{"id":"cra-exploit-clock","title":"CRA Exploited-Vulnerability Evidence and Art. 14 Deadline Clock","description":"Takes a CycloneDX or SPDX JSON SBOM (or a purl list), asks OSV.dev for the advisories that affect each exact component version (OSV evaluates the version ranges per ecosystem), then checks each CVE against the CISA Known Exploited Vulnerabilities catalog and the ENISA EUVD exploited-vulnerability index, and adds FIRST EPSS scores. Returns a per-component verdict, the evidence with source URLs and SHA-256 digests, and the Regulation (EU) 2024/2847 Article 14(2) dates computed in UTC from the awareness time and fix time you supply: early warning within 24 h, notification within 72 h, final report 14 days after a corrective or mitigating measure is available. Also drafts Art. 14(2) content from quoted feed text. Reports evidence and arithmetic, not a legal conclusion. Not legal advice: whether a vulnerability is actively exploited, when you became aware, and what to notify are your determination. A separate standalone awareness record is added only when issue_record is true; every response is in any case a hub-signed credential over its output and input digests. Fan-out is capped (1000 components, 120 advisory records); EUVD is checked per CVE up to 20 CVEs and above that by one read of its whole exploited list; partial results name what is missing. Deterministic, no model call.","roi":"Shows which SBOM components carry vulnerabilities listed as exploited by CISA or ENISA, and the 24 h, 72 h and 14-day Art. 14 dates from your awareness time.","audience":"developer","channels":["x402","mcp","rapidapi","apify"],"endpoint":{"method":"POST","url":"https://agents.writerslogic.com/api/v1/cra-exploit-clock","path":"/api/v1/cra-exploit-clock","contentType":"application/json"},"price":{"amount":"2.00","currency":"USDC","network":"base","perCall":true,"failedCallsCharged":false},"inputSchema":{"type":"object","additionalProperties":false,"properties":{"sbom":{"description":"CycloneDX 1.4-1.6 or SPDX 2.2/2.3 JSON SBOM, as an object or a JSON string, up to 5 MB. Components need a purl with a version (SPDX: a purl externalRef). Exactly one of sbom or purls.","anyOf":[{"type":"object"},{"type":"string","maxLength":5000000}]},"purls":{"type":"array","maxItems":1000,"items":{"type":"string","minLength":8,"maxLength":400},"description":"Alternative to sbom: versioned package URLs, e.g. pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1. Ecosystems: npm, pypi, maven, golang, cargo, nuget, gem, composer, hex, pub, swift."},"product":{"type":"object","additionalProperties":false,"required":["name"],"description":"Your product with digital elements; used only to fill the draft fields (defaults to the SBOM's own product name).","properties":{"name":{"type":"string","minLength":1,"maxLength":200},"version":{"type":"string","maxLength":100}}},"awareness_time":{"type":"string","maxLength":40,"description":"When the manufacturer became aware, ISO 8601 with UTC offset (e.g. 2026-11-04T09:30:00Z). Defaults to now. Taken as given; this agent cannot verify it."},"fix_available_at":{"type":"string","maxLength":40,"description":"When a corrective or mitigating measure became available, ISO 8601 with UTC offset; sets the Art. 14(2)(c) final-report date."},"issue_record":{"type":"boolean","description":"Default false. When true, adds a standalone awareness_record (evidence snapshot, SBOM digest, evaluation time; signed with the hub attestation key when configured) for you to retain. It does not switch off the hub's standard signed response credential, which every response carries and which already binds the output and input digests to a timestamp."}}},"resultSchema":{"type":"object","properties":{"verdict":{"type":"string","enum":["EXPLOITED_CANDIDATES_FOUND","NO_EXPLOITED_EVIDENCE","INSUFFICIENT_EVIDENCE"],"description":"NO_EXPLOITED_EVIDENCE only when every SBOM entry was fully checked."},"confidence":{"type":"object","description":"{score 0-1, label}: 0.95 with a CISA KEV listing, 0.85 EUVD only, 0.9 for absence, else 0.5 times the share of entries with a definitive answer."