{"bulk_dumps":{"available":true,"note":"Optional, instance-specific open-data convenience \u2014 not a sync mechanism. Re-pulling a full export on a schedule is worse for the server than an API client using since= and yields stale data between runs.","url":"https://vulnerability.circl.lu/dumps/"},"contact":{"email":"mailto:info@circl.lu","url":"https://vulnerability.circl.lu/about"},"documentation":{"access_patterns":"https://www.vulnerability-lookup.org/documentation/access-patterns.html","api":"https://vulnerability.circl.lu/api","general":"https://www.vulnerability-lookup.org/documentation"},"expires":"2027-05-10T05:54:26+00:00","instance":{"base_url":"https://vulnerability.circl.lu","name":"Vulnerability Lookup","operator":"Computer Incident Response Center Luxembourg (CIRCL)","operator_url":"https://www.circl.lu","uuid":"1a89b78e-f703-45f3-bb86-59eb712668bd"},"policy_url":"https://vulnerability.circl.lu/.well-known/api-policy.json","rate_limits":{"enforced":true,"key":"X-API-KEY when present (per-key bucket); IP address otherwise.","limits":{"anonymous":"60 per minute","authenticated":"1/second"},"policy":"Enforced rate limits are advertised in the rate_limits block of this document and via standard X-RateLimit-* response headers.","runtime_headers":"X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset are emitted on rate-limited responses; 429 responses carry Retry-After."},"sync":{"canonical_path":"api+stream","guidance":"Use the API for synchronisation. The 'since=' parameter on /api/vulnerability/ (and equivalent endpoints) supports incremental pulls. The pub/sub stream provides real-time updates without polling. Do not enumerate the API to mirror the dataset.","incremental_endpoint":"/api/vulnerability/?since=YYYY-MM-DD","stream_auth":"X-API-KEY header (per-user API token)","stream_available":true,"stream_endpoint":"/pubsub/subscribe/{topic}","stream_format":"text/event-stream (Server-Sent Events)","stream_topics":["comment","bundle","sighting","vulnerability"]},"user_agent":{"expectation":"Identify automated clients with a meaningful User-Agent string that includes a contact URL or email."},"version":"1"}