Ethiack Docs
Feed

List Marks

GET/api/v1/marks

Each matching entry's position on the timeline in days from t = 0, with counts over the whole set. Takes the GET /api/v1/feed filters. Past 1500 marks the list is a stable sample, in-flight entries first, and sampled is true; the counts stay exact. Marks are not in date order.

Query Parameters

window?string

Keep entries whose published_at is within the last 7 or 30 days. Omitted or any other value is all time.

Value in"7d" | "30d"
q?string

Case-insensitive substring of title, vendor, product, the first package's name or display_id.

check?boolean

Whether the entry has a check (check).

exploit?boolean

Whether the entry has a validated exploit (exploit).

kev?boolean

Whether the entry has a KEV listing (signals.kev).

poc?boolean

Whether the entry has a public PoC (signals.public_poc).

anchor_state?string

anchored: cve.org has published the CVE record. awaiting_cve: not yet. Other values match nothing.

Value in"anchored" | "awaiting_cve"
status?string

Exact status. Any other value matches nothing.

Value in"published" | "in_pipeline" | "triaged_in_scope" | "rejected_out_of_scope" | "retired"
automation?string

Exact automation. Any other value matches nothing.

Value in"deterministic" | "contextual"
vendor?string

Case-insensitive substring of vendor.

product?string

Case-insensitive substring of product.

package?string

Case-insensitive substring of the first package's package_name.

ecosystem?string

Exact, case-sensitive match on the first package's ecosystem, e.g. npm, go, pip. Spellings are not normalised.

since_days?integer

Entries whose published_at is within the last N days. 0 or less applies no filter, the same as omitting it; values above 3650 count as 3650; anything but the digits 0-9 is ignored.

Range0 <= value <= 3650

Response Body

application/json

application/json

curl -X GET "https://zero.ethiack.com/api/v1/marks?window=7d&check=true&anchor_state=awaiting_cve"
{
  "marks": [
    {
      "anchor_state": "awaiting_cve",
      "check": -1.4045258569791668,
      "display_id": "ETK-2026-1784",
      "etk_id": "ETK-2026-1784",
      "exploit": -1.4045258569791668,
      "kev": null,
      "kev_precision": null,
      "public_poc": null,
      "status": "published"
    },
    {
      "anchor_state": "awaiting_cve",
      "check": -2.1446134757986113,
      "display_id": "CVE-2026-77622",
      "etk_id": "ETK-2026-1723",
      "exploit": null,
      "kev": null,
      "kev_precision": null,
      "public_poc": -2.142368577858796,
      "status": "published"
    }
  ],
  "pre": 15,
  "sampled": false,
  "total": 15,
  "validated": 15
}
Empty
Empty
{
  "error": "internal"
}

List Entries GET

Entries, newest first (`seq` descending), with the feed-wide `summary`. Filters combine with AND. Boolean filters take lowercase `true` or `false` and ignore anything else. Text values are cut at 200 characters. To walk the whole feed, follow `next_cursor`: it is keyset on `seq` and stable while entries arrive. `page` is offset-based, so a page boundary can repeat or skip a row when entries arrive between requests.

List Live Runs GET

Analysis runs in progress, latest start first, at most 20.