--- sourceDocument: Australia Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # CVE Exposure Assessment REST API # CVE Exposure Assessment REST API {#ariaid-title1} Release version: Australia Updated September 3, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of CVE Exposure Assessment REST API The CVE Exposure Assessment REST API enables ServiceNow customers to trigger CVE exposure assessments and create vulnerability assessment records programmatically from external systems. This API supports automating vulnerability assessment workflows and integrating with external security tools. Show full answer Show less To use this API, the caller must have the **snvulanalyst.emergencyresponse** role. If the request does not specify a source identifier, the system records "VR-SNOW" by default to track the calling system. ## Assess CVEs Operation This operation accepts one or more CVE IDs and triggers the same exposure assessment that is available in the Vulnerability Assessment Workspace. It handles CVE IDs that are unknown to the instance gracefully, returning them separately rather than failing the entire request. * **HTTP Method:** POST * **Endpoint:** /api/snvulanalyst/exposureassessment/cve * **Required parameter:** `cveIds` --- an array of CVE ID strings (e.g., \["CVE-2024-1234", "CVE-2024-5678"\]) * **Optional parameter:** `source` --- string identifying the calling system (e.g., "Qualys") On success, the response includes: * Lists of CVEs already tracked (`existingCves`) and newly enabled (`newCves`) * CVEs not found in the instance (`notFoundCveIds`) * A status link (`jobStatusLink`) to monitor the assessment job If the `cveIds` parameter is missing or empty, the API returns an HTTP 400 error. ## Create Vulnerability Assessment Operation This operation creates a vulnerability assessment record similar to the "Create Vulnerability Assessment" action in the Vulnerability Assessment Workspace. It only creates the record; you must run the assessment separately using this API or the workspace. * **HTTP Method:** POST * **Endpoint:** /api/snvulanalyst/exposureassessment/vulnerabilityassessment * **Required parameter:** `title` --- title of the vulnerability assessment record * **Optional parameters:** * `cve` --- single CVE ID to associate as the Primary CVE; must exist, and no active assessment may already exist for it * `source` --- string identifying the calling system * `autoCreateVitsAvits` --- boolean to auto-create VITs/AVITs, default is false * `priority` --- integer 1 to 5 representing priority; values outside this range cause request failure On success, the API returns HTTP 201 and the `sysid` of the newly created assessment record. The API returns HTTP 400 errors if mandatory fields are missing, the priority is invalid, the CVE does not exist, or an active assessment already exists for the given CVE. ## Practical Considerations for ServiceNow Customers * Ensure the caller has the **snvulanalyst.emergencyresponse** role to invoke these endpoints. * Use the Assess CVEs operation to trigger exposure assessments for one or more CVEs efficiently, and handle unknown CVEs gracefully. * Create vulnerability assessment records through the API to automate tracking before performing assessments. * Always validate CVEs before creating assessments to avoid conflicts with existing active records. * Use the `source` parameter to identify your external system making the API calls, aiding in audit and tracking. * Monitor the status of assessment jobs using the provided `jobStatusLink`. Review the following information before using the CVE Exposure Assessment REST API to trigger a CVE exposure assessment or create a vulnerability assessment record from an external system. To call either operation in this API, the sn_vul_analyst.emergency_response role is required. If you don't pass a source value in the request body, the system records `VR-SNOW` so the calling system is still identifiable. ## Assess CVEs {#vr-va-ws-cve-exposure-assessment-api__section_cve_exp_api_assess_cves} Accepts one or more CVE IDs and triggers the same exposure assessment that the Get CVE exposure action triggers in the [Vulnerability Assessment Workspace](https://www.servicenow.com/docs/u8sK2NCOophqngLNqHw_8w "The Vulnerability Assessment Workspace is designed for the Vulnerability event manager to perform exposure assessment, and proactively manage critical vulnerability events especially during the critical vulnerability events such as a zero-day event."). CVE IDs that don't match a CVE entry in your instance aren't treated as a failure: the request still succeeds, and those IDs are returned