---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# CVE Exposure Assessment REST API

# CVE Exposure Assessment REST API {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Review the following information before using the CVE Exposure Assessment REST API to trigger a CVE exposure assessment or create a vulnerability assessment record from an external
system.

To call either operation in this API, the sn_vul_analyst.emergency_response role is required. If you don't pass a source value in the request body, the system records `VR-SNOW` so the
calling system is still identifiable.

## Assess CVEs {#vr-va-ws-cve-exposure-assessment-api__section_cve_exp_api_assess_cves}

Accepts one or more CVE IDs and triggers the same exposure assessment that the Get CVE exposure action triggers in the [Vulnerability Assessment Workspace](https://www.servicenow.com/docs/QlkmEQ8cn7CeyR5wNOGqrA "The Vulnerability Assessment Workspace is designed for the Vulnerability event manager to perform exposure assessment, and proactively manage critical vulnerability events especially during the critical vulnerability events such as a zero-day event."). CVE IDs that don't match a CVE entry in your instance aren't treated as a failure: the request still succeeds, and those IDs are
returned separately so you can identify them.

HTTP method: (POST)  
API URL: \<host_name\>/api/sn_vul_analyst/exposure_assessment/cve  
Note:  
\<host_name\> is your ServiceNow instance name.
{#vr-va-ws-cve-exposure-assessment-api__table_cve_exp_api_assess_params__entry__3}

| Request parameters | Possible values | Description |
|-|-|-|
| cveIds | Array of CVE ID strings, for example \["CVE-2024-1234", "CVE-2024-5678"\] | Required. The request fails if this array is missing or empty. |
| source | Any string that identifies the calling system, for example "Qualys" | Optional. |
[ ]

{#vr-va-ws-cve-exposure-assessment-api__table_cve_exp_api_assess_params}

Request example.

    {"cveIds": ["CVE-2024-1234", "CVE-2024-5678"], "source": "Qualys"}

Response example. existingCves lists CVE IDs that were already tracked for exposure before this call, and newCves lists the ones this call newly enabled.
jobStatusLink is an HTML link, not a plain URL: parse the `href` attribute if you need the link target programmatically.

    {
      "result": {
        "notFoundCveIds": ["CVE-2024-9999"],
        "existingCves": ["CVE-2024-1234"],
        "newCves": ["CVE-2024-5678"],
        "jobStatusLink": "<a href=/nav_to.do?uri=sn_sec_cmn_background_job.do%3Fsys_id%3D... target=\"_blank\">View Status</a>"
      }
    }

If cveIds isn't a non-empty array, the API rejects the request with an HTTP 400 error.

## Create a vulnerability assessment {#vr-va-ws-cve-exposure-assessment-api__section_cve_exp_api_create_assessment}

Creates a vulnerability assessment record the same way the Create Vulnerability Assessment action does in the [Vulnerability Assessment Workspace](https://www.servicenow.com/docs/QlkmEQ8cn7CeyR5wNOGqrA "The Vulnerability Assessment Workspace is designed for the Vulnerability event manager to perform exposure assessment, and proactively manage critical vulnerability events especially during the critical vulnerability events such as a zero-day event."). Use this operation to create the record only, then use [Perform an assessment](https://www.servicenow.com/docs/aJn_wogN5sq4bVf0mOAPIA "After you’ve created the vulnerability assessment record and updated the risk attribute fields, run an assessment of the event record.") (or the Assess CVEs operation above) to run the assessment.

HTTP method: (POST)  
API URL: \<host_name\>/api/sn_vul_analyst/exposure_assessment/vulnerability_assessment  
Note:  
\<host_name\> is your ServiceNow instance name.
{#vr-va-ws-cve-exposure-assessment-api__table_cve_exp_api_create_params__entry__3}

| Request parameters | Possible values | Description |
|-|-|-|
| title | String | Required. Title of the vulnerability assessment record. |
| cve | A single CVE ID, for example "CVE-2024-1234" | Optional. Associates the CVE as the Primary CVE on the new record. The request fails if the CVE ID doesn't match an existing record, or if there's already an active (non-closed) vulnerability assessment for that CVE. The error doesn't return the existing record's sys_id, so check for an existing assessment first if you need to find it. |
| source | Any string that identifies the calling system, for example "Qualys" | Optional. |
| autoCreateVitsAvits | true or false | Optional. Sets the Auto-create VITs/AVITs field on the new record. Defaults to false. |
| priority | 1, 2, 3, 4, or 5 | Optional. The request fails if you pass a value outside this range. |
[ ]

{#vr-va-ws-cve-exposure-assessment-api__table_cve_exp_api_create_params}

Request example.

    {"title": "Assess CVE-2024-1234", "cve": "CVE-2024-1234", "source": "Qualys", "autoCreateVitsAvits": false, "priority": "2"}

On success, the API returns an HTTP 201 status and the sys_id of the new record.

    {
      "result": {
        "sysId": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6"
      }
    }

If title is missing, priority is outside the valid range, cve doesn't match an existing CVE, or an active assessment already exists for that CVE, the API
rejects the request with an HTTP 400 error and an error message describing which check failed.
**Related tasks**   

* [Create a vulnerability assessment record](https://www.servicenow.com/docs/DBqrTKlCM9klR9dycGSG8g "Create assessment records for vulnerabilities of interest. After you create the assessment, you can initiate initial risk assessment, manually update the record, and calculate the risk score automatically.")
* [Perform an assessment](https://www.servicenow.com/docs/aJn_wogN5sq4bVf0mOAPIA "After you’ve created the vulnerability assessment record and updated the risk attribute fields, run an assessment of the event record.")
* [Add CVEs to assess exposure](https://www.servicenow.com/docs/I9f0Jo5QI27EZLUPgG9SBg "Add Common Vulnerabilities and Exposures (CVEs) to the exposure configuration list of CVEs in Exposure Assessment to assess the impact of a new vulnerability or zero-day vulnerability.")