How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Need help?

Contact us
Canonical

Ubuntu Security API

An open, unauthenticated API over Canonical's vulnerability data — Ubuntu Security Notices (USNs), CVE records with CVSS3 scoring, and per-release support status. Canonical publishes a Swagger 2.0 contract for it at https://ubuntu.com/security/api/spec.json and a Swagger UI at /security/api/docs. It is the most agent-friendly surface Canonical operates: read-only, needs no credential, and answers the question "is my Ubuntu package affected by this CVE?" directly.

Documentation Provider Profile APIs.io OpenAPI GitHub

Ubuntu Security API is one of 22 APIs that Canonical publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Security, CVE, and Vulnerability. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.

This API exposes 17 operations across 15 paths, and defines 46 schemas. It is described by OpenAPI 2.0.0, at version v1.

Requests are made against the base URL https://ubuntu.com.

17 operations 15 paths 46 schemas 3 DELETE9 GET2 POST3 PUT

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 2.0.0
API Version
v1
Base URL
https://ubuntu.com
Resource Areas
1

Paths & Operations 17

Across 15 paths, the API surfaces 17 operations — 3 DELETE, 9 GET, 2 POST, 3 PUT. Each is listed below with its method, path, parameters, and response codes.

Operations 17
GET
/security/compat/notices.json
8 params → 200422
GET
/security/compat/notices/{notice_id}.json
2 params → 200404
GET
/security/cves.json
13 params → 200422
GET
/security/cves/{cve_id}.json
2 params → 200404
GET
/security/notices.json
8 params → 200422
GET
/security/notices/{notice_id}.json
2 params → 200404
GET
/security/page/notices.json
8 params → 200422
GET
/security/releases.json
→ 200404
GET
/security/releases/{release_codename}.json
1 param → 200404
PUT
/security/updates/cves.json
1 param → 200400413422
DELETE
/security/updates/cves/{cve_id}.json
1 param → 200404
POST
/security/updates/notices.json
1 param → 200422
DELETE
/security/updates/notices/{notice_id}.json
1 param → 200404
PUT
/security/updates/notices/{notice_id}.json
2 params → 200404422
POST
/security/updates/releases.json
1 param → 200422
DELETE
/security/updates/releases/{release_codename}.json
1 param → 200400404
PUT
/security/updates/releases/{release_codename}.json
2 params → 200404422

Schemas 46

The contract defines 46 schemas that model the data the API accepts and returns. The most detailed are CVEAPIDetailed (19 properties), CVEAPI (18 properties), CVEImport (17 properties), CvssV4Import (14 properties). Each schema is shown below with its type and property counts.

CVEAPI
object
18 properties 1 required
CVEAPIDetailed
object
19 properties 1 required
CVEImport
object
17 properties 1 required
CVESummaryV2
object
2 properties
CVEsAPI
object
4 properties
CreateNoticeImport
object
10 properties 5 required
CveBaseMetric
object
3 properties
CveBaseMetricV4
object
1 property
CveBaseMetricV4Import
object
1 property
CveImpact
object
2 properties
CveImpactImport
object
2 properties
CvePackage
object
5 properties 4 required
CvssV3
object
12 properties
CvssV4
object
14 properties
CvssV4BaseMetrics
object
3 properties
CvssV4BaseMetricsImport
object
3 properties
CvssV4EnvironmentalMetrics
object
2 properties
CvssV4EnvironmentalMetricsImport
object
2 properties
CvssV4ExploitabilityMetrics
object
5 properties
CvssV4Import
object
14 properties
CvssV4ModifiedBaseMetrics
object
3 properties
CvssV4ModifiedBaseMetricsImport
object
3 properties
CvssV4SecurityRequirements
object
3 properties
CvssV4SubsequentSystemImpactMetrics
object
3 properties
CvssV4SupplementalMetrics
object
6 properties
CvssV4ThreatMetrics
object
1 property
CvssV4VulnerableSystemImpactMetrics
object
3 properties
Message
object
1 property
MessageWithErrors
object
2 properties
Note
object
2 properties 2 required
NoticeAPI
object
11 properties 5 required
NoticeAPIDetailed
object
14 properties 5 required
NoticeAPIDetailedSchemaV2
object
14 properties 5 required
NoticeImport
object
10 properties 5 required
NoticePackage
object
10 properties 3 required
NoticeReleases
object
3 properties
NoticesAPI
object
4 properties
NoticesAPISchemaV2
object
4 properties
PageNoticeAPI
object
8 properties 4 required
PageNoticesAPI
object
4 properties
RelatedNotices
object
2 properties
Release
object
8 properties 8 required
ReleaseAPI
object
9 properties 8 required
ReleasesAPI
object
1 property
Status
object
5 properties 2 required
UpdateRelease
object
8 properties 8 required

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

canonical-ubuntu-security-api-openapi.json Raw ↑

Other APIs Canonical publishes across the network.

Snap Store API
AE Profile APIs.io
Charmhub API
AE Profile APIs.io
snapd REST API
AE Profile APIs.io
MAAS API
AE Profile APIs.io
Juju Client / Controller API
AE Profile APIs.io
Launchpad Web Services API
AE Profile APIs.io
Ubuntu Pro Client API
AE Profile APIs.io
Landscape API
AE Profile APIs.io
Canonical Assertions API
AE Profile APIs.io
Canonical Search API
AE Profile APIs.io
Canonical Snaps API
AE Profile APIs.io
LXD REST API
AE Profile APIs.io
#Security#CVE#Vulnerability
← Back to U APIs
API Details
ID
canonical:ubuntu-security-api
Base URL
https://ubuntu.com
Docs
https://ubuntu.com/security/api/docs
Provider
Canonical
APIs.io →  GitHub →
Explore more
All APIs Providers APIs.io Network
Work with this as data

Every API here is available over the API and to AI agents over MCP. APIs is not yet its own endpoint on the v1 API. Reach this content through network search and the tag graph, or the MCP server below.

Installs https://mcp.apievangelist.com/mcp in Claude, Cursor, VS Code and the rest — one button, every client.

MCP tools for apis
4 tools reach this content
  • search_api_evangelistSearch every content type across the network at once.
  • find_relatedThe shared-tag relevance graph — what else covers this.
  • get_tagEverything one tag labels, across all content types.
  • guide_topicPRO — a curated bundle for a topic: area, guidance, rules, papers, stories, services.
All tools & prompts
Call it yourself
curl for this page
Search the network for this 
curl "https://api.apievangelist.com/v1/search?q=ubuntu-security-api&limit=10"
Everything under a tag 
curl "https://api.apievangelist.com/v1/tags/ubuntu-security-api"

Discovery needs no key. Full bodies and the synthesis endpoints are Pro.

Get an API key

Free tier, no email required. Sign in with whichever identity you already have.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have. Your account

Where this information came from

This is an independent, third-party profile of Ubuntu Security API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.