Standard tier API
The Standard Threat Intelligence API is the entry-level tier of the v2 API. It returns every advisory that applies to a single WordPress plugin, theme or core version. If you need bulk lookups, the latest-24h feed, or advisory-by-id details, see the Extended tier.
Interactive reference: Every endpoint, parameter and response shape is documented in the Threat Intelligence API (Standard) reference.
Tooling (Postman, SDK, LLM): spec URLs and import instructions for all three tiers live on Overview → Using the APIs with your tools.
This page covers the concepts you need to use the API effectively — authentication, rate limiting, errors, and code samples. Use it alongside the interactive reference.
Base URL
Section titled “Base URL”https://patchstack.com/database/api/v2/Authentication
Section titled “Authentication”Every request must include your API key in the PSKey HTTP request header. You can request an API key from your Patchstack App billing page.
PSKey: <your-api-key>Response format
Section titled “Response format”All responses are JSON. Responses are cached until the Patchstack database updates, at which point the cache is cleared.
The Standard tier returns a flat per-item shape. For the richer shape with description, vuln_type, cvss_score, cve, and patched_in_ranges, use the Extended tier. Field definitions live in API properties.
Rate limiting
Section titled “Rate limiting”Standard is limited to 5,000 requests per 24 hours. Contact https://patchstack.com/for-hosts/ if you need a higher quota or the Extended tier.
Errors
Section titled “Errors”| Status | Meaning |
|---|---|
401 Unauthorized | Missing or invalid PSKey header. |
403 Forbidden | API key not authorised for the requested endpoint. |
404 Not Found | Unknown product/version combination. |
429 Too Many Requests | Rate limit exceeded. |
500 | Server error — please include the request id in any bug report. |
Testing — curl one-liners
Section titled “Testing — curl one-liners”# Full advisory list for a plugin versioncurl 'https://patchstack.com/database/api/v2/product/plugin/tutor/1.5.2' \ -H 'PSKey: <your-api-key>'
# Boolean-only exists check (faster)curl 'https://patchstack.com/database/api/v2/product/plugin/tutor/1.5.2/exists' \ -H 'PSKey: <your-api-key>'
# WordPress corecurl 'https://patchstack.com/database/api/v2/product/wordpress/wordpress/5.8.2' \ -H 'PSKey: <your-api-key>'More information
Section titled “More information”You can find more information about the Patchstack Threat Intelligence API on https://patchstack.com/for-hosts/. If you have integration questions, email dave.jong@patchstack.com.