Repository navigation
NVD API
Gustavo De Micheli edited this page Apr 13, 2026
·
1 revision
Dependency-check has moved from using the NVD data-feed to the NVD API. It is highly encouraged to obtain an NVD API Key; see Requesting an API Key. Without an NVD API Key, updating will be extremely slow.
The NVD API has enforced rate limits. If you are using a single API KEY and multiple builds occur you could hit the rate
limit and receive 403 errors. In a CI environment one must use a caching strategy, like caching the Database
(see Database Settings), or sharing the Data Directory between builds.
| Setting | Description | Default |
|---|---|---|
apiKey |
API Key for the NVD API | "" |
endpoint |
NVD API Endpoint | null |
requestDelay |
delay between requests for the NVD API | 0 |
maxRetryCount |
the maximum number of retry requests for a single call to the NVD API | 30 |
validForHours |
control the skipping of the check for NVD updates | 4 |
resultsPerPage |
control the results per page lower than NVD's default of 2000. |
null (2000) |
| Setting | Description | Default |
|---|---|---|
url |
URL for the NVD API Data Feed | null |
startYear |
starting year for the NVD CVE Data feed cache. |
null (2002) |
validForDays |
indicates how often the NVD API data feed needs to be updated before a full refresh is evaluated | 7 |
username |
username to use when connecting to the NVD Data feed. For use when NVD API Data is hosted as datafeeds locally on a site requiring HTTP-Basic-authentication. | null |
password |
password to authenticate to the NVD Data feed. For use when NVD API Data is hosted as datafeeds locally on a site requiring HTTP-Basic-authentication. | null |
bearerToken |
token to authenticate to the NVD Data feed. For use when NVD API Data is hosted as datafeeds locally on a site requiring HTTP-Bearer-authentication. | null |
| Setting | Description | Default |
|---|---|---|
driverName |
the database driver class name. An embedded database is used by default | org.h2.Driver |
driverPath |
the database driver class path | null |
connectionString |
the database connection string | jdbc:h2:file:%s;AUTOCOMMIT=ON;CACHE_SIZE=65536;RETENTION_TIME=1000;MAX_COMPACT_TIME=10000; |
username |
username to use when connecting to the database | dcuser |
password |
password to use when connecting to the database | |
batchInsertEnabled |
adds capabilities to batch insert. Tested on PostgreSQL and H2 | true |
batchInsertSize |
Size of database batch inserts | 1000 |
