curl --request POST \
--url https://v1.api.altostrat.io/scans/cve/mac-address/cves \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"mac_addresses": [
"00:1A:2B:3C:4D:5E",
"08:00:27:7C:2E:5A"
]
}
'import requests
url = "https://v1.api.altostrat.io/scans/cve/mac-address/cves"
payload = { "mac_addresses": ["00:1A:2B:3C:4D:5E", "08:00:27:7C:2E:5A"] }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({mac_addresses: ['00:1A:2B:3C:4D:5E', '08:00:27:7C:2E:5A']})
};
fetch('https://v1.api.altostrat.io/scans/cve/mac-address/cves', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://v1.api.altostrat.io/scans/cve/mac-address/cves",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'mac_addresses' => [
'00:1A:2B:3C:4D:5E',
'08:00:27:7C:2E:5A'
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://v1.api.altostrat.io/scans/cve/mac-address/cves"
payload := strings.NewReader("{\n \"mac_addresses\": [\n \"00:1A:2B:3C:4D:5E\",\n \"08:00:27:7C:2E:5A\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://v1.api.altostrat.io/scans/cve/mac-address/cves")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"mac_addresses\": [\n \"00:1A:2B:3C:4D:5E\",\n \"08:00:27:7C:2E:5A\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://v1.api.altostrat.io/scans/cve/mac-address/cves")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"mac_addresses\": [\n \"00:1A:2B:3C:4D:5E\",\n \"08:00:27:7C:2E:5A\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"mac_addresses": [
"00:1A:2B:3C:4D:5E"
],
"total_scans": 5,
"total_cve_instances": 23,
"total_host_count": 8,
"mac_stats": {},
"stats": {
"unique_cve_count": 15,
"highest_score": 9.8,
"average_score": 7.5
},
"cves": [
{
"id": "9c46d2a1-1234-5678-9abc-def012345678",
"cve_id": "CVE-2021-44228",
"description": "Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints.",
"published_at": "2021-12-10T11:15:00Z",
"created_at": "2025-10-29T12:10:00Z",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"score": 10,
"severity": "CRITICAL",
"scan_id": "9c46a6f1-a8d8-4f5a-9b2f-7d1b3e9c5a1d",
"compliance_tags": [
"PCI-DSS",
"HIPAA",
"NIST"
],
"host": {
"id": "9c46d4e5-a1b2-c3d4-e5f6-a1b2c3d4e5f6",
"hostname": "fileserver.local",
"mac_address": "00:1A:2B:3C:4D:5E",
"manufacturer": "Apple, Inc.",
"ip_address": "192.168.1.101"
},
"status": "open",
"other_occurrences": [
{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"scan_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"host_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"created_at": "2023-11-07T05:31:56Z"
}
]
}
]
}{
"type": "invalid_request_error",
"code": "parameter_missing",
"message": "The 'description' parameter is required for this request.",
"doc_url": "https://docs.altostrat.io/errors/parameter_missing"
}{
"type": "invalid_request_error",
"code": "parameter_missing",
"message": "The 'description' parameter is required for this request.",
"doc_url": "https://docs.altostrat.io/errors/parameter_missing"
}{
"type": "invalid_request_error",
"code": "parameter_missing",
"message": "The 'description' parameter is required for this request.",
"doc_url": "https://docs.altostrat.io/errors/parameter_missing"
}Get CVEs by MAC Address
Retrieves all discovered vulnerabilities (CVEs) associated with a specific list of MAC addresses across all historical scans. This is the primary endpoint for tracking a device’s vulnerability history.