},"exposure":{"type":"object","description":"Art. 64(2) fine ceiling for breaching Art. 13/14: EUR 15 000 000 or 2.5% of worldwide turnover, whichever is higher. A ceiling, not an estimate."},"next_step":{"type":"object","description":"{code: ASSESS_AND_SUBMIT_EARLY_WARNING | RESOLVE_EVIDENCE_GAPS | MONITOR_FEEDS, by, detail}."},"top_evidence":{"type":"array","items":{"type":"object","description":"Up to 5 exploited CVEs, each with the sources behind it: {cve, component, sources[{source, url, sha256}]}. The sha256 is of the response body fetched from that url."}},"summary":{"type":"string"},"not_legal_advice":{"type":"string","description":"Caveat: evidence and arithmetic only; the 'actively exploited' and 'aware' determinations are the manufacturer's."},"awareness":{"type":"object","description":"{time, source: caller | evaluation_time, attested, note}. A caller-supplied time is never attested unless issue_record is true, and even then it is recorded as caller-asserted."},"deadlines":{"type":"object","description":"early_warning_due (+24 h), notification_due (+72 h), final_report_due (fix_available_at + 14 days, or null), hours remaining at evaluation, applies (exploitation evidence found and awareness on or after the 2026-09-11 application date of Art. 14, Art. 71(2)), and legal_basis citing Regulation (EU) 2024/2847 Art. 14(2) with the source URL."},"sbom":{"type":"object","description":"format, spec_version, sha256, bytes, entries, evaluated, skipped[{ref, name, reason}]."},"counts":{"type":"object","description":"Entries per component verdict."},"exploited_vulnerabilities":{"type":"array","items":{"type":"object","description":"Per CVE: components, kev entry (date_added, ransomware use), euvd record (id, exploited_since, url), epss, earliest_exploitation_evidence_date, osv_advisories with URLs."}},"components":{"type":"array","items":{"type":"object","description":"Per entry: purl, verdict (EXPLOITED_REPORTABLE_CANDIDATE | KNOWN_VULN_NOT_EXPLOITED | NO_MATCH | INSUFFICIENT_EVIDENCE), affected_range_match (OSV_AFFECTED | OSV_NOT_AFFECTED | NOT_EVALUATED), advisories[], kev, kev_date_added, epss, euvd_exploited, evidence_gaps. Skipped entries carry reason instead."}},"art14_draft_fields":{"type":"array","items":{"type":"object","description":"Draft Art. 14(2)(a)-(c) content per exploited CVE, quoted from feed text with source URLs; a draft, never a filing."}},"feed_snapshots":{"type":"object","description":"KEV catalog version and release date, EPSS score date, EUVD and OSV query times."},"sources":{"type":"array","items":{"type":"object","description":"Per feed: url, status, requests, sha256 (a single response body, or a digest over every request's url and hash), fetched_at, errors."}},"coverage":{"type":"object","description":"complete, missing[], upstream_calls, elapsed_ms. Partial results name what is missing."},"awareness_record":{"anyOf":[{"type":"object","description":"Null unless issue_record is true (the response credential is signed regardless). When present: evaluated_at, awareness_time and its source, sbom_sha256, exploited CVEs, feed snapshots, source digests, digest_sha256 and an optional signature."},{"type":"null"}]}}},"outputSchema":{"type":"object","properties":{"data":{"type":"object","properties":{"verdict":{"type":"string","enum":["EXPLOITED_CANDIDATES_FOUND","NO_EXPLOITED_EVIDENCE","INSUFFICIENT_EVIDENCE"],"description":"NO_EXPLOITED_EVIDENCE only when every SBOM entry was fully checked."},"confidence":{"type":"object","description":"{score 0-1, label}: 0.95 with a CISA KEV listing, 0.85 EUVD only, 0.9 for absence, else 0.5 times the share of entries with a definitive answer."},"exposure":{"type":"object","description":"Art. 64(2) fine ceiling for breaching Art. 13/14: EUR 15 000 000 or 2.5% of worldwide turnover, whichever is higher. A ceiling, not an estimate."},"next_step":{"type":"object","description":"{code: ASSESS_AND_SUBMIT_EARLY_WARNING | RESOLVE_EVIDENCE_GAPS | MONITOR_FEEDS, by, detail}."},"top_evidence":{"type":"array","items":{"type":"object","description":"Up to 5 exploited CVEs, each with the sources behind it: {cve, component, sources[{source, url, sha256}]}. The sha256 is of the response body fetched from that url."