separately so you can identify them. HTTP method: (POST) API URL: \/api/sn_vul_analyst/exposure_assessment/cve Note: \ is your ServiceNow instance name. {#vr-va-ws-cve-exposure-assessment-api__table_cve_exp_api_assess_params__entry__3} | Request parameters | Possible values | Description | |-|-|-| | cveIds | Array of CVE ID strings, for example \["CVE-2024-1234", "CVE-2024-5678"\] | Required. The request fails if this array is missing or empty. | | source | Any string that identifies the calling system, for example "Qualys" | Optional. | [ ] {#vr-va-ws-cve-exposure-assessment-api__table_cve_exp_api_assess_params} Request example. {"cveIds": ["CVE-2024-1234", "CVE-2024-5678"], "source": "Qualys"} Response example. existingCves lists CVE IDs that were already tracked for exposure before this call, and newCves lists the ones this call newly enabled. jobStatusLink is an HTML link, not a plain URL: parse the `href` attribute if you need the link target programmatically. { "result": { "notFoundCveIds": ["CVE-2024-9999"], "existingCves": ["CVE-2024-1234"], "newCves": ["CVE-2024-5678"], "jobStatusLink": "View Status" } } If cveIds isn't a non-empty array, the API rejects the request with an HTTP 400 error. ## Create a vulnerability assessment {#vr-va-ws-cve-exposure-assessment-api__section_cve_exp_api_create_assessment} Creates a vulnerability assessment record the same way the Create Vulnerability Assessment action does in the [Vulnerability Assessment Workspace](https://www.servicenow.com/docs/u8sK2NCOophqngLNqHw_8w "The Vulnerability Assessment Workspace is designed for the Vulnerability event manager to perform exposure assessment, and proactively manage critical vulnerability events especially during the critical vulnerability events such as a zero-day event."). Use this operation to create the record only, then use [Perform an assessment](https://www.servicenow.com/docs/PACGsT8ChB8WnJnZYHyB1A "After you’ve created the vulnerability assessment record and updated the risk attribute fields, run an assessment of the event record.") (or the Assess CVEs operation above) to run the assessment. HTTP method: (POST) API URL: \/api/sn_vul_analyst/exposure_assessment/vulnerability_assessment Note: \ is your ServiceNow instance name. {#vr-va-ws-cve-exposure-assessment-api__table_cve_exp_api_create_params__entry__3} | Request parameters | Possible values | Description | |-|-|-| | title | String | Required. Title of the vulnerability assessment record. | | cve | A single CVE ID, for example "CVE-2024-1234" | Optional. Associates the CVE as the Primary CVE on the new record. The request fails if the CVE ID doesn't match an existing record, or if there's already an active (non-closed) vulnerability assessment for that CVE. The error doesn't return the existing record's sys_id, so check for an existing assessment first if you need to find it. | | source | Any string that identifies the calling system, for example "Qualys" | Optional. | | autoCreateVitsAvits | true or false | Optional. Sets the Auto-create VITs/AVITs field on the new record. Defaults to false. | | priority | 1, 2, 3, 4, or 5 | Optional. The request fails if you pass a value outside this range. | [ ] {#vr-va-ws-cve-exposure-assessment-api__table_cve_exp_api_create_params} Request example. {"title": "Assess CVE-2024-1234", "cve": "CVE-2024-1234", "source": "Qualys", "autoCreateVitsAvits": false, "priority": "2"} On success, the API returns an HTTP 201 status and the sys_id of the new record. { "result": { "sysId": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6" } } If title is missing, priority is outside the valid range, cve doesn't match an existing CVE, or an active assessment already exists for that CVE, the API rejects the request with an HTTP 400 error and an error message describing which check failed. **Related tasks** * [Create a vulnerability assessment record](https://www.servicenow.com/docs/rDKgGA~BMRD1gf5bu7UKdw "Create assessment records for vulnerabilities of interest. After you create the assessment, you can initiate initial risk assessment, manually update the record, and calculate the risk score automatically.") * [Perform an assessment](https://www.servicenow.com/docs/PACGsT8ChB8WnJnZYHyB1A "After you’ve created the vulnerability assessment record and updated the risk attribute fields, run an assessment of the event record.") * [Add CVEs to assess exposure](https://www.servicenow.com/docs/m8_tpeVH2yrHq9FY2FKyjQ "Add Common Vulnerabilities and Exposures (CVEs) to the exposure configuration list of CVEs in Exposure Assessment to assess the impact of a new vulnerability or zero-day vulnerability.")