Note: This endpoint uses POST to allow for querying multiple MAC addresses in the request body, which is more robust and secure than a lengthy GET URL.
curl --request POST \
--url https://v1.api.altostrat.io/scans/cve/mac-address/cves \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"mac_addresses": [
"00:1A:2B:3C:4D:5E",
"08:00:27:7C:2E:5A"
]
}
'import requests
url = "https://v1.api.altostrat.io/scans/cve/mac-address/cves"
payload = { "mac_addresses": ["00:1A:2B:3C:4D:5E", "08:00:27:7C:2E:5A"] }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({mac_addresses: ['00:1A:2B:3C:4D:5E', '08:00:27:7C:2E:5A']})
};
fetch('https://v1.api.altostrat.io/scans/cve/mac-address/cves', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://v1.api.altostrat.io/scans/cve/mac-address/cves",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'mac_addresses' => [
'00:1A:2B:3C:4D:5E',
'08:00:27:7C:2E:5A'
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://v1.api.altostrat.io/scans/cve/mac-address/cves"
payload := strings.NewReader("{\n \"mac_addresses\": [\n \"00:1A:2B:3C:4D:5E\",\n \"08:00:27:7C:2E:5A\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://v1.api.altostrat.io/scans/cve/mac-address/cves")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"mac_addresses\": [\n \"00:1A:2B:3C:4D:5E\",\n \"08:00:27:7C:2E:5A\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://v1.api.altostrat.io/scans/cve/mac-address/cves")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"mac_addresses\": [\n \"00:1A:2B:3C:4D:5E\",\n \"08:00:27:7C:2E:5A\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"mac_addresses": [
"00:1A:2B:3C:4D:5E"
],
"total_scans": 5,
"total_cve_instances": 23,
"total_host_count": 8,
"mac_stats": {},
"stats": {
"unique_cve_count": 15,
"highest_score": 9.8,
"average_score": 7.5
},
"cves": [
{
"id": "9c46d2a1-1234-5678-9abc-def012345678",
"cve_id": "CVE-2021-44228",
"description": "Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints.",
"published_at": "2021-12-10T11:15:00Z",
"created_at": "2025-10-29T12:10:00Z",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"score": 10,
"severity": "CRITICAL",
"scan_id": "9c46a6f1-a8d8-4f5a-9b2f-7d1b3e9c5a1d",
"compliance_tags": [
"PCI-DSS",
"HIPAA",
"NIST"
],
"host": {
"id": "9c46d4e5-a1b2-c3d4-e5f6-a1b2c3d4e5f6",
"hostname": "fileserver.local",
"mac_address": "00:1A:2B:3C:4D:5E",
"manufacturer": "Apple, Inc.",
"ip_address": "192.168.1.101"
},
"status": "open",
"other_occurrences": [
{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"scan_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"host_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"created_at": "2023-11-07T05:31:56Z"
}
]
}
]
}{
"type": "invalid_request_error",
"code": "parameter_missing",
"message": "The 'description' parameter is required for this request.",
"doc_url": "https://docs.altostrat.io/errors/parameter_missing"
}{
"type": "invalid_request_error",
"code": "parameter_missing",
"message": "The 'description' parameter is required for this request.",
"doc_url": "https://docs.altostrat.io/errors/parameter_missing"
}{
"type": "invalid_request_error",
"code": "parameter_missing",
"message": "The 'description' parameter is required for this request.",
"doc_url": "https://docs.altostrat.io/errors/parameter_missing"
}Authorizations
Enter your bearer token in the format: Bearer {token}
Body
A list of MAC addresses to query.
An array of one or more MAC addresses to search for.
Response
A detailed list of CVEs found for the specified MAC addresses.
A comprehensive report of vulnerabilities for the requested MAC addresses.
The list of MAC addresses included in this report.
["00:1A:2B:3C:4D:5E"]The total number of unique scans where these MACs were found.
5
The total number of vulnerability instances found across all scans for these MACs.
23
The total number of host records (IP/port combinations) associated with these MACs.
8
A breakdown of vulnerability statistics for each requested MAC address.
Show child attributes
Show child attributes
Aggregated statistics across all requested MAC addresses.
Show child attributes
Show child attributes
A list of unique vulnerabilities found, along with their occurrences.
Show child attributes
Show child attributes
Was this page helpful?