}},"summary":{"type":"string"},"not_legal_advice":{"type":"string","description":"Caveat: evidence and arithmetic only; the 'actively exploited' and 'aware' determinations are the manufacturer's."},"awareness":{"type":"object","description":"{time, source: caller | evaluation_time, attested, note}. A caller-supplied time is never attested unless issue_record is true, and even then it is recorded as caller-asserted."},"deadlines":{"type":"object","description":"early_warning_due (+24 h), notification_due (+72 h), final_report_due (fix_available_at + 14 days, or null), hours remaining at evaluation, applies (exploitation evidence found and awareness on or after the 2026-09-11 application date of Art. 14, Art. 71(2)), and legal_basis citing Regulation (EU) 2024/2847 Art. 14(2) with the source URL."},"sbom":{"type":"object","description":"format, spec_version, sha256, bytes, entries, evaluated, skipped[{ref, name, reason}]."},"counts":{"type":"object","description":"Entries per component verdict."},"exploited_vulnerabilities":{"type":"array","items":{"type":"object","description":"Per CVE: components, kev entry (date_added, ransomware use), euvd record (id, exploited_since, url), epss, earliest_exploitation_evidence_date, osv_advisories with URLs."}},"components":{"type":"array","items":{"type":"object","description":"Per entry: purl, verdict (EXPLOITED_REPORTABLE_CANDIDATE | KNOWN_VULN_NOT_EXPLOITED | NO_MATCH | INSUFFICIENT_EVIDENCE), affected_range_match (OSV_AFFECTED | OSV_NOT_AFFECTED | NOT_EVALUATED), advisories[], kev, kev_date_added, epss, euvd_exploited, evidence_gaps. Skipped entries carry reason instead."}},"art14_draft_fields":{"type":"array","items":{"type":"object","description":"Draft Art. 14(2)(a)-(c) content per exploited CVE, quoted from feed text with source URLs; a draft, never a filing."}},"feed_snapshots":{"type":"object","description":"KEV catalog version and release date, EPSS score date, EUVD and OSV query times."},"sources":{"type":"array","items":{"type":"object","description":"Per feed: url, status, requests, sha256 (a single response body, or a digest over every request's url and hash), fetched_at, errors."}},"coverage":{"type":"object","description":"complete, missing[], upstream_calls, elapsed_ms. Partial results name what is missing."},"awareness_record":{"anyOf":[{"type":"object","description":"Null unless issue_record is true (the response credential is signed regardless). When present: evaluated_at, awareness_time and its source, sbom_sha256, exploited CVEs, feed snapshots, source digests, digest_sha256 and an optional signature."},{"type":"null"}]}}},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]},"example":{"sbom":{"bomFormat":"CycloneDX","specVersion":"1.5","version":1,"metadata":{"component":{"type":"application","name":"acme-gateway","version":"3.2.0"}},"components":[{"type":"library","bom-ref":"log4j-core","group":"org.apache.logging.log4j","name":"log4j-core","version":"2.14.1","purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1"},{"type":"library","bom-ref":"lodash","name":"lodash","version":"4.17.15","purl":"pkg:npm/lodash@4.17.15"},{"type":"library","bom-ref":"left-pad","name":"left-pad","version":"1.3.0","purl":"pkg:npm/left-pad@1.3.0"}]},"product":{"name":"acme-gateway","version":"3.2.0"}},"openapiOperation":{"operationId":"cra_exploit_clock","summary":"CRA Exploited-Vulnerability Evidence and Art. 14 Deadline Clock","description":"Takes a CycloneDX or SPDX JSON SBOM (or a purl list), asks OSV.dev for the advisories that affect each exact component version (OSV evaluates the version ranges per ecosystem), then checks each CVE against the CISA Known Exploited Vulnerabilities catalog and the ENISA EUVD exploited-vulnerability index, and adds FIRST EPSS scores. Returns a per-component verdict, the evidence with source URLs and SHA-256 digests, and the Regulation (EU) 2024/2847 Article 14(2) dates computed in UTC from the awareness time and fix time you supply: early warning within 24 h, notification within 72 h, final report 14 days after a corrective or mitigating measure is available. Also