For developers

Connect DayBreach data to your own product

Everything you see on the site is also available through the API. Create an account, get your key and send your first request within a minute.

Get a free keyCreate an organisation account
Ücretsiz
No card or approval required
2.000
Requests per day (personal key)
10.000
Requests per day (organisation key)
6
Data feeds: vulnerabilities, news, leaks, breaches, gangs, details

API

Intelligence API documentation

Pull current vulnerabilities, the products they affect, news, leaks and gangs into your own screens. The API returns only public threat data and asks you for no inventory information: you match which of your systems are affected on your own side.

1. Get a key

Hesap Merkezi → API anahtarları page: create a key there. A key is shown only at the moment it is created; keep it as a secret setting on your server and do not embed it in a browser or a mobile app.

2. Send a request

Send the key in the x-api-key header.

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.enginteksut.com.tr/api/v1/intel/cves?vendor=microsoft&severity=CRITICAL&limit=20"

3. Read the response

Every response is a signed packet. The data is in manifest.data ; lists carry the fields items, total ve has_next as well.

{
  "manifest": {
    "kind": "cve_list",
    "generated_at": "2026-10-09T14:24:07.000Z",
    "data": { "items": [ { "id": "CVE-2026-…", "severity": "CRITICAL", "affected": [ … ] } ],
              "page": 1, "limit": 20, "total": 4400, "has_next": true }
  },
  "signature": "…",
  "algorithm": "Ed25519"
}

You can verify the signature with the key served at /intel/public-key : the signature covers the manifest object serialised as JSON with its keys in alphabetical order. For responses that have not changed, ETag / If-None-Match desteklenir.

Endpoints

GETPermissionsDescription
/intel/cvesAkışVulnerabilities, newest first. The q parameter accepts the query language.

q, vendor, product, severity, kev, exploit, since, page, limit

/intel/newsAkışSecurity news.

cve, since, page, limit

/intel/incidentsAkışRansomware leak announcements.

gang, country, sector, domain, since, page, limit

/intel/breachesAkışOfficial breach notices (KVKK, SEC 8-K, Have I Been Pwned).

source, country, q, since, page, limit

/intel/gangsAkışRansomware gangs.

q, page, limit

/intel/gangs/{slug}AkışA single gang, with its related vulnerabilities and latest leaks.
/intel/cves/{id}DetayThe full record of a single vulnerability: affected products and versions, references and patch assessment.
/intel/advisories/{id}DetayA single threat advisory.
/intel/changesDeğişikliklerRecords changed after the cursor you supply.

cursor, limit

/intel/snapshotTam kopyaA prebuilt, signed copy of the whole catalogue (a large file).
/intel/public-key—The key for verifying signatures. Requires no API key.

Finding the vulnerabilities that affect your systems

For each product you use, call /intel/cves?vendor=…&product=… , or use /intel/changes to fetch new records regularly and compare them with your own inventory. Each vulnerability's affected list contains the product name and the affected version range (versionRange). Because the comparison happens on your side, your inventory never leaves your network.

Connect your AI assistant (MCP)

DayBreach also works as an MCP server: Claude, Cursor or any other assistant that supports MCP can query vulnerabilities, leaks, breach notices and gangs directly with your key. You can ask, for example, “Which critical Fortinet vulnerabilities were published in the last month?”

Claude Code

claude mcp add --transport http daybreach https://api.enginteksut.com.tr/api/v1/mcp \
  --header "x-api-key: $DAYBREACH_API_KEY"

Cursor and similar tools (mcp.json)

{
  "mcpServers": {
    "daybreach": {
      "url": "https://api.enginteksut.com.tr/api/v1/mcp",
      "headers": { "x-api-key": "dbk_..." }
    }
  }
}

Tools: search_cves, get_cve, list_ransomware_incidents, list_breach_notices, search_gangs, get_gang, search_security_news. All of them are read-only and subject to your key's request limits.

Limits and errors

  • Every key has a per-minute request limit and a daily quota; the current values are shown in the key list.
  • 401 no key sent · 403 key invalid, revoked or not authorised · 429 limit exceeded.
  • Error responses have the form { "error": { "code", "message" } } (JSON).
  • In leak records, the claim_status field states whether the record is a claim or has been corroborated.