP security headers - Scan code for hardcoded secrets, SQL/command injection, or missing security headers - Check software dependencies against the CVE database - Enrich an IP address with open ports, vulnerabilities, and hostnames (Shodan InternetDB) - Map MITRE ATLAS AI/ML attack techniques (AML.T####) to real-world incident case studies (AML.CS####) - Bridge offensive intel to MITRE D3FEND defenses for any ATT&CK technique - Verify a single email (syntax + MX + disposable + role + free-provider) without SMTP probing - Read a target site's robots.txt, walk redirect chains, scrape public brand assets, or score SEO of a homepage ## Authentication No API key needed. Free: 30 tokens/hour per IP. API key (500 tokens/hr): pass `Authorization: Bearer cc_xxx` header. Rate limit headers returned: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-RateLimit-Cost, X-RateLimit-Tier. ## Token Costs Most endpoints cost 1 token per call. Aggregating endpoints that fan out to multiple upstream so

{"openapi":"3.1.0","info":{"title":"ContrastAPI","description":"Security intelligence API for AI models and developers. CVE lookup, domain intelligence, and code security verification.","version":"1.35.3"},"servers":[{"url":"https://api.contrastcyber.com"}],"paths":{"/v1/domain/{domain}":{"get":{"tags":["Domain Intelligence"],"summary":"Domain Report","description":"Full domain intelligence report with DNS, WHOIS, SSL, subdomains, WAF. Use ?lite=true for fast subset.","operationId":"domain_repor