drafts Art. 14(2) content from quoted feed text. Reports evidence and arithmetic, not a legal conclusion. Not legal advice: whether a vulnerability is actively exploited, when you became aware, and what to notify are your determination. A separate standalone awareness record is added only when issue_record is true; every response is in any case a hub-signed credential over its output and input digests. Fan-out is capped (1000 components, 120 advisory records); EUVD is checked per CVE up to 20 CVEs and above that by one read of its whole exploited list; partial results name what is missing. Deterministic, no model call.\n\nPrice: 2.00 USDC on Base (x402).","x-x402-price-usdc":"2.00","x-x402-amount":"2000000","x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"2.00"}},"x-audience":"developer","x-sample-url":"https://agents.writerslogic.com/api/v1/samples/cra-exploit-clock","security":[{"x402":[]},{"apiKey":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"properties":{"sbom":{"description":"CycloneDX 1.4-1.6 or SPDX 2.2/2.3 JSON SBOM, as an object or a JSON string, up to 5 MB. Components need a purl with a version (SPDX: a purl externalRef). Exactly one of sbom or purls.","anyOf":[{"type":"object"},{"type":"string","maxLength":5000000}]},"purls":{"type":"array","maxItems":1000,"items":{"type":"string","minLength":8,"maxLength":400},"description":"Alternative to sbom: versioned package URLs, e.g. pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1. Ecosystems: npm, pypi, maven, golang, cargo, nuget, gem, composer, hex, pub, swift."},"product":{"type":"object","additionalProperties":false,"required":["name"],"description":"Your product with digital elements; used only to fill the draft fields (defaults to the SBOM's own product name).","properties":{"name":{"type":"string","minLength":1,"maxLength":200},"version":{"type":"string","maxLength":100}}},"awareness_time":{"type":"string","maxLength":40,"description":"When the manufacturer became aware, ISO 8601 with UTC offset (e.g. 2026-11-04T09:30:00Z). Defaults to now. Taken as given; this agent cannot verify it."},"fix_available_at":{"type":"string","maxLength":40,"description":"When a corrective or mitigating measure became available, ISO 8601 with UTC offset; sets the Art. 14(2)(c) final-report date."},"issue_record":{"type":"boolean","description":"Default false. When true, adds a standalone awareness_record (evidence snapshot, SBOM digest, evaluation time; signed with the hub attestation key when configured) for you to retain. It does not switch off the hub's standard signed response credential, which every response carries and which already binds the output and input digests to a timestamp."}}},"example":{"sbom":{"bomFormat":"CycloneDX","specVersion":"1.5","version":1,"metadata":{"component":{"type":"application","name":"acme-gateway","version":"3.2.0"}},"components":[{"type":"library","bom-ref":"log4j-core","group":"org.apache.logging.log4j","name":"log4j-core","version":"2.14.1","purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1"},{"type":"library","bom-ref":"lodash","name":"lodash","version":"4.17.15","purl":"pkg:npm/lodash@4.17.15"},{"type":"library","bom-ref":"left-pad","name":"left-pad","version":"1.3.0","purl":"pkg:npm/left-pad@1.3.0"}]},"product":{"name":"acme-gateway","version":"3.2.0"}}}}},"responses":{"200":{"description":"Paid result with provenance","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"verdict":{"type":"string","enum":["EXPLOITED_CANDIDATES_FOUND","NO_EXPLOITED_EVIDENCE","INSUFFICIENT_EVIDENCE"],"description":"NO_EXPLOITED_EVIDENCE only when every SBOM entry was fully checked."},"confidence":{"type":"object","description":"{score 0-1, label}: 0.95 with a CISA KEV listing, 0.85 EUVD only, 0.9 for absence, else 0.5 times the share of entries with a definitive answer."},"exposure":{"type":"object","description":"Art. 64(2) fine ceiling for breaching Art. 13/14: EUR 15 000 000 or 2.5% of worldwide turnover, whichever is higher. A ceiling, not an estimate."},"next_step":{"type":"object","description":"{code: ASSESS_AND_SUBMIT_EARLY_WARNING | RESOLVE_EVIDENCE_GAPS | MONITOR_FEEDS, by, detail}."},"top_evidence":{"type":"array","items":{"type":"object","description":"Up to 5 exploited CVEs, each with the sources behind it: {cve, component, sources[{source, url, sha256}]}. The sha256 is of the response body fetched from that url."}},"summary":{"type":"string"},"not_legal_advice":{"type":"string","description":"Caveat: evidence and arithmetic only; the 'actively exploited' and 'aware' determinations are the manufacturer's."},"awareness":{"type":"object","description":"{time, source: caller | evaluation_time, attested, note}. A caller-supplied time is never attested unless issue_record is true, and even then it is recorded as caller-asserted."},"deadlines":{"type":"object","description":"early_warning_due (+24 h), notification_due (+72 h), final_report_due (fix_available_at + 14 days, or null), hours remaining at evaluation, applies (exploitation evidence found and awareness on or after the 2026-09-11 application date of Art. 14, Art. 71(2)), and legal_basis citing Regulation (EU) 2024/2847 Art. 14(2) with the source URL."},"sbom":{"type":"object","description":"format, spec_version, sha256, bytes, entries, evaluated, skipped[{ref, name, reason}]."},"counts":{"type":"object","description":"Entries per component verdict."},"exploited_vulnerabilities":{"type":"array","items":{"type":"object","description":"Per CVE: components, kev entry (date_added, ransomware use), euvd record (id, exploited_since, url), epss, earliest_exploitation_evidence_date, osv_advisories with URLs."}},"components":{"type":"array","items":{"type":"object","description":"Per entry: purl, verdict (EXPLOITED_REPORTABLE_CANDIDATE | KNOWN_VULN_NOT_EXPLOITED | NO_MATCH | INSUFFICIENT_EVIDENCE), affected_range_match (OSV_AFFECTED | OSV_NOT_AFFECTED | NOT_EVALUATED), advisories[], kev, kev_date_added, epss, euvd_exploited, evidence_gaps. Skipped entries carry reason instead."}},"art14_draft_fields":{"type":"array","items":{"type":"object","description":"Draft Art. 14(2)(a)-(c) content per exploited CVE, quoted from feed text with source URLs; a draft, never a filing."}},"feed_snapshots":{"type":"object","description":"KEV catalog version and release date, EPSS score date, EUVD and OSV query times."},"sources":{"type":"array","items":{"type":"object","description":"Per feed: url, status, requests, sha256 (a single response body, or a digest over every request's url and hash), fetched_at, errors."}},"coverage":{"type":"object","description":"complete, missing[], upstream_calls, elapsed_ms. Partial results name what is missing."},"awareness_record":{"anyOf":[{"type":"object","description":"Null unless issue_record is true (the response credential is signed regardless). When present: evaluated_at, awareness_time and its source, sbom_sha256, exploited CVEs, feed snapshots, source digests, digest_sha256 and an optional signature."},{"type":"null"}]}}},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]}}}},"400":{"description":"Invalid request (no payment consumed)","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"401":{"description":"Invalid X-API-KEY","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"402":{"description":"Payment required or invalid","content":{"application/json":{"schema":{"type":"object","description":"x402 v2 PaymentRequired (also base64 in the PAYMENT-REQUIRED header)","properties":{"x402Version":{"type":"integer"},"error":{"type":"string"},"code":{"type":"string"},"resource":{"type":"object"},"accepts":{"type":"array","items":{"type":"object"}},"extensions":{"type":"object"}}}}}},"502":{"description":"Upstream failure; the payment is released or not settled","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}}}},"links":{"docs":"https://agents.writerslogic.com/docs/cra-exploit-clock/","docsJson":"https://agents.writerslogic.com/docs/cra-exploit-clock.json","sample":"https://agents.writerslogic.com/api/v1/samples/cra-exploit-clock","openapi":"https://agents.writerslogic.com/openapi.json","catalog":"https://agents.writerslogic.com/api/v1/catalog","verifyProvenance":"https://agents.writerslogic.com/api/v1/verify-provenance","index":"https://agents.writerslogic.com/docs/index.json"}}